gravitational/teleport · error

The database agent's identity and discovered database have d

Error message

The database agent's identity and discovered database have different AWS account IDs

What it means

Warning emitted when the discovered database's AWS account ID differs from the account ID of the identity the database agent is running under: the agent's credentials belong to a different AWS account and will not be able to connect to that database.

Source

Thrown at lib/srv/db/cloud/resource_checker_credentials.go:99

			"database", database.GetName(),
			"cloud_type", database.GetType(),
		)
	}
	return nil
}

func (c *credentialsChecker) checkAWS(ctx context.Context, database types.Database) {
	meta := database.GetAWS()
	identity, err := c.getAWSIdentity(ctx, &meta)
	if err != nil {
		c.warn(ctx, "Failed to get AWS identity when checking a database created by the discovery service",
			"database", database.GetName(),
		)
		return
	}

	if meta.AccountID != "" && meta.AccountID != identity.GetAccountID() {
		c.warn(ctx,
			"The database agent's identity and discovered database have different AWS account IDs",
			"database", database.GetName(),
			"agent_account_id", identity.GetAccountID(),
			"discovered_account_id", meta.AccountID,
		)
		return
	}
}

// getAWSIdentity returns the identity used to access the given database,
// that is either the agent's identity or the database's configured assume-role.
func (c *credentialsChecker) getAWSIdentity(ctx context.Context, meta *types.AWS) (aws.Identity, error) {
	if meta.AssumeRoleARN != "" {
		// If the database has an assume role ARN, use that instead of
		// agent identity. This avoids an unnecessary sts call too.
		return aws.IdentityFromArn(meta.AssumeRoleARN)
	}

View on GitHub (pinned to 1283425b60)

Solutions

1. Configure the database agent with credentials from the same AWS account as the discovered database
2. Or set up cross-account access (IAM role assumption) and configure discovery accordingly

When it happens

Trigger: Thrown at lib/srv/db/cloud/resource_checker_credentials.go:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/b9f69f2588ba7069. Report an issue: GitHub.