{"record":{"id":"98cb6821c6d59489","repo":"gravitational/teleport","slug":"failed-to-get-azure-subscription-ids-when-checking","errorCode":null,"errorMessage":"Failed to get Azure subscription IDs when checking a database created by the discovery service","messagePattern":"Failed to get Azure subscription IDs when checking a database created by the discovery service","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/db/cloud/resource_checker_credentials.go","lineNumber":138,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\t\tclient := c.awsClients.getSTSClient(awsCfg)\n\t\treturn aws.GetIdentityWithClient(ctx, client)\n\t})\n\treturn identity, trace.Wrap(err)\n}\n\nfunc (c *credentialsChecker) checkAzure(ctx context.Context, database types.Database) {\n\tallSubIDs, err := utils.FnCacheGet(ctx, c.cache, types.CloudAzure, func(ctx context.Context) ([]string, error) {\n\t\tclient, err := c.azureClients.GetSubscriptionClient(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, trace.Wrap(err)\n\t\t}\n\t\treturn client.ListSubscriptionIDs(ctx)\n\t})\n\tif err != nil {\n\t\tc.warn(ctx, \"Failed to get Azure subscription IDs when checking a database created by the discovery service\",\n\t\t\t\"error\", err,\n\t\t\t\"database\", database.GetName(),\n\t\t)\n\t\treturn\n\t}\n\n\trid, err := arm.ParseResourceID(database.GetAzure().ResourceID)\n\tif err != nil {\n\t\tc.logger.WarnContext(ctx, \"Failed to parse resource ID of database\",\n\t\t\t\"database\", database.GetName(),\n\t\t\t\"error\", err,\n\t\t)\n\t\treturn\n\t}\n\n\tif !slices.Contains(allSubIDs, rid.SubscriptionID) {\n\t\tc.warn(ctx, \"The discovered database is in a subscription that the database agent does not have access to\",\n\t\t\t\"database\", database.GetName(),","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/db/cloud/resource_checker_credentials.go#L120-L156","documentation":"Warning emitted when listing Azure subscriptions available to the database agent's credentials fails, so the checker cannot verify whether discovered Azure databases belong to an accessible subscription.","triggerScenarios":"Thrown at lib/srv/db/cloud/resource_checker_credentials.go:138 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the Azure credentials used by the agent (client ID/secret, tenant) are valid and not expired","Grant the credential permission to list subscriptions","Check network connectivity to Azure Resource Manager endpoints"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}