gravitational/teleport · error

Failed to get AWS identity when checking a database created

Error message

Failed to get AWS identity when checking a database created by the discovery service

What it means

Warning (not a hard failure) emitted by the discovery/credentials checker: calling GetCallerIdentity/STS with the database agent's configured AWS credentials failed, so subsequent cross-account checks for AWS-hosted discovered databases cannot be performed.

Source

Thrown at lib/srv/db/cloud/resource_checker_credentials.go:92

	switch {
	case database.IsAWSHosted():
		c.checkAWS(ctx, database)
	case database.IsAzure():
		c.checkAzure(ctx, database)
	default:
		c.logger.DebugContext(ctx, "Database has unknown cloud type",
			"database", database.GetName(),
			"cloud_type", database.GetType(),
		)
	}
	return nil
}

func (c *credentialsChecker) checkAWS(ctx context.Context, database types.Database) {
	meta := database.GetAWS()
	identity, err := c.getAWSIdentity(ctx, &meta)
	if err != nil {
		c.warn(ctx, "Failed to get AWS identity when checking a database created by the discovery service",
			"database", database.GetName(),
		)
		return
	}

	if meta.AccountID != "" && meta.AccountID != identity.GetAccountID() {
		c.warn(ctx,
			"The database agent's identity and discovered database have different AWS account IDs",
			"database", database.GetName(),
			"agent_account_id", identity.GetAccountID(),
			"discovered_account_id", meta.AccountID,
		)
		return
	}
}

// getAWSIdentity returns the identity used to access the given database,
// that is either the agent's identity or the database's configured assume-role.

View on GitHub (pinned to 1283425b60)

Solutions

1. Verify the discovery/database agent's AWS credentials (IAM role/user, IRSA, or EC2 instance profile) are valid and not expired
2. Ensure the identity has permission to call sts:GetCallerIdentity
3. Check AWS region and network connectivity to the STS endpoint

When it happens

Trigger: Thrown at lib/srv/db/cloud/resource_checker_credentials.go:92 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/35a5f728db57cb6c. Report an issue: GitHub.