gravitational/teleport · error

The discovered database is in a subscription that the databa

Error message

The discovered database is in a subscription that the database agent does not have access to

What it means

Warning emitted when a discovered Azure database's resource ID belongs to a subscription that is not among the subscriptions the database agent's credentials can access; connections to that database will fail.

Source

Thrown at lib/srv/db/cloud/resource_checker_credentials.go:155

	if err != nil {
		c.warn(ctx, "Failed to get Azure subscription IDs when checking a database created by the discovery service",
			"error", err,
			"database", database.GetName(),
		)
		return
	}

	rid, err := arm.ParseResourceID(database.GetAzure().ResourceID)
	if err != nil {
		c.logger.WarnContext(ctx, "Failed to parse resource ID of database",
			"database", database.GetName(),
			"error", err,
		)
		return
	}

	if !slices.Contains(allSubIDs, rid.SubscriptionID) {
		c.warn(ctx, "The discovered database is in a subscription that the database agent does not have access to",
			"database", database.GetName(),
			"subscription", rid.SubscriptionID,
		)
		return
	}
}

func (c *credentialsChecker) warn(ctx context.Context, msg string, args ...any) {
	logger := c.logger.With(
		"help_message", `You can update "db_service.resources" section of this agent's config file to filter out unwanted resources (see https://goteleport.com/docs/reference/agent-services/database-access-reference/configuration/ for more details). If this database is intended to be handled by this agent, please verify that valid cloud credentials are configured for the agent.`,
	)

	if c.isWildcardMatcher() {
		//nolint:sloglint // The passed in message and args trips up the linter
		logger.WarnContext(ctx, msg, args...)
		return
	}

View on GitHub (pinned to 1283425b60)

Solutions

1. Grant the agent's Azure credentials access to the database's subscription
2. Or restrict discovery to only the subscriptions the credentials can access

When it happens

Trigger: Thrown at lib/srv/db/cloud/resource_checker_credentials.go:155 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/520974b3831543e8. Report an issue: GitHub.