gravitational/teleport · warning

TAG feature is not enabled

Error message

TAG feature is not enabled

What it means

errTAGFeatureNotEnabled is a sentinel error returned when the cluster's license does not include the Teleport Identity Security (Access Graph / TAG) entitlement. The discovery service checks ClusterFeatures via accessGraphEntitlementEnabled before initializing Access Graph sync, and returns this error instead of starting sync workers. Callers match it with errors.Is to log a warning and skip Access Graph rather than fail the service.

Source

Thrown at lib/srv/discovery/access_graph_aws.go:334

	// 10MB compressed, but we want to be able to send the whole file in one go.
	const maxMessageSize = 50 * 1024 * 1024 // 50MB
	opts = append(opts,
		opt,
		grpc.WithUnaryInterceptor(metadata.UnaryClientInterceptor),
		grpc.WithStreamInterceptor(metadata.StreamClientInterceptor),
		grpc.WithDefaultCallOptions(
			grpc.MaxCallRecvMsgSize(maxMessageSize),
			grpc.MaxCallSendMsgSize(maxMessageSize),
		),
	)

	conn, err := grpc.DialContext(ctx, config.Addr, opts...)
	return conn, trace.Wrap(err)
}

// errTAGFeatureNotEnabled is returned when the TAG feature is not enabled
// in the cluster features.
var errTAGFeatureNotEnabled = errors.New("TAG feature is not enabled")

func accessGraphEntitlementEnabled(features *proto.Features) bool {
	return features.GetAccessGraph() ||
		modules.GetProtoEntitlement(features, entitlements.AccessGraph).Enabled
}

func activityCenterEntitlementEnabled(features *proto.Features) bool {
	return modules.GetProtoEntitlement(features, entitlements.ActivityCenter).Enabled
}

// initializeAndWatchAccessGraph creates a new access graph service client and
// watches the connection state. If the connection is closed, it will
// automatically try to reconnect.
func (s *Server) initializeAndWatchAccessGraph(ctx context.Context, reloadCh <-chan struct{}) error {
	const (
		// aws discovery semaphore lock.
		semaphoreName = "access_graph_aws_sync"
	)

View on GitHub (pinned to 1283425b60)

Solutions

1. Upgrade to a Teleport Enterprise license that includes Teleport Identity Security (Access Graph)
2. Remove or comment out the Access Graph section from the discovery service config if TAG is not licensed
3. Verify the cluster's feature set (tctl status / cluster features) to confirm the access_graph entitlement is present
4. Restart the discovery service after applying a new license so features are re-fetched

Example fix

// before: discovery config enables TAG without license
discovery_service:
  aws:
  - types: ["access_graph"]
// after: either obtain a TAG-entitled license, or drop the matcher
// discovery_service:
//   aws: []  # TAG not licensed

feats := s.Config.ClusterFeatures()
if !accessGraphEntitlementEnabled(&feats) {
    // skip TAG config instead of attempting sync
    log.WarnContext(ctx, "license does not include Teleport Identity Security; skipping Access Graph")
    return nil
}

func accessGraphEntitlementEnabled(features *proto.Features) bool {
    return features.GetAccessGraph() || modules.GetProtoEntitlement(features, entitlements.AccessGraph).Enabled
}

err := s.initializeAndWatchAccessGraph(ctx, reloadCh)
if errors.Is(err, errTAGFeatureNotEnabled) {
    log.WarnContext(ctx, "Access Graph specified in config, but license does not include Teleport Identity Security.")
    return nil
}
if err != nil { return trace.Wrap(err) }

When it happens

Trigger: Calling initializeAndWatchAccessGraph, startCloudtrailPoller, or initializeAndWatchAzureAccessGraph when features.GetAccessGraph() is false and the proto entitlement entitlements.AccessGraph is not Enabled — i.e. Access Graph is configured in discovery config but the license lacks it, or the feature flag hasn't propagated to this cluster yet.

Common situations: Operators configure an AWS/Azure Access Graph discovery section without an enterprise license that includes Teleport Identity Security; license expiry downgrades entitlements; features not yet refreshed from the auth server after license upgrade.

Related errors

• no Access Graph fetchers
• all fetched nodes already enrolled
• PKCS11 HSM support requires a license with the HSM feature e
• GCP KMS support requires a license with the HSM feature enab
• AWS KMS support requires a license with the HSM feature enab

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/6631a7249e3d848d. Report an issue: GitHub.