{"record":{"id":"693e2cdb491f1134","repo":"gravitational/teleport","slug":"no-access-graph-fetchers","errorCode":null,"errorMessage":"no Access Graph fetchers","messagePattern":"no Access Graph fetchers","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"info","filePath":"lib/srv/discovery/access_graph_aws.go","lineNumber":74,"sourceCode":"const (\n\t// batchSize is the maximum number of resources to send in a single\n\t// request to the access graph service.\n\tbatchSize = 500\n\t// defaultPollInterval is the default interval between polling for access graph resources\n\tdefaultPollInterval = 15 * time.Minute\n\t// Configure health check service to monitor access graph service and\n\t// automatically reconnect if the connection is lost without\n\t// relying on new events from the auth server to trigger a reconnect.\n\tserviceConfig = `{\n\t\t \"loadBalancingConfig\": [{\"round_robin\": {}}],\n\t\t \"healthCheckConfig\": {\n\t\t\t \"serviceName\": \"\"\n\t\t }\n\t }`\n)\n\n// errNoAccessGraphFetchers is returned when there are no TAG fetchers.\nvar errNoAccessGraphFetchers = errors.New(\"no Access Graph fetchers\")\n\nfunc (s *Server) reconcileAccessGraph(\n\tctx context.Context,\n\tcurrentTAGResources *aws_sync.Resources,\n\tstream accessgraphv1alpha.AccessGraphService_AWSEventsStreamClient,\n\tfeatures aws_sync.Features,\n\teksAuditLogWatcher *eksAuditLogWatcher,\n) error {\n\ttype fetcherResult struct {\n\t\tfetcher *aws_sync.Fetcher\n\t\tresult  *aws_sync.Resources\n\t\terr     error\n\t}\n\n\tallFetchers := s.getAllAWSSyncFetchers()\n\tif len(allFetchers) == 0 {\n\t\t// If there are no fetchers, we don't need to continue.\n\t\t// We will send a delete request for all resources and return.","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/discovery/access_graph_aws.go#L56-L92","documentation":"errNoAccessGraphFetchers is returned by the discovery server's Access Graph reconcile/watch functions when the configuration yields zero TAG fetchers (nothing to fetch or reconcile). Callers treat it as a benign terminal state and wait for config changes.","triggerScenarios":"reconcileAccessGraph/initializeAndWatchAccessGraph (AWS) or reconcileAccessGraphAzure/initializeAndWatchAzureAccessGraph (Azure) run with no configured AWS/Azure resources that require Access Graph fetching — e.g. no discovered EKS clusters or empty fetcher set.","commonSituations":"Teleport discovery configured without any Access Graph integrations; all AWS/Azure accounts filtered out by matchers; features flag disabling TAG sync.","solutions":["Expected/no-op when no Access Graph integration is configured — the watcher idles until config changes","If TAG sync is desired, add matching AWS/Azure matchers or enable the Access Graph feature flags in discovery config","Verify matcher configuration (labels, regions, account IDs) actually selects resources"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if len(fetchers) == 0 {\n    log.Info(\"no Access Graph fetchers configured; skipping reconcile\")\n    return nil\n}","typeGuard":null,"tryCatchPattern":"err := s.reconcileAccessGraph(ctx, res, stream, features, watcher)\nif errors.Is(err, errNoAccessGraphFetchers) {\n    return nil // benign: wait for config change\n}","preventionTips":["Use errors.Is on the sentinel to treat as benign","Validate discovery matchers select resources when TAG sync is desired","Enable Access Graph feature flags explicitly in config"],"tags":["discovery","aws","azure","access-graph","configuration"],"backgroundTag":"no-fetchers-configured","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}