{"record":{"id":"6631a7249e3d848d","repo":"gravitational/teleport","slug":"tag-feature-is-not-enabled","errorCode":null,"errorMessage":"TAG feature is not enabled","messagePattern":"TAG feature is not enabled","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/srv/discovery/access_graph_aws.go","lineNumber":334,"sourceCode":"\t// 10MB compressed, but we want to be able to send the whole file in one go.\n\tconst maxMessageSize = 50 * 1024 * 1024 // 50MB\n\topts = append(opts,\n\t\topt,\n\t\tgrpc.WithUnaryInterceptor(metadata.UnaryClientInterceptor),\n\t\tgrpc.WithStreamInterceptor(metadata.StreamClientInterceptor),\n\t\tgrpc.WithDefaultCallOptions(\n\t\t\tgrpc.MaxCallRecvMsgSize(maxMessageSize),\n\t\t\tgrpc.MaxCallSendMsgSize(maxMessageSize),\n\t\t),\n\t)\n\n\tconn, err := grpc.DialContext(ctx, config.Addr, opts...)\n\treturn conn, trace.Wrap(err)\n}\n\n// errTAGFeatureNotEnabled is returned when the TAG feature is not enabled\n// in the cluster features.\nvar errTAGFeatureNotEnabled = errors.New(\"TAG feature is not enabled\")\n\nfunc accessGraphEntitlementEnabled(features *proto.Features) bool {\n\treturn features.GetAccessGraph() ||\n\t\tmodules.GetProtoEntitlement(features, entitlements.AccessGraph).Enabled\n}\n\nfunc activityCenterEntitlementEnabled(features *proto.Features) bool {\n\treturn modules.GetProtoEntitlement(features, entitlements.ActivityCenter).Enabled\n}\n\n// initializeAndWatchAccessGraph creates a new access graph service client and\n// watches the connection state. If the connection is closed, it will\n// automatically try to reconnect.\nfunc (s *Server) initializeAndWatchAccessGraph(ctx context.Context, reloadCh <-chan struct{}) error {\n\tconst (\n\t\t// aws discovery semaphore lock.\n\t\tsemaphoreName = \"access_graph_aws_sync\"\n\t)","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/discovery/access_graph_aws.go#L316-L352","documentation":"errTAGFeatureNotEnabled is a sentinel error returned when the cluster's license does not include the Teleport Identity Security (Access Graph / TAG) entitlement. The discovery service checks ClusterFeatures via accessGraphEntitlementEnabled before initializing Access Graph sync, and returns this error instead of starting sync workers. Callers match it with errors.Is to log a warning and skip Access Graph rather than fail the service.","triggerScenarios":"Calling initializeAndWatchAccessGraph, startCloudtrailPoller, or initializeAndWatchAzureAccessGraph when features.GetAccessGraph() is false and the proto entitlement entitlements.AccessGraph is not Enabled — i.e. Access Graph is configured in discovery config but the license lacks it, or the feature flag hasn't propagated to this cluster yet.","commonSituations":"Operators configure an AWS/Azure Access Graph discovery section without an enterprise license that includes Teleport Identity Security; license expiry downgrades entitlements; features not yet refreshed from the auth server after license upgrade.","solutions":["Upgrade to a Teleport Enterprise license that includes Teleport Identity Security (Access Graph)","Remove or comment out the Access Graph section from the discovery service config if TAG is not licensed","Verify the cluster's feature set (tctl status / cluster features) to confirm the access_graph entitlement is present","Restart the discovery service after applying a new license so features are re-fetched"],"exampleFix":"// before: discovery config enables TAG without license\ndiscovery_service:\n  aws:\n  - types: [\"access_graph\"]\n// after: either obtain a TAG-entitled license, or drop the matcher\n// discovery_service:\n//   aws: []  # TAG not licensed","handlingStrategy":"validation","validationCode":"feats := s.Config.ClusterFeatures()\nif !accessGraphEntitlementEnabled(&feats) {\n    // skip TAG config instead of attempting sync\n    log.WarnContext(ctx, \"license does not include Teleport Identity Security; skipping Access Graph\")\n    return nil\n}","typeGuard":"func accessGraphEntitlementEnabled(features *proto.Features) bool {\n    return features.GetAccessGraph() || modules.GetProtoEntitlement(features, entitlements.AccessGraph).Enabled\n}","tryCatchPattern":"err := s.initializeAndWatchAccessGraph(ctx, reloadCh)\nif errors.Is(err, errTAGFeatureNotEnabled) {\n    log.WarnContext(ctx, \"Access Graph specified in config, but license does not include Teleport Identity Security.\")\n    return nil\n}\nif err != nil { return trace.Wrap(err) }","preventionTips":["Check entitlements at startup before building discovery config","Validate license includes Access Graph when applying config with TAG matchers","Re-fetch cluster features after license changes and re-evaluate sync"],"tags":["licensing","feature-flag","access-graph","discovery"],"backgroundTag":"feature-not-entitled","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}