gravitational/teleport · error

Failed to get Azure subscription IDs when checking a databas

Error message

Failed to get Azure subscription IDs when checking a database created by the discovery service

What it means

Warning emitted when listing Azure subscriptions available to the database agent's credentials fails, so the checker cannot verify whether discovered Azure databases belong to an accessible subscription.

Source

Thrown at lib/srv/db/cloud/resource_checker_credentials.go:138

		if err != nil {
			return nil, trace.Wrap(err)
		}
		client := c.awsClients.getSTSClient(awsCfg)
		return aws.GetIdentityWithClient(ctx, client)
	})
	return identity, trace.Wrap(err)
}

func (c *credentialsChecker) checkAzure(ctx context.Context, database types.Database) {
	allSubIDs, err := utils.FnCacheGet(ctx, c.cache, types.CloudAzure, func(ctx context.Context) ([]string, error) {
		client, err := c.azureClients.GetSubscriptionClient(ctx)
		if err != nil {
			return nil, trace.Wrap(err)
		}
		return client.ListSubscriptionIDs(ctx)
	})
	if err != nil {
		c.warn(ctx, "Failed to get Azure subscription IDs when checking a database created by the discovery service",
			"error", err,
			"database", database.GetName(),
		)
		return
	}

	rid, err := arm.ParseResourceID(database.GetAzure().ResourceID)
	if err != nil {
		c.logger.WarnContext(ctx, "Failed to parse resource ID of database",
			"database", database.GetName(),
			"error", err,
		)
		return
	}

	if !slices.Contains(allSubIDs, rid.SubscriptionID) {
		c.warn(ctx, "The discovered database is in a subscription that the database agent does not have access to",
			"database", database.GetName(),

View on GitHub (pinned to 1283425b60)

Solutions

  1. Verify the Azure credentials used by the agent (client ID/secret, tenant) are valid and not expired
  2. Grant the credential permission to list subscriptions
  3. Check network connectivity to Azure Resource Manager endpoints
Defensive patterns

Strategy: retry

When it happens

Trigger: Thrown at lib/srv/db/cloud/resource_checker_credentials.go:138 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/98cb6821c6d59489. Report an issue: GitHub.