What causes "no Access Graph fetchers" in gravitational/teleport?

Expected/no-op when no Access Graph integration is configured — the watcher idles until config changes

no Access Graph fetchers

Error message

no Access Graph fetchers

What it means

errNoAccessGraphFetchers is returned by the discovery server's Access Graph reconcile/watch functions when the configuration yields zero TAG fetchers (nothing to fetch or reconcile). Callers treat it as a benign terminal state and wait for config changes.

Source

Thrown at lib/srv/discovery/access_graph_aws.go:74

const (
	// batchSize is the maximum number of resources to send in a single
	// request to the access graph service.
	batchSize = 500
	// defaultPollInterval is the default interval between polling for access graph resources
	defaultPollInterval = 15 * time.Minute
	// Configure health check service to monitor access graph service and
	// automatically reconnect if the connection is lost without
	// relying on new events from the auth server to trigger a reconnect.
	serviceConfig = `{
		 "loadBalancingConfig": [{"round_robin": {}}],
		 "healthCheckConfig": {
			 "serviceName": ""
		 }
	 }`
)

// errNoAccessGraphFetchers is returned when there are no TAG fetchers.
var errNoAccessGraphFetchers = errors.New("no Access Graph fetchers")

func (s *Server) reconcileAccessGraph(
	ctx context.Context,
	currentTAGResources *aws_sync.Resources,
	stream accessgraphv1alpha.AccessGraphService_AWSEventsStreamClient,
	features aws_sync.Features,
	eksAuditLogWatcher *eksAuditLogWatcher,
) error {
	type fetcherResult struct {
		fetcher *aws_sync.Fetcher
		result  *aws_sync.Resources
		err     error
	}

	allFetchers := s.getAllAWSSyncFetchers()
	if len(allFetchers) == 0 {
		// If there are no fetchers, we don't need to continue.
		// We will send a delete request for all resources and return.

View on GitHub (pinned to 1283425b60)

Solutions

Expected/no-op when no Access Graph integration is configured — the watcher idles until config changes
If TAG sync is desired, add matching AWS/Azure matchers or enable the Access Graph feature flags in discovery config
Verify matcher configuration (labels, regions, account IDs) actually selects resources

Defensive patterns

Strategy: try-catch

Validate before calling

if len(fetchers) == 0 {
    log.Info("no Access Graph fetchers configured; skipping reconcile")
    return nil
}

Try / catch

err := s.reconcileAccessGraph(ctx, res, stream, features, watcher)
if errors.Is(err, errNoAccessGraphFetchers) {
    return nil // benign: wait for config change
}

Prevention

Use errors.Is on the sentinel to treat as benign
Validate discovery matchers select resources when TAG sync is desired
Enable Access Graph feature flags explicitly in config

When it happens

Trigger: reconcileAccessGraph/initializeAndWatchAccessGraph (AWS) or reconcileAccessGraphAzure/initializeAndWatchAzureAccessGraph (Azure) run with no configured AWS/Azure resources that require Access Graph fetching — e.g. no discovered EKS clusters or empty fetcher set.

Common situations: Teleport discovery configured without any Access Graph integrations; all AWS/Azure accounts filtered out by matchers; features flag disabling TAG sync.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/693e2cdb491f1134. Report an issue: GitHub.