{"record":{"id":"b9f69f2588ba7069","repo":"gravitational/teleport","slug":"the-database-agent-s-identity-and-discovered-datab","errorCode":null,"errorMessage":"The database agent's identity and discovered database have different AWS account IDs","messagePattern":"The database agent's identity and discovered database have different AWS account IDs","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/db/cloud/resource_checker_credentials.go","lineNumber":99,"sourceCode":"\t\t\t\"database\", database.GetName(),\n\t\t\t\"cloud_type\", database.GetType(),\n\t\t)\n\t}\n\treturn nil\n}\n\nfunc (c *credentialsChecker) checkAWS(ctx context.Context, database types.Database) {\n\tmeta := database.GetAWS()\n\tidentity, err := c.getAWSIdentity(ctx, &meta)\n\tif err != nil {\n\t\tc.warn(ctx, \"Failed to get AWS identity when checking a database created by the discovery service\",\n\t\t\t\"database\", database.GetName(),\n\t\t)\n\t\treturn\n\t}\n\n\tif meta.AccountID != \"\" && meta.AccountID != identity.GetAccountID() {\n\t\tc.warn(ctx,\n\t\t\t\"The database agent's identity and discovered database have different AWS account IDs\",\n\t\t\t\"database\", database.GetName(),\n\t\t\t\"agent_account_id\", identity.GetAccountID(),\n\t\t\t\"discovered_account_id\", meta.AccountID,\n\t\t)\n\t\treturn\n\t}\n}\n\n// getAWSIdentity returns the identity used to access the given database,\n// that is either the agent's identity or the database's configured assume-role.\nfunc (c *credentialsChecker) getAWSIdentity(ctx context.Context, meta *types.AWS) (aws.Identity, error) {\n\tif meta.AssumeRoleARN != \"\" {\n\t\t// If the database has an assume role ARN, use that instead of\n\t\t// agent identity. This avoids an unnecessary sts call too.\n\t\treturn aws.IdentityFromArn(meta.AssumeRoleARN)\n\t}\n","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/db/cloud/resource_checker_credentials.go#L81-L117","documentation":"Warning emitted when the discovered database's AWS account ID differs from the account ID of the identity the database agent is running under: the agent's credentials belong to a different AWS account and will not be able to connect to that database.","triggerScenarios":"Thrown at lib/srv/db/cloud/resource_checker_credentials.go:99 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the database agent with credentials from the same AWS account as the discovered database","Or set up cross-account access (IAM role assumption) and configure discovery accordingly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}