diff --git a/.golangci.yml b/.golangci.yml
index 3e2d2c20598..5f522099dba 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -109,9 +109,6 @@ linters:
             - '!**/lib/auth/test/**'
             - '!**/lib/services/suite/**'
             - '!**/e/lib/accesslist/equal.go'
-            - '!**/e/lib/auth/saml.go'
-            - '!**lib/services/compare.go'
-            - '!**/lib/services/local/access_list.go'
           deny:
             - pkg: github.com/google/go-cmp/cmp
               desc: '"github.com/google/go-cmp/cmp" should only be used in tests'
diff --git a/api/types/accesslist/accesslist.go b/api/types/accesslist/accesslist.go
index a708c158613..eb6a8370114 100644
--- a/api/types/accesslist/accesslist.go
+++ b/api/types/accesslist/accesslist.go
@@ -709,9 +709,7 @@ func WithIgnoreEphemeralFields() EqualAccessListsOption {
 // EqualAccessLists compares two access lists for semantic equality.
 //
 // By default, this function performs a standard equality check. Use WithIgnoreEphemeralFields()
-// to ignore ephemeral fields that are managed by reconcilers or the backend. This function
-// mimics the behavior of services.CompareResources for AccessList types when used with
-// WithIgnoreEphemeralFields().
+// to ignore ephemeral fields that are managed by reconcilers or the backend.
 //
 // By default, this function clones the input access lists before comparison to avoid
 // modifying the originals. Use WithSkipClone() to skip cloning if the inputs can be
diff --git a/api/types/derived.gen.go b/api/types/derived.gen.go
index 4bc6e4c381b..b7c838eef5b 100644
--- a/api/types/derived.gen.go
+++ b/api/types/derived.gen.go
@@ -220,12 +220,23 @@ func deriveTeleportEqualKubernetesServerV3(this, that *KubernetesServerV3) bool
 			this.Scope == that.Scope
 }
 
+// deriveTeleportEqualAccessGraphAWSSync returns whether this and that are equal.
+func deriveTeleportEqualAccessGraphAWSSync(this, that *AccessGraphAWSSync) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.Regions, that.Regions) &&
+			deriveTeleportEqual_24(this.AssumeRole, that.AssumeRole) &&
+			this.Integration == that.Integration &&
+			deriveTeleportEqual_25(this.CloudTrailLogs, that.CloudTrailLogs) &&
+			deriveTeleportEqual_26(this.EksAuditLogs, that.EksAuditLogs)
+}
+
 // deriveTeleportEqualAWSOrganizationMatcher returns whether this and that are equal.
 func deriveTeleportEqualAWSOrganizationMatcher(this, that *AWSOrganizationMatcher) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.OrganizationID == that.OrganizationID &&
-			deriveTeleportEqual_24(this.OrganizationalUnits, that.OrganizationalUnits)
+			deriveTeleportEqual_27(this.OrganizationalUnits, that.OrganizationalUnits)
 }
 
 // deriveTeleportEqualMetadata returns whether this and that are equal.
@@ -285,7 +296,7 @@ func deriveTeleportEqualOktaAssignmentV1(this, that *OktaAssignmentV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqualResourceHeader(&this.ResourceHeader, &that.ResourceHeader) &&
-			deriveTeleportEqual_25(&this.Spec, &that.Spec)
+			deriveTeleportEqual_28(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualResourceHeader returns whether this and that are equal.
@@ -306,7 +317,7 @@ func deriveTeleportEqualRoleV6(this, that *RoleV6) bool {
 			this.SubKind == that.SubKind &&
 			this.Version == that.Version &&
 			deriveTeleportEqualMetadata(&this.Metadata, &that.Metadata) &&
-			deriveTeleportEqual_26(&this.Spec, &that.Spec)
+			deriveTeleportEqual_29(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualSAMLConnectorV2 returns whether this and that are equal.
@@ -317,7 +328,7 @@ func deriveTeleportEqualSAMLConnectorV2(this, that *SAMLConnectorV2) bool {
 			this.SubKind == that.SubKind &&
 			this.Version == that.Version &&
 			deriveTeleportEqualMetadata(&this.Metadata, &that.Metadata) &&
-			deriveTeleportEqual_27(&this.Spec, &that.Spec)
+			deriveTeleportEqual_30(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualUser returns whether this and that are equal.
@@ -328,7 +339,7 @@ func deriveTeleportEqualUser(this, that *UserV2) bool {
 			this.SubKind == that.SubKind &&
 			this.Version == that.Version &&
 			deriveTeleportEqualMetadata(&this.Metadata, &that.Metadata) &&
-			deriveTeleportEqual_28(&this.Spec, &that.Spec)
+			deriveTeleportEqual_31(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqualExternalIdentity returns whether this and that are equal.
@@ -346,7 +357,7 @@ func deriveTeleportEqualUserGroupV1(this, that *UserGroupV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqualResourceHeader(&this.ResourceHeader, &that.ResourceHeader) &&
-			deriveTeleportEqual_29(&this.Spec, &that.Spec)
+			deriveTeleportEqual_32(&this.Spec, &that.Spec)
 }
 
 // deriveTeleportEqual returns whether this and that are equal.
@@ -360,23 +371,23 @@ func deriveTeleportEqual(this, that *AccessRequestSpecV3) bool {
 			this.Expires.Equal(that.Expires) &&
 			this.RequestReason == that.RequestReason &&
 			this.ResolveReason == that.ResolveReason &&
-			deriveTeleportEqual_30(this.ResolveAnnotations, that.ResolveAnnotations) &&
-			deriveTeleportEqual_30(this.SystemAnnotations, that.SystemAnnotations) &&
-			deriveTeleportEqual_31(this.Thresholds, that.Thresholds) &&
-			deriveTeleportEqual_32(this.RoleThresholdMapping, that.RoleThresholdMapping) &&
-			deriveTeleportEqual_33(this.Reviews, that.Reviews) &&
+			deriveTeleportEqual_33(this.ResolveAnnotations, that.ResolveAnnotations) &&
+			deriveTeleportEqual_33(this.SystemAnnotations, that.SystemAnnotations) &&
+			deriveTeleportEqual_34(this.Thresholds, that.Thresholds) &&
+			deriveTeleportEqual_35(this.RoleThresholdMapping, that.RoleThresholdMapping) &&
+			deriveTeleportEqual_36(this.Reviews, that.Reviews) &&
 			deriveTeleportEqual_2(this.SuggestedReviewers, that.SuggestedReviewers) &&
-			deriveTeleportEqual_34(this.RequestedResourceIDs, that.RequestedResourceIDs) &&
+			deriveTeleportEqual_37(this.RequestedResourceIDs, that.RequestedResourceIDs) &&
 			this.LoginHint == that.LoginHint &&
 			this.DryRun == that.DryRun &&
 			this.MaxDuration.Equal(that.MaxDuration) &&
 			this.SessionTTL.Equal(that.SessionTTL) &&
-			deriveTeleportEqual_35(this.AccessList, that.AccessList) &&
+			deriveTeleportEqual_38(this.AccessList, that.AccessList) &&
 			((this.AssumeStartTime == nil && that.AssumeStartTime == nil) || (this.AssumeStartTime != nil && that.AssumeStartTime != nil && (*(this.AssumeStartTime)).Equal(*(that.AssumeStartTime)))) &&
 			((this.ResourceExpiry == nil && that.ResourceExpiry == nil) || (this.ResourceExpiry != nil && that.ResourceExpiry != nil && (*(this.ResourceExpiry)).Equal(*(that.ResourceExpiry)))) &&
-			deriveTeleportEqual_36(this.DryRunEnrichment, that.DryRunEnrichment) &&
+			deriveTeleportEqual_39(this.DryRunEnrichment, that.DryRunEnrichment) &&
 			this.RequestKind == that.RequestKind &&
-			deriveTeleportEqual_37(this.LongTermGrouping, that.LongTermGrouping)
+			deriveTeleportEqual_40(this.LongTermGrouping, that.LongTermGrouping)
 }
 
 // deriveTeleportEqual_ returns whether this and that are equal.
@@ -418,19 +429,19 @@ func deriveTeleportEqual_3(this, that *AppSpecV3) bool {
 		this != nil && that != nil &&
 			this.URI == that.URI &&
 			this.PublicAddr == that.PublicAddr &&
-			deriveTeleportEqual_38(this.DynamicLabels, that.DynamicLabels) &&
+			deriveTeleportEqual_41(this.DynamicLabels, that.DynamicLabels) &&
 			this.InsecureSkipVerify == that.InsecureSkipVerify &&
-			deriveTeleportEqual_39(this.Rewrite, that.Rewrite) &&
-			deriveTeleportEqual_40(this.AWS, that.AWS) &&
+			deriveTeleportEqual_42(this.Rewrite, that.Rewrite) &&
+			deriveTeleportEqual_43(this.AWS, that.AWS) &&
 			this.Cloud == that.Cloud &&
 			deriveTeleportEqual_2(this.UserGroups, that.UserGroups) &&
 			this.Integration == that.Integration &&
 			deriveTeleportEqual_2(this.RequiredAppNames, that.RequiredAppNames) &&
-			deriveTeleportEqual_41(this.CORS, that.CORS) &&
-			deriveTeleportEqual_42(this.IdentityCenter, that.IdentityCenter) &&
-			deriveTeleportEqual_43(this.TCPPorts, that.TCPPorts) &&
+			deriveTeleportEqual_44(this.CORS, that.CORS) &&
+			deriveTeleportEqual_45(this.IdentityCenter, that.IdentityCenter) &&
+			deriveTeleportEqual_46(this.TCPPorts, that.TCPPorts) &&
 			this.UseAnyProxyPublicAddr == that.UseAnyProxyPublicAddr &&
-			deriveTeleportEqual_44(this.MCP, that.MCP)
+			deriveTeleportEqual_47(this.MCP, that.MCP)
 }
 
 // deriveTeleportEqual_4 returns whether this and that are equal.
@@ -440,12 +451,12 @@ func deriveTeleportEqual_4(this, that *AppServerSpecV3) bool {
 			this.Version == that.Version &&
 			this.Hostname == that.Hostname &&
 			this.HostID == that.HostID &&
-			deriveTeleportEqual_45(&this.Rotation, &that.Rotation) &&
+			deriveTeleportEqual_48(&this.Rotation, &that.Rotation) &&
 			deriveTeleportEqualAppV3(this.App, that.App) &&
 			deriveTeleportEqual_2(this.ProxyIDs, that.ProxyIDs) &&
 			this.RelayGroup == that.RelayGroup &&
 			deriveTeleportEqual_2(this.RelayIds, that.RelayIds) &&
-			deriveTeleportEqual_46(this.ComponentFeatures, that.ComponentFeatures)
+			deriveTeleportEqual_49(this.ComponentFeatures, that.ComponentFeatures)
 }
 
 // deriveTeleportEqual_5 returns whether this and that are equal.
@@ -455,11 +466,11 @@ func deriveTeleportEqual_5(this, that *CertAuthoritySpecV2) bool {
 			this.Type == that.Type &&
 			this.ClusterName == that.ClusterName &&
 			deriveTeleportEqual_2(this.Roles, that.Roles) &&
-			deriveTeleportEqual_47(this.RoleMap, that.RoleMap) &&
-			deriveTeleportEqual_45(this.Rotation, that.Rotation) &&
+			deriveTeleportEqual_50(this.RoleMap, that.RoleMap) &&
+			deriveTeleportEqual_48(this.Rotation, that.Rotation) &&
 			this.SigningAlg == that.SigningAlg &&
-			deriveTeleportEqual_48(&this.ActiveKeys, &that.ActiveKeys) &&
-			deriveTeleportEqual_48(&this.AdditionalTrustedKeys, &that.AdditionalTrustedKeys)
+			deriveTeleportEqual_51(&this.ActiveKeys, &that.ActiveKeys) &&
+			deriveTeleportEqual_51(&this.AdditionalTrustedKeys, &that.AdditionalTrustedKeys)
 }
 
 // deriveTeleportEqual_6 returns whether this and that are equal.
@@ -587,16 +598,16 @@ func deriveTeleportEqual_18(this, that *DatabaseSpecV3) bool {
 			this.Protocol == that.Protocol &&
 			this.URI == that.URI &&
 			this.CACert == that.CACert &&
-			deriveTeleportEqual_38(this.DynamicLabels, that.DynamicLabels) &&
+			deriveTeleportEqual_41(this.DynamicLabels, that.DynamicLabels) &&
 			deriveTeleportEqualAWS(&this.AWS, &that.AWS) &&
 			deriveTeleportEqualGCPCloudSQL(&this.GCP, &that.GCP) &&
 			deriveTeleportEqualAzure(&this.Azure, &that.Azure) &&
-			deriveTeleportEqual_49(&this.TLS, &that.TLS) &&
-			deriveTeleportEqual_50(&this.AD, &that.AD) &&
-			deriveTeleportEqual_51(&this.MySQL, &that.MySQL) &&
-			deriveTeleportEqual_52(this.AdminUser, that.AdminUser) &&
-			deriveTeleportEqual_53(&this.MongoAtlas, &that.MongoAtlas) &&
-			deriveTeleportEqual_54(&this.Oracle, &that.Oracle)
+			deriveTeleportEqual_52(&this.TLS, &that.TLS) &&
+			deriveTeleportEqual_53(&this.AD, &that.AD) &&
+			deriveTeleportEqual_54(&this.MySQL, &that.MySQL) &&
+			deriveTeleportEqual_55(this.AdminUser, that.AdminUser) &&
+			deriveTeleportEqual_56(&this.MongoAtlas, &that.MongoAtlas) &&
+			deriveTeleportEqual_57(&this.Oracle, &that.Oracle)
 }
 
 // deriveTeleportEqual_19 returns whether this and that are equal.
@@ -606,7 +617,7 @@ func deriveTeleportEqual_19(this, that *DynamicWindowsDesktopSpecV1) bool {
 			this.Addr == that.Addr &&
 			this.Domain == that.Domain &&
 			this.NonAD == that.NonAD &&
-			deriveTeleportEqual_55(this.ScreenSize, that.ScreenSize)
+			deriveTeleportEqual_58(this.ScreenSize, that.ScreenSize)
 }
 
 // deriveTeleportEqual_20 returns whether this and that are equal.
@@ -617,14 +628,14 @@ func deriveTeleportEqual_20(this, that *WindowsDesktopSpecV3) bool {
 			this.Domain == that.Domain &&
 			this.HostID == that.HostID &&
 			this.NonAD == that.NonAD &&
-			deriveTeleportEqual_55(this.ScreenSize, that.ScreenSize)
+			deriveTeleportEqual_58(this.ScreenSize, that.ScreenSize)
 }
 
 // deriveTeleportEqual_21 returns whether this and that are equal.
 func deriveTeleportEqual_21(this, that *KubernetesClusterSpecV3) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_38(this.DynamicLabels, that.DynamicLabels) &&
+			deriveTeleportEqual_41(this.DynamicLabels, that.DynamicLabels) &&
 			bytes.Equal(this.Kubeconfig, that.Kubeconfig) &&
 			deriveTeleportEqualKubeAzure(&this.Azure, &that.Azure) &&
 			deriveTeleportEqualKubeAWS(&this.AWS, &that.AWS) &&
@@ -635,7 +646,7 @@ func deriveTeleportEqual_21(this, that *KubernetesClusterSpecV3) bool {
 func deriveTeleportEqual_22(this, that *KubernetesClusterDiscoveryStatus) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_56(this.Aws, that.Aws)
+			deriveTeleportEqual_59(this.Aws, that.Aws)
 }
 
 // deriveTeleportEqual_23 returns whether this and that are equal.
@@ -645,7 +656,7 @@ func deriveTeleportEqual_23(this, that *KubernetesServerSpecV3) bool {
 			this.Version == that.Version &&
 			this.Hostname == that.Hostname &&
 			this.HostID == that.HostID &&
-			deriveTeleportEqual_45(&this.Rotation, &that.Rotation) &&
+			deriveTeleportEqual_48(&this.Rotation, &that.Rotation) &&
 			deriveTeleportEqualKubernetesClusterV3(this.Cluster, that.Cluster) &&
 			deriveTeleportEqual_2(this.ProxyIDs, that.ProxyIDs) &&
 			this.RelayGroup == that.RelayGroup &&
@@ -653,36 +664,60 @@ func deriveTeleportEqual_23(this, that *KubernetesServerSpecV3) bool {
 }
 
 // deriveTeleportEqual_24 returns whether this and that are equal.
-func deriveTeleportEqual_24(this, that *AWSOrganizationUnitsMatcher) bool {
+func deriveTeleportEqual_24(this, that *AssumeRole) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.RoleARN == that.RoleARN &&
+			this.ExternalID == that.ExternalID &&
+			this.RoleName == that.RoleName
+}
+
+// deriveTeleportEqual_25 returns whether this and that are equal.
+func deriveTeleportEqual_25(this, that *AccessGraphAWSSyncCloudTrailLogs) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Region == that.Region &&
+			this.SQSQueue == that.SQSQueue
+}
+
+// deriveTeleportEqual_26 returns whether this and that are equal.
+func deriveTeleportEqual_26(this, that *AccessGraphAWSSyncEKSAuditLogs) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_60(this.Tags, that.Tags)
+}
+
+// deriveTeleportEqual_27 returns whether this and that are equal.
+func deriveTeleportEqual_27(this, that *AWSOrganizationUnitsMatcher) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Include, that.Include) &&
 			deriveTeleportEqual_2(this.Exclude, that.Exclude)
 }
 
-// deriveTeleportEqual_25 returns whether this and that are equal.
-func deriveTeleportEqual_25(this, that *OktaAssignmentSpecV1) bool {
+// deriveTeleportEqual_28 returns whether this and that are equal.
+func deriveTeleportEqual_28(this, that *OktaAssignmentSpecV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.User == that.User &&
-			deriveTeleportEqual_57(this.Targets, that.Targets) &&
+			deriveTeleportEqual_61(this.Targets, that.Targets) &&
 			this.CleanupTime.Equal(that.CleanupTime) &&
 			this.Status == that.Status &&
 			this.LastTransition.Equal(that.LastTransition) &&
 			this.Finalized == that.Finalized
 }
 
-// deriveTeleportEqual_26 returns whether this and that are equal.
-func deriveTeleportEqual_26(this, that *RoleSpecV6) bool {
+// deriveTeleportEqual_29 returns whether this and that are equal.
+func deriveTeleportEqual_29(this, that *RoleSpecV6) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_58(&this.Options, &that.Options) &&
-			deriveTeleportEqual_59(&this.Allow, &that.Allow) &&
-			deriveTeleportEqual_59(&this.Deny, &that.Deny)
+			deriveTeleportEqual_62(&this.Options, &that.Options) &&
+			deriveTeleportEqual_63(&this.Allow, &that.Allow) &&
+			deriveTeleportEqual_63(&this.Deny, &that.Deny)
 }
 
-// deriveTeleportEqual_27 returns whether this and that are equal.
-func deriveTeleportEqual_27(this, that *SAMLConnectorSpecV2) bool {
+// deriveTeleportEqual_30 returns whether this and that are equal.
+func deriveTeleportEqual_30(this, that *SAMLConnectorSpecV2) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Issuer == that.Issuer &&
@@ -694,45 +729,45 @@ func deriveTeleportEqual_27(this, that *SAMLConnectorSpecV2) bool {
 			this.ServiceProviderIssuer == that.ServiceProviderIssuer &&
 			this.EntityDescriptor == that.EntityDescriptor &&
 			this.EntityDescriptorURL == that.EntityDescriptorURL &&
-			deriveTeleportEqual_60(this.AttributesToRoles, that.AttributesToRoles) &&
-			deriveTeleportEqual_61(this.SigningKeyPair, that.SigningKeyPair) &&
+			deriveTeleportEqual_64(this.AttributesToRoles, that.AttributesToRoles) &&
+			deriveTeleportEqual_65(this.SigningKeyPair, that.SigningKeyPair) &&
 			this.Provider == that.Provider &&
-			deriveTeleportEqual_61(this.EncryptionKeyPair, that.EncryptionKeyPair) &&
+			deriveTeleportEqual_65(this.EncryptionKeyPair, that.EncryptionKeyPair) &&
 			this.AllowIDPInitiated == that.AllowIDPInitiated &&
-			deriveTeleportEqual_62(this.ClientRedirectSettings, that.ClientRedirectSettings) &&
+			deriveTeleportEqual_66(this.ClientRedirectSettings, that.ClientRedirectSettings) &&
 			this.SingleLogoutURL == that.SingleLogoutURL &&
-			deriveTeleportEqual_63(this.MFASettings, that.MFASettings) &&
+			deriveTeleportEqual_67(this.MFASettings, that.MFASettings) &&
 			this.ForceAuthn == that.ForceAuthn &&
 			this.PreferredRequestBinding == that.PreferredRequestBinding &&
 			deriveTeleportEqual_2(this.UserMatchers, that.UserMatchers) &&
 			this.IncludeSubject == that.IncludeSubject
 }
 
-// deriveTeleportEqual_28 returns whether this and that are equal.
-func deriveTeleportEqual_28(this, that *UserSpecV2) bool {
+// deriveTeleportEqual_31 returns whether this and that are equal.
+func deriveTeleportEqual_31(this, that *UserSpecV2) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_64(this.OIDCIdentities, that.OIDCIdentities) &&
-			deriveTeleportEqual_64(this.SAMLIdentities, that.SAMLIdentities) &&
-			deriveTeleportEqual_64(this.GithubIdentities, that.GithubIdentities) &&
+			deriveTeleportEqual_68(this.OIDCIdentities, that.OIDCIdentities) &&
+			deriveTeleportEqual_68(this.SAMLIdentities, that.SAMLIdentities) &&
+			deriveTeleportEqual_68(this.GithubIdentities, that.GithubIdentities) &&
 			deriveTeleportEqual_2(this.Roles, that.Roles) &&
-			deriveTeleportEqual_30(this.Traits, that.Traits) &&
-			deriveTeleportEqual_65(&this.Status, &that.Status) &&
+			deriveTeleportEqual_33(this.Traits, that.Traits) &&
+			deriveTeleportEqual_69(&this.Status, &that.Status) &&
 			this.Expires.Equal(that.Expires) &&
-			deriveTeleportEqual_66(&this.CreatedBy, &that.CreatedBy) &&
-			deriveTeleportEqual_67(this.LocalAuth, that.LocalAuth) &&
+			deriveTeleportEqual_70(&this.CreatedBy, &that.CreatedBy) &&
+			deriveTeleportEqual_71(this.LocalAuth, that.LocalAuth) &&
 			deriveTeleportEqual_2(this.TrustedDeviceIDs, that.TrustedDeviceIDs)
 }
 
-// deriveTeleportEqual_29 returns whether this and that are equal.
-func deriveTeleportEqual_29(this, that *UserGroupSpecV1) bool {
+// deriveTeleportEqual_32 returns whether this and that are equal.
+func deriveTeleportEqual_32(this, that *UserGroupSpecV1) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Applications, that.Applications)
 }
 
-// deriveTeleportEqual_30 returns whether this and that are equal.
-func deriveTeleportEqual_30(this, that map[string][]string) bool {
+// deriveTeleportEqual_33 returns whether this and that are equal.
+func deriveTeleportEqual_33(this, that map[string][]string) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -751,8 +786,8 @@ func deriveTeleportEqual_30(this, that map[string][]string) bool {
 	return true
 }
 
-// deriveTeleportEqual_31 returns whether this and that are equal.
-func deriveTeleportEqual_31(this, that []AccessReviewThreshold) bool {
+// deriveTeleportEqual_34 returns whether this and that are equal.
+func deriveTeleportEqual_34(this, that []AccessReviewThreshold) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -767,8 +802,8 @@ func deriveTeleportEqual_31(this, that []AccessReviewThreshold) bool {
 	return true
 }
 
-// deriveTeleportEqual_32 returns whether this and that are equal.
-func deriveTeleportEqual_32(this, that map[string]ThresholdIndexSets) bool {
+// deriveTeleportEqual_35 returns whether this and that are equal.
+func deriveTeleportEqual_35(this, that map[string]ThresholdIndexSets) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -780,15 +815,15 @@ func deriveTeleportEqual_32(this, that map[string]ThresholdIndexSets) bool {
 		if !ok {
 			return false
 		}
-		if !(deriveTeleportEqual_68(&v, &thatv)) {
+		if !(deriveTeleportEqual_72(&v, &thatv)) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_33 returns whether this and that are equal.
-func deriveTeleportEqual_33(this, that []AccessReview) bool {
+// deriveTeleportEqual_36 returns whether this and that are equal.
+func deriveTeleportEqual_36(this, that []AccessReview) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -796,15 +831,15 @@ func deriveTeleportEqual_33(this, that []AccessReview) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_69(&this[i], &that[i])) {
+		if !(deriveTeleportEqual_73(&this[i], &that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_34 returns whether this and that are equal.
-func deriveTeleportEqual_34(this, that []ResourceID) bool {
+// deriveTeleportEqual_37 returns whether this and that are equal.
+func deriveTeleportEqual_37(this, that []ResourceID) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -819,34 +854,34 @@ func deriveTeleportEqual_34(this, that []ResourceID) bool {
 	return true
 }
 
-// deriveTeleportEqual_35 returns whether this and that are equal.
-func deriveTeleportEqual_35(this, that *PromotedAccessList) bool {
+// deriveTeleportEqual_38 returns whether this and that are equal.
+func deriveTeleportEqual_38(this, that *PromotedAccessList) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name &&
 			this.Title == that.Title
 }
 
-// deriveTeleportEqual_36 returns whether this and that are equal.
-func deriveTeleportEqual_36(this, that *AccessRequestDryRunEnrichment) bool {
+// deriveTeleportEqual_39 returns whether this and that are equal.
+func deriveTeleportEqual_39(this, that *AccessRequestDryRunEnrichment) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ReasonMode == that.ReasonMode &&
 			deriveTeleportEqual_2(this.ReasonPrompts, that.ReasonPrompts)
 }
 
-// deriveTeleportEqual_37 returns whether this and that are equal.
-func deriveTeleportEqual_37(this, that *LongTermResourceGrouping) bool {
+// deriveTeleportEqual_40 returns whether this and that are equal.
+func deriveTeleportEqual_40(this, that *LongTermResourceGrouping) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_70(this.AccessListToResources, that.AccessListToResources) &&
+			deriveTeleportEqual_74(this.AccessListToResources, that.AccessListToResources) &&
 			this.RecommendedAccessList == that.RecommendedAccessList &&
 			this.ValidationMessage == that.ValidationMessage &&
 			this.CanProceed == that.CanProceed
 }
 
-// deriveTeleportEqual_38 returns whether this and that are equal.
-func deriveTeleportEqual_38(this, that map[string]CommandLabelV2) bool {
+// deriveTeleportEqual_41 returns whether this and that are equal.
+func deriveTeleportEqual_41(this, that map[string]CommandLabelV2) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -858,32 +893,32 @@ func deriveTeleportEqual_38(this, that map[string]CommandLabelV2) bool {
 		if !ok {
 			return false
 		}
-		if !(deriveTeleportEqual_71(&v, &thatv)) {
+		if !(deriveTeleportEqual_75(&v, &thatv)) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_39 returns whether this and that are equal.
-func deriveTeleportEqual_39(this, that *Rewrite) bool {
+// deriveTeleportEqual_42 returns whether this and that are equal.
+func deriveTeleportEqual_42(this, that *Rewrite) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Redirect, that.Redirect) &&
-			deriveTeleportEqual_72(this.Headers, that.Headers) &&
+			deriveTeleportEqual_76(this.Headers, that.Headers) &&
 			this.JWTClaims == that.JWTClaims
 }
 
-// deriveTeleportEqual_40 returns whether this and that are equal.
-func deriveTeleportEqual_40(this, that *AppAWS) bool {
+// deriveTeleportEqual_43 returns whether this and that are equal.
+func deriveTeleportEqual_43(this, that *AppAWS) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ExternalID == that.ExternalID &&
-			deriveTeleportEqual_73(this.RolesAnywhereProfile, that.RolesAnywhereProfile)
+			deriveTeleportEqual_77(this.RolesAnywhereProfile, that.RolesAnywhereProfile)
 }
 
-// deriveTeleportEqual_41 returns whether this and that are equal.
-func deriveTeleportEqual_41(this, that *CORSPolicy) bool {
+// deriveTeleportEqual_44 returns whether this and that are equal.
+func deriveTeleportEqual_44(this, that *CORSPolicy) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.AllowedOrigins, that.AllowedOrigins) &&
@@ -894,16 +929,16 @@ func deriveTeleportEqual_41(this, that *CORSPolicy) bool {
 			deriveTeleportEqual_2(this.ExposedHeaders, that.ExposedHeaders)
 }
 
-// deriveTeleportEqual_42 returns whether this and that are equal.
-func deriveTeleportEqual_42(this, that *AppIdentityCenter) bool {
+// deriveTeleportEqual_45 returns whether this and that are equal.
+func deriveTeleportEqual_45(this, that *AppIdentityCenter) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.AccountID == that.AccountID &&
-			deriveTeleportEqual_74(this.PermissionSets, that.PermissionSets)
+			deriveTeleportEqual_78(this.PermissionSets, that.PermissionSets)
 }
 
-// deriveTeleportEqual_43 returns whether this and that are equal.
-func deriveTeleportEqual_43(this, that []*PortRange) bool {
+// deriveTeleportEqual_46 returns whether this and that are equal.
+func deriveTeleportEqual_46(this, that []*PortRange) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -911,15 +946,15 @@ func deriveTeleportEqual_43(this, that []*PortRange) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_75(this[i], that[i])) {
+		if !(deriveTeleportEqual_79(this[i], that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_44 returns whether this and that are equal.
-func deriveTeleportEqual_44(this, that *MCP) bool {
+// deriveTeleportEqual_47 returns whether this and that are equal.
+func deriveTeleportEqual_47(this, that *MCP) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Command == that.Command &&
@@ -927,8 +962,8 @@ func deriveTeleportEqual_44(this, that *MCP) bool {
 			this.RunAsHostUser == that.RunAsHostUser
 }
 
-// deriveTeleportEqual_45 returns whether this and that are equal.
-func deriveTeleportEqual_45(this, that *Rotation) bool {
+// deriveTeleportEqual_48 returns whether this and that are equal.
+func deriveTeleportEqual_48(this, that *Rotation) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.State == that.State &&
@@ -938,18 +973,18 @@ func deriveTeleportEqual_45(this, that *Rotation) bool {
 			this.Started.Equal(that.Started) &&
 			this.GracePeriod == that.GracePeriod &&
 			this.LastRotated.Equal(that.LastRotated) &&
-			deriveTeleportEqual_76(&this.Schedule, &that.Schedule)
+			deriveTeleportEqual_80(&this.Schedule, &that.Schedule)
 }
 
-// deriveTeleportEqual_46 returns whether this and that are equal.
-func deriveTeleportEqual_46(this, that *componentfeaturesv1.ComponentFeatures) bool {
+// deriveTeleportEqual_49 returns whether this and that are equal.
+func deriveTeleportEqual_49(this, that *componentfeaturesv1.ComponentFeatures) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_77(this.Features, that.Features)
+			deriveTeleportEqual_81(this.Features, that.Features)
 }
 
-// deriveTeleportEqual_47 returns whether this and that are equal.
-func deriveTeleportEqual_47(this, that []RoleMapping) bool {
+// deriveTeleportEqual_50 returns whether this and that are equal.
+func deriveTeleportEqual_50(this, that []RoleMapping) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -957,24 +992,24 @@ func deriveTeleportEqual_47(this, that []RoleMapping) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_78(&this[i], &that[i])) {
+		if !(deriveTeleportEqual_82(&this[i], &that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_48 returns whether this and that are equal.
-func deriveTeleportEqual_48(this, that *CAKeySet) bool {
+// deriveTeleportEqual_51 returns whether this and that are equal.
+func deriveTeleportEqual_51(this, that *CAKeySet) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_79(this.SSH, that.SSH) &&
-			deriveTeleportEqual_80(this.TLS, that.TLS) &&
-			deriveTeleportEqual_81(this.JWT, that.JWT)
+			deriveTeleportEqual_83(this.SSH, that.SSH) &&
+			deriveTeleportEqual_84(this.TLS, that.TLS) &&
+			deriveTeleportEqual_85(this.JWT, that.JWT)
 }
 
-// deriveTeleportEqual_49 returns whether this and that are equal.
-func deriveTeleportEqual_49(this, that *DatabaseTLS) bool {
+// deriveTeleportEqual_52 returns whether this and that are equal.
+func deriveTeleportEqual_52(this, that *DatabaseTLS) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Mode == that.Mode &&
@@ -983,8 +1018,8 @@ func deriveTeleportEqual_49(this, that *DatabaseTLS) bool {
 			this.TrustSystemCertPool == that.TrustSystemCertPool
 }
 
-// deriveTeleportEqual_50 returns whether this and that are equal.
-func deriveTeleportEqual_50(this, that *AD) bool {
+// deriveTeleportEqual_53 returns whether this and that are equal.
+func deriveTeleportEqual_53(this, that *AD) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.KeytabFile == that.KeytabFile &&
@@ -997,30 +1032,30 @@ func deriveTeleportEqual_50(this, that *AD) bool {
 			this.LDAPServiceAccountSID == that.LDAPServiceAccountSID
 }
 
-// deriveTeleportEqual_51 returns whether this and that are equal.
-func deriveTeleportEqual_51(this, that *MySQLOptions) bool {
+// deriveTeleportEqual_54 returns whether this and that are equal.
+func deriveTeleportEqual_54(this, that *MySQLOptions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.ServerVersion == that.ServerVersion
 }
 
-// deriveTeleportEqual_52 returns whether this and that are equal.
-func deriveTeleportEqual_52(this, that *DatabaseAdminUser) bool {
+// deriveTeleportEqual_55 returns whether this and that are equal.
+func deriveTeleportEqual_55(this, that *DatabaseAdminUser) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name &&
 			this.DefaultDatabase == that.DefaultDatabase
 }
 
-// deriveTeleportEqual_53 returns whether this and that are equal.
-func deriveTeleportEqual_53(this, that *MongoAtlas) bool {
+// deriveTeleportEqual_56 returns whether this and that are equal.
+func deriveTeleportEqual_56(this, that *MongoAtlas) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name
 }
 
-// deriveTeleportEqual_54 returns whether this and that are equal.
-func deriveTeleportEqual_54(this, that *OracleOptions) bool {
+// deriveTeleportEqual_57 returns whether this and that are equal.
+func deriveTeleportEqual_57(this, that *OracleOptions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.AuditUser == that.AuditUser &&
@@ -1028,466 +1063,25 @@ func deriveTeleportEqual_54(this, that *OracleOptions) bool {
 			this.ShuffleHostnames == that.ShuffleHostnames
 }
 
-// deriveTeleportEqual_55 returns whether this and that are equal.
-func deriveTeleportEqual_55(this, that *Resolution) bool {
+// deriveTeleportEqual_58 returns whether this and that are equal.
+func deriveTeleportEqual_58(this, that *Resolution) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Width == that.Width &&
 			this.Height == that.Height
 }
 
-// deriveTeleportEqual_56 returns whether this and that are equal.
-func deriveTeleportEqual_56(this, that *KubernetesClusterAWSStatus) bool {
+// deriveTeleportEqual_59 returns whether this and that are equal.
+func deriveTeleportEqual_59(this, that *KubernetesClusterAWSStatus) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.SetupAccessForArn == that.SetupAccessForArn &&
 			this.Integration == that.Integration &&
-			deriveTeleportEqual_82(this.DiscoveryAssumedRole, that.DiscoveryAssumedRole)
-}
-
-// deriveTeleportEqual_57 returns whether this and that are equal.
-func deriveTeleportEqual_57(this, that []*OktaAssignmentTargetV1) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_83(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_58 returns whether this and that are equal.
-func deriveTeleportEqual_58(this, that *RoleOptions) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.ForwardAgent == that.ForwardAgent &&
-			this.MaxSessionTTL == that.MaxSessionTTL &&
-			deriveTeleportEqual_84(this.PortForwarding, that.PortForwarding) &&
-			this.CertificateFormat == that.CertificateFormat &&
-			this.ClientIdleTimeout == that.ClientIdleTimeout &&
-			this.DisconnectExpiredCert == that.DisconnectExpiredCert &&
-			deriveTeleportEqual_2(this.BPF, that.BPF) &&
-			this.PermitX11Forwarding == that.PermitX11Forwarding &&
-			this.MaxConnections == that.MaxConnections &&
-			this.MaxSessions == that.MaxSessions &&
-			this.RequestAccess == that.RequestAccess &&
-			this.RequestPrompt == that.RequestPrompt &&
-			this.Lock == that.Lock &&
-			deriveTeleportEqual_85(this.RecordSession, that.RecordSession) &&
-			deriveTeleportEqual_84(this.DesktopClipboard, that.DesktopClipboard) &&
-			deriveTeleportEqual_86(this.CertExtensions, that.CertExtensions) &&
-			this.MaxKubernetesConnections == that.MaxKubernetesConnections &&
-			deriveTeleportEqual_84(this.DesktopDirectorySharing, that.DesktopDirectorySharing) &&
-			deriveTeleportEqual_84(this.CreateHostUser, that.CreateHostUser) &&
-			this.PinSourceIP == that.PinSourceIP &&
-			deriveTeleportEqual_84(this.SSHFileCopy, that.SSHFileCopy) &&
-			this.RequireMFAType == that.RequireMFAType &&
-			this.DeviceTrustMode == that.DeviceTrustMode &&
-			deriveTeleportEqual_87(this.IDP, that.IDP) &&
-			deriveTeleportEqual_84(this.CreateDesktopUser, that.CreateDesktopUser) &&
-			deriveTeleportEqual_84(this.CreateDatabaseUser, that.CreateDatabaseUser) &&
-			this.CreateHostUserMode == that.CreateHostUserMode &&
-			this.CreateDatabaseUserMode == that.CreateDatabaseUserMode &&
-			this.MFAVerificationInterval == that.MFAVerificationInterval &&
-			this.CreateHostUserDefaultShell == that.CreateHostUserDefaultShell &&
-			deriveTeleportEqual_88(this.SSHPortForwarding, that.SSHPortForwarding)
-}
-
-// deriveTeleportEqual_59 returns whether this and that are equal.
-func deriveTeleportEqual_59(this, that *RoleConditions) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_2(this.Logins, that.Logins) &&
-			deriveTeleportEqual_2(this.Namespaces, that.Namespaces) &&
-			deriveTeleportEqual_89(this.NodeLabels, that.NodeLabels) &&
-			deriveTeleportEqual_90(this.Rules, that.Rules) &&
-			deriveTeleportEqual_2(this.KubeGroups, that.KubeGroups) &&
-			deriveTeleportEqual_91(this.Request, that.Request) &&
-			deriveTeleportEqual_2(this.KubeUsers, that.KubeUsers) &&
-			deriveTeleportEqual_89(this.AppLabels, that.AppLabels) &&
-			deriveTeleportEqual_89(this.ClusterLabels, that.ClusterLabels) &&
-			deriveTeleportEqual_89(this.KubernetesLabels, that.KubernetesLabels) &&
-			deriveTeleportEqual_89(this.DatabaseLabels, that.DatabaseLabels) &&
-			deriveTeleportEqual_2(this.DatabaseNames, that.DatabaseNames) &&
-			deriveTeleportEqual_2(this.DatabaseUsers, that.DatabaseUsers) &&
-			deriveTeleportEqual_92(this.Impersonate, that.Impersonate) &&
-			deriveTeleportEqual_93(this.ReviewRequests, that.ReviewRequests) &&
-			deriveTeleportEqual_2(this.AWSRoleARNs, that.AWSRoleARNs) &&
-			deriveTeleportEqual_2(this.WindowsDesktopLogins, that.WindowsDesktopLogins) &&
-			deriveTeleportEqual_89(this.WindowsDesktopLabels, that.WindowsDesktopLabels) &&
-			deriveTeleportEqual_94(this.RequireSessionJoin, that.RequireSessionJoin) &&
-			deriveTeleportEqual_95(this.JoinSessions, that.JoinSessions) &&
-			deriveTeleportEqual_2(this.HostGroups, that.HostGroups) &&
-			deriveTeleportEqual_2(this.HostSudoers, that.HostSudoers) &&
-			deriveTeleportEqual_2(this.AzureIdentities, that.AzureIdentities) &&
-			deriveTeleportEqual_96(this.KubernetesResources, that.KubernetesResources) &&
-			deriveTeleportEqual_2(this.GCPServiceAccounts, that.GCPServiceAccounts) &&
-			deriveTeleportEqual_89(this.DatabaseServiceLabels, that.DatabaseServiceLabels) &&
-			deriveTeleportEqual_89(this.GroupLabels, that.GroupLabels) &&
-			deriveTeleportEqual_2(this.DesktopGroups, that.DesktopGroups) &&
-			deriveTeleportEqual_2(this.DatabaseRoles, that.DatabaseRoles) &&
-			this.NodeLabelsExpression == that.NodeLabelsExpression &&
-			this.AppLabelsExpression == that.AppLabelsExpression &&
-			this.ClusterLabelsExpression == that.ClusterLabelsExpression &&
-			this.KubernetesLabelsExpression == that.KubernetesLabelsExpression &&
-			this.DatabaseLabelsExpression == that.DatabaseLabelsExpression &&
-			this.DatabaseServiceLabelsExpression == that.DatabaseServiceLabelsExpression &&
-			this.WindowsDesktopLabelsExpression == that.WindowsDesktopLabelsExpression &&
-			this.GroupLabelsExpression == that.GroupLabelsExpression &&
-			deriveTeleportEqual_97(this.DatabasePermissions, that.DatabasePermissions) &&
-			deriveTeleportEqual_98(this.SPIFFE, that.SPIFFE) &&
-			deriveTeleportEqual_99(this.AccountAssignments, that.AccountAssignments) &&
-			deriveTeleportEqual_100(this.GitHubPermissions, that.GitHubPermissions) &&
-			deriveTeleportEqual_89(this.WorkloadIdentityLabels, that.WorkloadIdentityLabels) &&
-			this.WorkloadIdentityLabelsExpression == that.WorkloadIdentityLabelsExpression &&
-			deriveTeleportEqual_101(this.MCP, that.MCP) &&
-			deriveTeleportEqual_2(this.LinuxDesktopLogins, that.LinuxDesktopLogins) &&
-			deriveTeleportEqual_89(this.LinuxDesktopLabels, that.LinuxDesktopLabels) &&
-			this.LinuxDesktopLabelsExpression == that.LinuxDesktopLabelsExpression &&
-			deriveTeleportEqual_89(this.BeamLabels, that.BeamLabels) &&
-			this.BeamLabelsExpression == that.BeamLabelsExpression
+			deriveTeleportEqual_24(this.DiscoveryAssumedRole, that.DiscoveryAssumedRole)
 }
 
 // deriveTeleportEqual_60 returns whether this and that are equal.
-func deriveTeleportEqual_60(this, that []AttributeMapping) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_102(&this[i], &that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_61 returns whether this and that are equal.
-func deriveTeleportEqual_61(this, that *AsymmetricKeyPair) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.PrivateKey == that.PrivateKey &&
-			this.Cert == that.Cert
-}
-
-// deriveTeleportEqual_62 returns whether this and that are equal.
-func deriveTeleportEqual_62(this, that *SSOClientRedirectSettings) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_2(this.AllowedHttpsHostnames, that.AllowedHttpsHostnames) &&
-			deriveTeleportEqual_2(this.InsecureAllowedCidrRanges, that.InsecureAllowedCidrRanges)
-}
-
-// deriveTeleportEqual_63 returns whether this and that are equal.
-func deriveTeleportEqual_63(this, that *SAMLConnectorMFASettings) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Enabled == that.Enabled &&
-			this.EntityDescriptor == that.EntityDescriptor &&
-			this.EntityDescriptorUrl == that.EntityDescriptorUrl &&
-			this.ForceAuthn == that.ForceAuthn &&
-			this.Issuer == that.Issuer &&
-			this.Sso == that.Sso &&
-			this.Cert == that.Cert
-}
-
-// deriveTeleportEqual_64 returns whether this and that are equal.
-func deriveTeleportEqual_64(this, that []ExternalIdentity) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqualExternalIdentity(&this[i], &that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_65 returns whether this and that are equal.
-func deriveTeleportEqual_65(this, that *LoginStatus) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.IsLocked == that.IsLocked &&
-			this.LockedMessage == that.LockedMessage &&
-			this.LockedTime.Equal(that.LockedTime) &&
-			this.LockExpires.Equal(that.LockExpires)
-}
-
-// deriveTeleportEqual_66 returns whether this and that are equal.
-func deriveTeleportEqual_66(this, that *CreatedBy) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_103(this.Connector, that.Connector) &&
-			this.Time.Equal(that.Time) &&
-			deriveTeleportEqual_104(&this.User, &that.User)
-}
-
-// deriveTeleportEqual_67 returns whether this and that are equal.
-func deriveTeleportEqual_67(this, that *LocalAuthSecrets) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			bytes.Equal(this.PasswordHash, that.PasswordHash) &&
-			this.TOTPKey == that.TOTPKey &&
-			deriveTeleportEqual_105(this.Webauthn, that.Webauthn)
-}
-
-// deriveTeleportEqual_68 returns whether this and that are equal.
-func deriveTeleportEqual_68(this, that *ThresholdIndexSets) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_106(this.Sets, that.Sets)
-}
-
-// deriveTeleportEqual_69 returns whether this and that are equal.
-func deriveTeleportEqual_69(this, that *AccessReview) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Author == that.Author &&
-			deriveTeleportEqual_2(this.Roles, that.Roles) &&
-			this.ProposedState == that.ProposedState &&
-			this.Reason == that.Reason &&
-			this.Created.Equal(that.Created) &&
-			deriveTeleportEqual_30(this.Annotations, that.Annotations) &&
-			deriveTeleportEqual_107(this.ThresholdIndexes, that.ThresholdIndexes) &&
-			deriveTeleportEqual_35(this.AccessList, that.AccessList) &&
-			((this.AssumeStartTime == nil && that.AssumeStartTime == nil) || (this.AssumeStartTime != nil && that.AssumeStartTime != nil && (*(this.AssumeStartTime)).Equal(*(that.AssumeStartTime))))
-}
-
-// deriveTeleportEqual_70 returns whether this and that are equal.
-func deriveTeleportEqual_70(this, that map[string]ResourceIDList) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for k, v := range this {
-		thatv, ok := that[k]
-		if !ok {
-			return false
-		}
-		if !(deriveTeleportEqual_108(&v, &thatv)) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_71 returns whether this and that are equal.
-func deriveTeleportEqual_71(this, that *CommandLabelV2) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Period == that.Period &&
-			deriveTeleportEqual_2(this.Command, that.Command) &&
-			this.Result == that.Result
-}
-
-// deriveTeleportEqual_72 returns whether this and that are equal.
-func deriveTeleportEqual_72(this, that []*Header) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_109(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_73 returns whether this and that are equal.
-func deriveTeleportEqual_73(this, that *AppAWSRolesAnywhereProfile) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.ProfileARN == that.ProfileARN &&
-			this.AcceptRoleSessionName == that.AcceptRoleSessionName
-}
-
-// deriveTeleportEqual_74 returns whether this and that are equal.
-func deriveTeleportEqual_74(this, that []*IdentityCenterPermissionSet) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_110(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_75 returns whether this and that are equal.
-func deriveTeleportEqual_75(this, that *PortRange) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Port == that.Port &&
-			this.EndPort == that.EndPort
-}
-
-// deriveTeleportEqual_76 returns whether this and that are equal.
-func deriveTeleportEqual_76(this, that *RotationSchedule) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.UpdateClients.Equal(that.UpdateClients) &&
-			this.UpdateServers.Equal(that.UpdateServers) &&
-			this.Standby.Equal(that.Standby)
-}
-
-// deriveTeleportEqual_77 returns whether this and that are equal.
-func deriveTeleportEqual_77(this, that []componentfeaturesv1.ComponentFeatureID) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(this[i] == that[i]) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_78 returns whether this and that are equal.
-func deriveTeleportEqual_78(this, that *RoleMapping) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Remote == that.Remote &&
-			deriveTeleportEqual_2(this.Local, that.Local)
-}
-
-// deriveTeleportEqual_79 returns whether this and that are equal.
-func deriveTeleportEqual_79(this, that []*SSHKeyPair) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(this[i].Equal(that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_80 returns whether this and that are equal.
-func deriveTeleportEqual_80(this, that []*TLSKeyPair) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_111(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_81 returns whether this and that are equal.
-func deriveTeleportEqual_81(this, that []*JWTKeyPair) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_112(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_82 returns whether this and that are equal.
-func deriveTeleportEqual_82(this, that *AssumeRole) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.RoleARN == that.RoleARN &&
-			this.ExternalID == that.ExternalID &&
-			this.RoleName == that.RoleName
-}
-
-// deriveTeleportEqual_83 returns whether this and that are equal.
-func deriveTeleportEqual_83(this, that *OktaAssignmentTargetV1) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Type == that.Type &&
-			this.Id == that.Id
-}
-
-// deriveTeleportEqual_84 returns whether this and that are equal.
-func deriveTeleportEqual_84(this, that *BoolOption) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Value == that.Value
-}
-
-// deriveTeleportEqual_85 returns whether this and that are equal.
-func deriveTeleportEqual_85(this, that *RecordSession) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_84(this.Desktop, that.Desktop) &&
-			this.Default == that.Default &&
-			this.SSH == that.SSH
-}
-
-// deriveTeleportEqual_86 returns whether this and that are equal.
-func deriveTeleportEqual_86(this, that []*CertExtension) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_113(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_87 returns whether this and that are equal.
-func deriveTeleportEqual_87(this, that *IdPOptions) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_114(this.SAML, that.SAML)
-}
-
-// deriveTeleportEqual_88 returns whether this and that are equal.
-func deriveTeleportEqual_88(this, that *SSHPortForwarding) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_115(this.Local, that.Local) &&
-			deriveTeleportEqual_116(this.Remote, that.Remote)
-}
-
-// deriveTeleportEqual_89 returns whether this and that are equal.
-func deriveTeleportEqual_89(this, that map[string]utils.Strings) bool {
+func deriveTeleportEqual_60(this, that map[string]utils.Strings) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1506,8 +1100,8 @@ func deriveTeleportEqual_89(this, that map[string]utils.Strings) bool {
 	return true
 }
 
-// deriveTeleportEqual_90 returns whether this and that are equal.
-func deriveTeleportEqual_90(this, that []Rule) bool {
+// deriveTeleportEqual_61 returns whether this and that are equal.
+func deriveTeleportEqual_61(this, that []*OktaAssignmentTargetV1) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1515,30 +1109,462 @@ func deriveTeleportEqual_90(this, that []Rule) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_117(&this[i], &that[i])) {
+		if !(deriveTeleportEqual_86(this[i], that[i])) {
 			return false
 		}
 	}
 	return true
 }
 
-// deriveTeleportEqual_91 returns whether this and that are equal.
-func deriveTeleportEqual_91(this, that *AccessRequestConditions) bool {
+// deriveTeleportEqual_62 returns whether this and that are equal.
+func deriveTeleportEqual_62(this, that *RoleOptions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
+			this.ForwardAgent == that.ForwardAgent &&
+			this.MaxSessionTTL == that.MaxSessionTTL &&
+			deriveTeleportEqual_87(this.PortForwarding, that.PortForwarding) &&
+			this.CertificateFormat == that.CertificateFormat &&
+			this.ClientIdleTimeout == that.ClientIdleTimeout &&
+			this.DisconnectExpiredCert == that.DisconnectExpiredCert &&
+			deriveTeleportEqual_2(this.BPF, that.BPF) &&
+			this.PermitX11Forwarding == that.PermitX11Forwarding &&
+			this.MaxConnections == that.MaxConnections &&
+			this.MaxSessions == that.MaxSessions &&
+			this.RequestAccess == that.RequestAccess &&
+			this.RequestPrompt == that.RequestPrompt &&
+			this.Lock == that.Lock &&
+			deriveTeleportEqual_88(this.RecordSession, that.RecordSession) &&
+			deriveTeleportEqual_87(this.DesktopClipboard, that.DesktopClipboard) &&
+			deriveTeleportEqual_89(this.CertExtensions, that.CertExtensions) &&
+			this.MaxKubernetesConnections == that.MaxKubernetesConnections &&
+			deriveTeleportEqual_87(this.DesktopDirectorySharing, that.DesktopDirectorySharing) &&
+			deriveTeleportEqual_87(this.CreateHostUser, that.CreateHostUser) &&
+			this.PinSourceIP == that.PinSourceIP &&
+			deriveTeleportEqual_87(this.SSHFileCopy, that.SSHFileCopy) &&
+			this.RequireMFAType == that.RequireMFAType &&
+			this.DeviceTrustMode == that.DeviceTrustMode &&
+			deriveTeleportEqual_90(this.IDP, that.IDP) &&
+			deriveTeleportEqual_87(this.CreateDesktopUser, that.CreateDesktopUser) &&
+			deriveTeleportEqual_87(this.CreateDatabaseUser, that.CreateDatabaseUser) &&
+			this.CreateHostUserMode == that.CreateHostUserMode &&
+			this.CreateDatabaseUserMode == that.CreateDatabaseUserMode &&
+			this.MFAVerificationInterval == that.MFAVerificationInterval &&
+			this.CreateHostUserDefaultShell == that.CreateHostUserDefaultShell &&
+			deriveTeleportEqual_91(this.SSHPortForwarding, that.SSHPortForwarding)
+}
+
+// deriveTeleportEqual_63 returns whether this and that are equal.
+func deriveTeleportEqual_63(this, that *RoleConditions) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.Logins, that.Logins) &&
+			deriveTeleportEqual_2(this.Namespaces, that.Namespaces) &&
+			deriveTeleportEqual_60(this.NodeLabels, that.NodeLabels) &&
+			deriveTeleportEqual_92(this.Rules, that.Rules) &&
+			deriveTeleportEqual_2(this.KubeGroups, that.KubeGroups) &&
+			deriveTeleportEqual_93(this.Request, that.Request) &&
+			deriveTeleportEqual_2(this.KubeUsers, that.KubeUsers) &&
+			deriveTeleportEqual_60(this.AppLabels, that.AppLabels) &&
+			deriveTeleportEqual_60(this.ClusterLabels, that.ClusterLabels) &&
+			deriveTeleportEqual_60(this.KubernetesLabels, that.KubernetesLabels) &&
+			deriveTeleportEqual_60(this.DatabaseLabels, that.DatabaseLabels) &&
+			deriveTeleportEqual_2(this.DatabaseNames, that.DatabaseNames) &&
+			deriveTeleportEqual_2(this.DatabaseUsers, that.DatabaseUsers) &&
+			deriveTeleportEqual_94(this.Impersonate, that.Impersonate) &&
+			deriveTeleportEqual_95(this.ReviewRequests, that.ReviewRequests) &&
+			deriveTeleportEqual_2(this.AWSRoleARNs, that.AWSRoleARNs) &&
+			deriveTeleportEqual_2(this.WindowsDesktopLogins, that.WindowsDesktopLogins) &&
+			deriveTeleportEqual_60(this.WindowsDesktopLabels, that.WindowsDesktopLabels) &&
+			deriveTeleportEqual_96(this.RequireSessionJoin, that.RequireSessionJoin) &&
+			deriveTeleportEqual_97(this.JoinSessions, that.JoinSessions) &&
+			deriveTeleportEqual_2(this.HostGroups, that.HostGroups) &&
+			deriveTeleportEqual_2(this.HostSudoers, that.HostSudoers) &&
+			deriveTeleportEqual_2(this.AzureIdentities, that.AzureIdentities) &&
+			deriveTeleportEqual_98(this.KubernetesResources, that.KubernetesResources) &&
+			deriveTeleportEqual_2(this.GCPServiceAccounts, that.GCPServiceAccounts) &&
+			deriveTeleportEqual_60(this.DatabaseServiceLabels, that.DatabaseServiceLabels) &&
+			deriveTeleportEqual_60(this.GroupLabels, that.GroupLabels) &&
+			deriveTeleportEqual_2(this.DesktopGroups, that.DesktopGroups) &&
+			deriveTeleportEqual_2(this.DatabaseRoles, that.DatabaseRoles) &&
+			this.NodeLabelsExpression == that.NodeLabelsExpression &&
+			this.AppLabelsExpression == that.AppLabelsExpression &&
+			this.ClusterLabelsExpression == that.ClusterLabelsExpression &&
+			this.KubernetesLabelsExpression == that.KubernetesLabelsExpression &&
+			this.DatabaseLabelsExpression == that.DatabaseLabelsExpression &&
+			this.DatabaseServiceLabelsExpression == that.DatabaseServiceLabelsExpression &&
+			this.WindowsDesktopLabelsExpression == that.WindowsDesktopLabelsExpression &&
+			this.GroupLabelsExpression == that.GroupLabelsExpression &&
+			deriveTeleportEqual_99(this.DatabasePermissions, that.DatabasePermissions) &&
+			deriveTeleportEqual_100(this.SPIFFE, that.SPIFFE) &&
+			deriveTeleportEqual_101(this.AccountAssignments, that.AccountAssignments) &&
+			deriveTeleportEqual_102(this.GitHubPermissions, that.GitHubPermissions) &&
+			deriveTeleportEqual_60(this.WorkloadIdentityLabels, that.WorkloadIdentityLabels) &&
+			this.WorkloadIdentityLabelsExpression == that.WorkloadIdentityLabelsExpression &&
+			deriveTeleportEqual_103(this.MCP, that.MCP) &&
+			deriveTeleportEqual_2(this.LinuxDesktopLogins, that.LinuxDesktopLogins) &&
+			deriveTeleportEqual_60(this.LinuxDesktopLabels, that.LinuxDesktopLabels) &&
+			this.LinuxDesktopLabelsExpression == that.LinuxDesktopLabelsExpression &&
+			deriveTeleportEqual_60(this.BeamLabels, that.BeamLabels) &&
+			this.BeamLabelsExpression == that.BeamLabelsExpression
+}
+
+// deriveTeleportEqual_64 returns whether this and that are equal.
+func deriveTeleportEqual_64(this, that []AttributeMapping) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_104(&this[i], &that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_65 returns whether this and that are equal.
+func deriveTeleportEqual_65(this, that *AsymmetricKeyPair) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.PrivateKey == that.PrivateKey &&
+			this.Cert == that.Cert
+}
+
+// deriveTeleportEqual_66 returns whether this and that are equal.
+func deriveTeleportEqual_66(this, that *SSOClientRedirectSettings) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.AllowedHttpsHostnames, that.AllowedHttpsHostnames) &&
+			deriveTeleportEqual_2(this.InsecureAllowedCidrRanges, that.InsecureAllowedCidrRanges)
+}
+
+// deriveTeleportEqual_67 returns whether this and that are equal.
+func deriveTeleportEqual_67(this, that *SAMLConnectorMFASettings) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Enabled == that.Enabled &&
+			this.EntityDescriptor == that.EntityDescriptor &&
+			this.EntityDescriptorUrl == that.EntityDescriptorUrl &&
+			this.ForceAuthn == that.ForceAuthn &&
+			this.Issuer == that.Issuer &&
+			this.Sso == that.Sso &&
+			this.Cert == that.Cert
+}
+
+// deriveTeleportEqual_68 returns whether this and that are equal.
+func deriveTeleportEqual_68(this, that []ExternalIdentity) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqualExternalIdentity(&this[i], &that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_69 returns whether this and that are equal.
+func deriveTeleportEqual_69(this, that *LoginStatus) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.IsLocked == that.IsLocked &&
+			this.LockedMessage == that.LockedMessage &&
+			this.LockedTime.Equal(that.LockedTime) &&
+			this.LockExpires.Equal(that.LockExpires)
+}
+
+// deriveTeleportEqual_70 returns whether this and that are equal.
+func deriveTeleportEqual_70(this, that *CreatedBy) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_105(this.Connector, that.Connector) &&
+			this.Time.Equal(that.Time) &&
+			deriveTeleportEqual_106(&this.User, &that.User)
+}
+
+// deriveTeleportEqual_71 returns whether this and that are equal.
+func deriveTeleportEqual_71(this, that *LocalAuthSecrets) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			bytes.Equal(this.PasswordHash, that.PasswordHash) &&
+			this.TOTPKey == that.TOTPKey &&
+			deriveTeleportEqual_107(this.Webauthn, that.Webauthn)
+}
+
+// deriveTeleportEqual_72 returns whether this and that are equal.
+func deriveTeleportEqual_72(this, that *ThresholdIndexSets) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_108(this.Sets, that.Sets)
+}
+
+// deriveTeleportEqual_73 returns whether this and that are equal.
+func deriveTeleportEqual_73(this, that *AccessReview) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Author == that.Author &&
 			deriveTeleportEqual_2(this.Roles, that.Roles) &&
-			deriveTeleportEqual_118(this.ClaimsToRoles, that.ClaimsToRoles) &&
-			deriveTeleportEqual_30(this.Annotations, that.Annotations) &&
-			deriveTeleportEqual_31(this.Thresholds, that.Thresholds) &&
-			deriveTeleportEqual_2(this.SuggestedReviewers, that.SuggestedReviewers) &&
-			deriveTeleportEqual_2(this.SearchAsRoles, that.SearchAsRoles) &&
-			this.MaxDuration == that.MaxDuration &&
-			deriveTeleportEqual_119(this.KubernetesResources, that.KubernetesResources) &&
-			deriveTeleportEqual_120(this.Reason, that.Reason)
+			this.ProposedState == that.ProposedState &&
+			this.Reason == that.Reason &&
+			this.Created.Equal(that.Created) &&
+			deriveTeleportEqual_33(this.Annotations, that.Annotations) &&
+			deriveTeleportEqual_109(this.ThresholdIndexes, that.ThresholdIndexes) &&
+			deriveTeleportEqual_38(this.AccessList, that.AccessList) &&
+			((this.AssumeStartTime == nil && that.AssumeStartTime == nil) || (this.AssumeStartTime != nil && that.AssumeStartTime != nil && (*(this.AssumeStartTime)).Equal(*(that.AssumeStartTime))))
+}
+
+// deriveTeleportEqual_74 returns whether this and that are equal.
+func deriveTeleportEqual_74(this, that map[string]ResourceIDList) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for k, v := range this {
+		thatv, ok := that[k]
+		if !ok {
+			return false
+		}
+		if !(deriveTeleportEqual_110(&v, &thatv)) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_75 returns whether this and that are equal.
+func deriveTeleportEqual_75(this, that *CommandLabelV2) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Period == that.Period &&
+			deriveTeleportEqual_2(this.Command, that.Command) &&
+			this.Result == that.Result
+}
+
+// deriveTeleportEqual_76 returns whether this and that are equal.
+func deriveTeleportEqual_76(this, that []*Header) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_111(this[i], that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_77 returns whether this and that are equal.
+func deriveTeleportEqual_77(this, that *AppAWSRolesAnywhereProfile) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.ProfileARN == that.ProfileARN &&
+			this.AcceptRoleSessionName == that.AcceptRoleSessionName
+}
+
+// deriveTeleportEqual_78 returns whether this and that are equal.
+func deriveTeleportEqual_78(this, that []*IdentityCenterPermissionSet) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_112(this[i], that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_79 returns whether this and that are equal.
+func deriveTeleportEqual_79(this, that *PortRange) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Port == that.Port &&
+			this.EndPort == that.EndPort
+}
+
+// deriveTeleportEqual_80 returns whether this and that are equal.
+func deriveTeleportEqual_80(this, that *RotationSchedule) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.UpdateClients.Equal(that.UpdateClients) &&
+			this.UpdateServers.Equal(that.UpdateServers) &&
+			this.Standby.Equal(that.Standby)
+}
+
+// deriveTeleportEqual_81 returns whether this and that are equal.
+func deriveTeleportEqual_81(this, that []componentfeaturesv1.ComponentFeatureID) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(this[i] == that[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_82 returns whether this and that are equal.
+func deriveTeleportEqual_82(this, that *RoleMapping) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Remote == that.Remote &&
+			deriveTeleportEqual_2(this.Local, that.Local)
+}
+
+// deriveTeleportEqual_83 returns whether this and that are equal.
+func deriveTeleportEqual_83(this, that []*SSHKeyPair) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(this[i].Equal(that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_84 returns whether this and that are equal.
+func deriveTeleportEqual_84(this, that []*TLSKeyPair) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_113(this[i], that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_85 returns whether this and that are equal.
+func deriveTeleportEqual_85(this, that []*JWTKeyPair) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_114(this[i], that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_86 returns whether this and that are equal.
+func deriveTeleportEqual_86(this, that *OktaAssignmentTargetV1) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Type == that.Type &&
+			this.Id == that.Id
+}
+
+// deriveTeleportEqual_87 returns whether this and that are equal.
+func deriveTeleportEqual_87(this, that *BoolOption) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Value == that.Value
+}
+
+// deriveTeleportEqual_88 returns whether this and that are equal.
+func deriveTeleportEqual_88(this, that *RecordSession) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_87(this.Desktop, that.Desktop) &&
+			this.Default == that.Default &&
+			this.SSH == that.SSH
+}
+
+// deriveTeleportEqual_89 returns whether this and that are equal.
+func deriveTeleportEqual_89(this, that []*CertExtension) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_115(this[i], that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_90 returns whether this and that are equal.
+func deriveTeleportEqual_90(this, that *IdPOptions) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_116(this.SAML, that.SAML)
+}
+
+// deriveTeleportEqual_91 returns whether this and that are equal.
+func deriveTeleportEqual_91(this, that *SSHPortForwarding) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_117(this.Local, that.Local) &&
+			deriveTeleportEqual_118(this.Remote, that.Remote)
 }
 
 // deriveTeleportEqual_92 returns whether this and that are equal.
-func deriveTeleportEqual_92(this, that *ImpersonateConditions) bool {
+func deriveTeleportEqual_92(this, that []Rule) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_119(&this[i], &that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_93 returns whether this and that are equal.
+func deriveTeleportEqual_93(this, that *AccessRequestConditions) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.Roles, that.Roles) &&
+			deriveTeleportEqual_120(this.ClaimsToRoles, that.ClaimsToRoles) &&
+			deriveTeleportEqual_33(this.Annotations, that.Annotations) &&
+			deriveTeleportEqual_34(this.Thresholds, that.Thresholds) &&
+			deriveTeleportEqual_2(this.SuggestedReviewers, that.SuggestedReviewers) &&
+			deriveTeleportEqual_2(this.SearchAsRoles, that.SearchAsRoles) &&
+			this.MaxDuration == that.MaxDuration &&
+			deriveTeleportEqual_121(this.KubernetesResources, that.KubernetesResources) &&
+			deriveTeleportEqual_122(this.Reason, that.Reason)
+}
+
+// deriveTeleportEqual_94 returns whether this and that are equal.
+func deriveTeleportEqual_94(this, that *ImpersonateConditions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Users, that.Users) &&
@@ -1546,50 +1572,18 @@ func deriveTeleportEqual_92(this, that *ImpersonateConditions) bool {
 			this.Where == that.Where
 }
 
-// deriveTeleportEqual_93 returns whether this and that are equal.
-func deriveTeleportEqual_93(this, that *AccessReviewConditions) bool {
+// deriveTeleportEqual_95 returns whether this and that are equal.
+func deriveTeleportEqual_95(this, that *AccessReviewConditions) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Roles, that.Roles) &&
-			deriveTeleportEqual_118(this.ClaimsToRoles, that.ClaimsToRoles) &&
+			deriveTeleportEqual_120(this.ClaimsToRoles, that.ClaimsToRoles) &&
 			this.Where == that.Where &&
 			deriveTeleportEqual_2(this.PreviewAsRoles, that.PreviewAsRoles)
 }
 
-// deriveTeleportEqual_94 returns whether this and that are equal.
-func deriveTeleportEqual_94(this, that []*SessionRequirePolicy) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_121(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_95 returns whether this and that are equal.
-func deriveTeleportEqual_95(this, that []*SessionJoinPolicy) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_122(this[i], that[i])) {
-			return false
-		}
-	}
-	return true
-}
-
 // deriveTeleportEqual_96 returns whether this and that are equal.
-func deriveTeleportEqual_96(this, that []KubernetesResource) bool {
+func deriveTeleportEqual_96(this, that []*SessionRequirePolicy) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1597,7 +1591,7 @@ func deriveTeleportEqual_96(this, that []KubernetesResource) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_123(&this[i], &that[i])) {
+		if !(deriveTeleportEqual_123(this[i], that[i])) {
 			return false
 		}
 	}
@@ -1605,7 +1599,7 @@ func deriveTeleportEqual_96(this, that []KubernetesResource) bool {
 }
 
 // deriveTeleportEqual_97 returns whether this and that are equal.
-func deriveTeleportEqual_97(this, that []DatabasePermission) bool {
+func deriveTeleportEqual_97(this, that []*SessionJoinPolicy) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1613,7 +1607,7 @@ func deriveTeleportEqual_97(this, that []DatabasePermission) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_124(&this[i], &that[i])) {
+		if !(deriveTeleportEqual_124(this[i], that[i])) {
 			return false
 		}
 	}
@@ -1621,7 +1615,7 @@ func deriveTeleportEqual_97(this, that []DatabasePermission) bool {
 }
 
 // deriveTeleportEqual_98 returns whether this and that are equal.
-func deriveTeleportEqual_98(this, that []*SPIFFERoleCondition) bool {
+func deriveTeleportEqual_98(this, that []KubernetesResource) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1629,7 +1623,7 @@ func deriveTeleportEqual_98(this, that []*SPIFFERoleCondition) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_125(this[i], that[i])) {
+		if !(deriveTeleportEqual_125(&this[i], &that[i])) {
 			return false
 		}
 	}
@@ -1637,7 +1631,7 @@ func deriveTeleportEqual_98(this, that []*SPIFFERoleCondition) bool {
 }
 
 // deriveTeleportEqual_99 returns whether this and that are equal.
-func deriveTeleportEqual_99(this, that []IdentityCenterAccountAssignment) bool {
+func deriveTeleportEqual_99(this, that []DatabasePermission) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1653,7 +1647,7 @@ func deriveTeleportEqual_99(this, that []IdentityCenterAccountAssignment) bool {
 }
 
 // deriveTeleportEqual_100 returns whether this and that are equal.
-func deriveTeleportEqual_100(this, that []GitHubPermission) bool {
+func deriveTeleportEqual_100(this, that []*SPIFFERoleCondition) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1661,7 +1655,7 @@ func deriveTeleportEqual_100(this, that []GitHubPermission) bool {
 		return false
 	}
 	for i := 0; i < len(this); i++ {
-		if !(deriveTeleportEqual_127(&this[i], &that[i])) {
+		if !(deriveTeleportEqual_127(this[i], that[i])) {
 			return false
 		}
 	}
@@ -1669,46 +1663,7 @@ func deriveTeleportEqual_100(this, that []GitHubPermission) bool {
 }
 
 // deriveTeleportEqual_101 returns whether this and that are equal.
-func deriveTeleportEqual_101(this, that *MCPPermissions) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_2(this.Tools, that.Tools)
-}
-
-// deriveTeleportEqual_102 returns whether this and that are equal.
-func deriveTeleportEqual_102(this, that *AttributeMapping) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Name == that.Name &&
-			this.Value == that.Value &&
-			deriveTeleportEqual_2(this.Roles, that.Roles)
-}
-
-// deriveTeleportEqual_103 returns whether this and that are equal.
-func deriveTeleportEqual_103(this, that *ConnectorRef) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Type == that.Type &&
-			this.ID == that.ID &&
-			this.Identity == that.Identity
-}
-
-// deriveTeleportEqual_104 returns whether this and that are equal.
-func deriveTeleportEqual_104(this, that *UserRef) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Name == that.Name
-}
-
-// deriveTeleportEqual_105 returns whether this and that are equal.
-func deriveTeleportEqual_105(this, that *WebauthnLocalAuth) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			bytes.Equal(this.UserID, that.UserID)
-}
-
-// deriveTeleportEqual_106 returns whether this and that are equal.
-func deriveTeleportEqual_106(this, that []ThresholdIndexSet) bool {
+func deriveTeleportEqual_101(this, that []IdentityCenterAccountAssignment) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1723,108 +1678,8 @@ func deriveTeleportEqual_106(this, that []ThresholdIndexSet) bool {
 	return true
 }
 
-// deriveTeleportEqual_107 returns whether this and that are equal.
-func deriveTeleportEqual_107(this, that []uint32) bool {
-	if this == nil || that == nil {
-		return this == nil && that == nil
-	}
-	if len(this) != len(that) {
-		return false
-	}
-	for i := 0; i < len(this); i++ {
-		if !(this[i] == that[i]) {
-			return false
-		}
-	}
-	return true
-}
-
-// deriveTeleportEqual_108 returns whether this and that are equal.
-func deriveTeleportEqual_108(this, that *ResourceIDList) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_34(this.ResourceIds, that.ResourceIds)
-}
-
-// deriveTeleportEqual_109 returns whether this and that are equal.
-func deriveTeleportEqual_109(this, that *Header) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Name == that.Name &&
-			this.Value == that.Value
-}
-
-// deriveTeleportEqual_110 returns whether this and that are equal.
-func deriveTeleportEqual_110(this, that *IdentityCenterPermissionSet) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.ARN == that.ARN &&
-			this.Name == that.Name &&
-			this.AssignmentID == that.AssignmentID
-}
-
-// deriveTeleportEqual_111 returns whether this and that are equal.
-func deriveTeleportEqual_111(this, that *TLSKeyPair) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			bytes.Equal(this.Cert, that.Cert) &&
-			bytes.Equal(this.Key, that.Key) &&
-			this.KeyType == that.KeyType &&
-			bytes.Equal(this.CRL, that.CRL)
-}
-
-// deriveTeleportEqual_112 returns whether this and that are equal.
-func deriveTeleportEqual_112(this, that *JWTKeyPair) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			bytes.Equal(this.PublicKey, that.PublicKey) &&
-			bytes.Equal(this.PrivateKey, that.PrivateKey) &&
-			this.PrivateKeyType == that.PrivateKeyType
-}
-
-// deriveTeleportEqual_113 returns whether this and that are equal.
-func deriveTeleportEqual_113(this, that *CertExtension) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			this.Type == that.Type &&
-			this.Mode == that.Mode &&
-			this.Name == that.Name &&
-			this.Value == that.Value
-}
-
-// deriveTeleportEqual_114 returns whether this and that are equal.
-func deriveTeleportEqual_114(this, that *IdPSAMLOptions) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_84(this.Enabled, that.Enabled)
-}
-
-// deriveTeleportEqual_115 returns whether this and that are equal.
-func deriveTeleportEqual_115(this, that *SSHLocalPortForwarding) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_84(this.Enabled, that.Enabled)
-}
-
-// deriveTeleportEqual_116 returns whether this and that are equal.
-func deriveTeleportEqual_116(this, that *SSHRemotePortForwarding) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_84(this.Enabled, that.Enabled)
-}
-
-// deriveTeleportEqual_117 returns whether this and that are equal.
-func deriveTeleportEqual_117(this, that *Rule) bool {
-	return (this == nil && that == nil) ||
-		this != nil && that != nil &&
-			deriveTeleportEqual_2(this.Resources, that.Resources) &&
-			deriveTeleportEqual_2(this.Verbs, that.Verbs) &&
-			this.Where == that.Where &&
-			deriveTeleportEqual_2(this.Actions, that.Actions)
-}
-
-// deriveTeleportEqual_118 returns whether this and that are equal.
-func deriveTeleportEqual_118(this, that []ClaimMapping) bool {
+// deriveTeleportEqual_102 returns whether this and that are equal.
+func deriveTeleportEqual_102(this, that []GitHubPermission) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1839,8 +1694,47 @@ func deriveTeleportEqual_118(this, that []ClaimMapping) bool {
 	return true
 }
 
-// deriveTeleportEqual_119 returns whether this and that are equal.
-func deriveTeleportEqual_119(this, that []RequestKubernetesResource) bool {
+// deriveTeleportEqual_103 returns whether this and that are equal.
+func deriveTeleportEqual_103(this, that *MCPPermissions) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.Tools, that.Tools)
+}
+
+// deriveTeleportEqual_104 returns whether this and that are equal.
+func deriveTeleportEqual_104(this, that *AttributeMapping) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Name == that.Name &&
+			this.Value == that.Value &&
+			deriveTeleportEqual_2(this.Roles, that.Roles)
+}
+
+// deriveTeleportEqual_105 returns whether this and that are equal.
+func deriveTeleportEqual_105(this, that *ConnectorRef) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Type == that.Type &&
+			this.ID == that.ID &&
+			this.Identity == that.Identity
+}
+
+// deriveTeleportEqual_106 returns whether this and that are equal.
+func deriveTeleportEqual_106(this, that *UserRef) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Name == that.Name
+}
+
+// deriveTeleportEqual_107 returns whether this and that are equal.
+func deriveTeleportEqual_107(this, that *WebauthnLocalAuth) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			bytes.Equal(this.UserID, that.UserID)
+}
+
+// deriveTeleportEqual_108 returns whether this and that are equal.
+func deriveTeleportEqual_108(this, that []ThresholdIndexSet) bool {
 	if this == nil || that == nil {
 		return this == nil && that == nil
 	}
@@ -1855,16 +1749,148 @@ func deriveTeleportEqual_119(this, that []RequestKubernetesResource) bool {
 	return true
 }
 
+// deriveTeleportEqual_109 returns whether this and that are equal.
+func deriveTeleportEqual_109(this, that []uint32) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(this[i] == that[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_110 returns whether this and that are equal.
+func deriveTeleportEqual_110(this, that *ResourceIDList) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_37(this.ResourceIds, that.ResourceIds)
+}
+
+// deriveTeleportEqual_111 returns whether this and that are equal.
+func deriveTeleportEqual_111(this, that *Header) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Name == that.Name &&
+			this.Value == that.Value
+}
+
+// deriveTeleportEqual_112 returns whether this and that are equal.
+func deriveTeleportEqual_112(this, that *IdentityCenterPermissionSet) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.ARN == that.ARN &&
+			this.Name == that.Name &&
+			this.AssignmentID == that.AssignmentID
+}
+
+// deriveTeleportEqual_113 returns whether this and that are equal.
+func deriveTeleportEqual_113(this, that *TLSKeyPair) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			bytes.Equal(this.Cert, that.Cert) &&
+			bytes.Equal(this.Key, that.Key) &&
+			this.KeyType == that.KeyType &&
+			bytes.Equal(this.CRL, that.CRL)
+}
+
+// deriveTeleportEqual_114 returns whether this and that are equal.
+func deriveTeleportEqual_114(this, that *JWTKeyPair) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			bytes.Equal(this.PublicKey, that.PublicKey) &&
+			bytes.Equal(this.PrivateKey, that.PrivateKey) &&
+			this.PrivateKeyType == that.PrivateKeyType
+}
+
+// deriveTeleportEqual_115 returns whether this and that are equal.
+func deriveTeleportEqual_115(this, that *CertExtension) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			this.Type == that.Type &&
+			this.Mode == that.Mode &&
+			this.Name == that.Name &&
+			this.Value == that.Value
+}
+
+// deriveTeleportEqual_116 returns whether this and that are equal.
+func deriveTeleportEqual_116(this, that *IdPSAMLOptions) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_87(this.Enabled, that.Enabled)
+}
+
+// deriveTeleportEqual_117 returns whether this and that are equal.
+func deriveTeleportEqual_117(this, that *SSHLocalPortForwarding) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_87(this.Enabled, that.Enabled)
+}
+
+// deriveTeleportEqual_118 returns whether this and that are equal.
+func deriveTeleportEqual_118(this, that *SSHRemotePortForwarding) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_87(this.Enabled, that.Enabled)
+}
+
+// deriveTeleportEqual_119 returns whether this and that are equal.
+func deriveTeleportEqual_119(this, that *Rule) bool {
+	return (this == nil && that == nil) ||
+		this != nil && that != nil &&
+			deriveTeleportEqual_2(this.Resources, that.Resources) &&
+			deriveTeleportEqual_2(this.Verbs, that.Verbs) &&
+			this.Where == that.Where &&
+			deriveTeleportEqual_2(this.Actions, that.Actions)
+}
+
 // deriveTeleportEqual_120 returns whether this and that are equal.
-func deriveTeleportEqual_120(this, that *AccessRequestConditionsReason) bool {
+func deriveTeleportEqual_120(this, that []ClaimMapping) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_131(&this[i], &that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_121 returns whether this and that are equal.
+func deriveTeleportEqual_121(this, that []RequestKubernetesResource) bool {
+	if this == nil || that == nil {
+		return this == nil && that == nil
+	}
+	if len(this) != len(that) {
+		return false
+	}
+	for i := 0; i < len(this); i++ {
+		if !(deriveTeleportEqual_132(&this[i], &that[i])) {
+			return false
+		}
+	}
+	return true
+}
+
+// deriveTeleportEqual_122 returns whether this and that are equal.
+func deriveTeleportEqual_122(this, that *AccessRequestConditionsReason) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Mode == that.Mode &&
 			this.Prompt == that.Prompt
 }
 
-// deriveTeleportEqual_121 returns whether this and that are equal.
-func deriveTeleportEqual_121(this, that *SessionRequirePolicy) bool {
+// deriveTeleportEqual_123 returns whether this and that are equal.
+func deriveTeleportEqual_123(this, that *SessionRequirePolicy) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name &&
@@ -1875,8 +1901,8 @@ func deriveTeleportEqual_121(this, that *SessionRequirePolicy) bool {
 			this.OnLeave == that.OnLeave
 }
 
-// deriveTeleportEqual_122 returns whether this and that are equal.
-func deriveTeleportEqual_122(this, that *SessionJoinPolicy) bool {
+// deriveTeleportEqual_124 returns whether this and that are equal.
+func deriveTeleportEqual_124(this, that *SessionJoinPolicy) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Name == that.Name &&
@@ -1885,8 +1911,8 @@ func deriveTeleportEqual_122(this, that *SessionJoinPolicy) bool {
 			deriveTeleportEqual_2(this.Modes, that.Modes)
 }
 
-// deriveTeleportEqual_123 returns whether this and that are equal.
-func deriveTeleportEqual_123(this, that *KubernetesResource) bool {
+// deriveTeleportEqual_125 returns whether this and that are equal.
+func deriveTeleportEqual_125(this, that *KubernetesResource) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Kind == that.Kind &&
@@ -1896,16 +1922,16 @@ func deriveTeleportEqual_123(this, that *KubernetesResource) bool {
 			this.APIGroup == that.APIGroup
 }
 
-// deriveTeleportEqual_124 returns whether this and that are equal.
-func deriveTeleportEqual_124(this, that *DatabasePermission) bool {
+// deriveTeleportEqual_126 returns whether this and that are equal.
+func deriveTeleportEqual_126(this, that *DatabasePermission) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Permissions, that.Permissions) &&
-			deriveTeleportEqual_89(this.Match, that.Match)
+			deriveTeleportEqual_60(this.Match, that.Match)
 }
 
-// deriveTeleportEqual_125 returns whether this and that are equal.
-func deriveTeleportEqual_125(this, that *SPIFFERoleCondition) bool {
+// deriveTeleportEqual_127 returns whether this and that are equal.
+func deriveTeleportEqual_127(this, that *SPIFFERoleCondition) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Path == that.Path &&
@@ -1913,30 +1939,30 @@ func deriveTeleportEqual_125(this, that *SPIFFERoleCondition) bool {
 			deriveTeleportEqual_2(this.IPSANs, that.IPSANs)
 }
 
-// deriveTeleportEqual_126 returns whether this and that are equal.
-func deriveTeleportEqual_126(this, that *IdentityCenterAccountAssignment) bool {
+// deriveTeleportEqual_128 returns whether this and that are equal.
+func deriveTeleportEqual_128(this, that *IdentityCenterAccountAssignment) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.PermissionSet == that.PermissionSet &&
 			this.Account == that.Account
 }
 
-// deriveTeleportEqual_127 returns whether this and that are equal.
-func deriveTeleportEqual_127(this, that *GitHubPermission) bool {
+// deriveTeleportEqual_129 returns whether this and that are equal.
+func deriveTeleportEqual_129(this, that *GitHubPermission) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			deriveTeleportEqual_2(this.Organizations, that.Organizations)
 }
 
-// deriveTeleportEqual_128 returns whether this and that are equal.
-func deriveTeleportEqual_128(this, that *ThresholdIndexSet) bool {
+// deriveTeleportEqual_130 returns whether this and that are equal.
+func deriveTeleportEqual_130(this, that *ThresholdIndexSet) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
-			deriveTeleportEqual_107(this.Indexes, that.Indexes)
+			deriveTeleportEqual_109(this.Indexes, that.Indexes)
 }
 
-// deriveTeleportEqual_129 returns whether this and that are equal.
-func deriveTeleportEqual_129(this, that *ClaimMapping) bool {
+// deriveTeleportEqual_131 returns whether this and that are equal.
+func deriveTeleportEqual_131(this, that *ClaimMapping) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Claim == that.Claim &&
@@ -1944,8 +1970,8 @@ func deriveTeleportEqual_129(this, that *ClaimMapping) bool {
 			deriveTeleportEqual_2(this.Roles, that.Roles)
 }
 
-// deriveTeleportEqual_130 returns whether this and that are equal.
-func deriveTeleportEqual_130(this, that *RequestKubernetesResource) bool {
+// deriveTeleportEqual_132 returns whether this and that are equal.
+func deriveTeleportEqual_132(this, that *RequestKubernetesResource) bool {
 	return (this == nil && that == nil) ||
 		this != nil && that != nil &&
 			this.Kind == that.Kind &&
diff --git a/api/types/matchers_accessgraph.go b/api/types/matchers_accessgraph.go
index d7596a5733c..c1ac1240b83 100644
--- a/api/types/matchers_accessgraph.go
+++ b/api/types/matchers_accessgraph.go
@@ -54,3 +54,8 @@ func (a *AccessGraphAWSSync) CheckAndSetDefaults() error {
 
 	return nil
 }
+
+// IsEqual determines if two resources are equivalent to one another.
+func (a *AccessGraphAWSSync) IsEqual(other *AccessGraphAWSSync) bool {
+	return deriveTeleportEqualAccessGraphAWSSync(a, other)
+}
diff --git a/lib/kube/proxy/watcher.go b/lib/kube/proxy/watcher.go
index 368d0860671..75bd46098e0 100644
--- a/lib/kube/proxy/watcher.go
+++ b/lib/kube/proxy/watcher.go
@@ -43,11 +43,14 @@ func (s *TLSServer) startReconciler(ctx context.Context) (err error) {
 	s.reconciler, err = services.NewReconciler(services.ReconcilerConfig[types.KubeCluster]{
 		Matcher:             s.matcher,
 		GetCurrentResources: s.getResources,
-		GetNewResources:     s.monitoredKubeClusters.get,
-		OnCreate:            s.onCreate,
-		OnUpdate:            s.onUpdate,
-		OnDelete:            s.onDelete,
-		Logger:              s.log.With("kind", types.KindKubernetesCluster),
+		CompareResources: func(kc1, kc2 types.KubeCluster) int {
+			return services.EqualFromBool(kc1.IsEqual(kc2))
+		},
+		GetNewResources: s.monitoredKubeClusters.get,
+		OnCreate:        s.onCreate,
+		OnUpdate:        s.onUpdate,
+		OnDelete:        s.onDelete,
+		Logger:          s.log.With("kind", types.KindKubernetesCluster),
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/services/compare.go b/lib/services/compare.go
deleted file mode 100644
index 0a0fe11f13b..00000000000
--- a/lib/services/compare.go
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2023  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package services
-
-import (
-	"strings"
-
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-
-	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
-	"github.com/gravitational/teleport/api/types"
-	"github.com/gravitational/teleport/api/types/accesslist"
-	"github.com/gravitational/teleport/api/types/compare"
-	"github.com/gravitational/teleport/api/types/header"
-)
-
-// CompareResources compares two resources by all significant fields.
-func CompareResources[T any](resA, resB T) int {
-	var equal bool
-	if hasEqual, ok := any(resA).(compare.IsEqual[T]); ok {
-		equal = hasEqual.IsEqual(resB)
-	} else {
-		equal = cmp.Equal(resA, resB,
-			ignoreProtoXXXFields(),
-			cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
-			cmpopts.IgnoreFields(types.DatabaseV3{}, "Status"),
-			cmpopts.IgnoreFields(types.UserSpecV2{}, "Status"),
-			cmpopts.IgnoreFields(accesslist.AccessList{}, "Status"),
-			cmpopts.IgnoreFields(header.Metadata{}, "Revision"),
-			cmpopts.IgnoreUnexported(headerv1.Metadata{}),
-
-			// Managed by IneligibleStatusReconciler, ignored by all others.
-			cmpopts.IgnoreFields(accesslist.AccessListMemberSpec{}, "IneligibleStatus"),
-			cmpopts.IgnoreFields(accesslist.Owner{}, "IneligibleStatus"),
-
-			cmpopts.EquateEmpty(),
-		)
-	}
-	if equal {
-		return Equal
-	}
-	return Different
-}
-
-// ignoreProtoXXXFields is a cmp.Option that ignores XXX_* fields from proto
-// messages.
-func ignoreProtoXXXFields() cmp.Option {
-	return cmp.FilterPath(func(path cmp.Path) bool {
-		if field, ok := path.Last().(cmp.StructField); ok {
-			return strings.HasPrefix(field.Name(), "XXX_")
-		}
-		return false
-	}, cmp.Ignore())
-}
diff --git a/lib/services/compare_test.go b/lib/services/compare_test.go
deleted file mode 100644
index 428a370d920..00000000000
--- a/lib/services/compare_test.go
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Teleport
- * Copyright (C) 2024  Gravitational, Inc.
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-package services
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/gravitational/teleport/api/types/accesslist"
-)
-
-func TestCompareResources(t *testing.T) {
-	compareTestCase(t, "cmp equal", compareResource{true}, compareResource{true}, Equal)
-	compareTestCase(t, "cmp not equal", compareResource{true}, compareResource{false}, Different)
-
-	// These results should be forced since we're going through a custom compare function.
-	compareTestCase(t, "IsEqual equal", &compareResourceWithEqual{true}, &compareResourceWithEqual{false}, Equal)
-	compareTestCase(t, "IsEqual not equal", &compareResourceWithEqual{false}, &compareResourceWithEqual{false}, Different)
-
-	// These results compare AccessListMemberSpec, which should ignore the IneligibleStatus field.
-	newAccessListMemberSpec := func(ineligibleStatus, accessList string) accesslist.AccessListMemberSpec {
-		return accesslist.AccessListMemberSpec{
-			AccessList:       accessList,
-			IneligibleStatus: ineligibleStatus,
-		}
-	}
-	compareTestCase(t, "cmp equal with equal IneligibleStatus", newAccessListMemberSpec("status1", "accessList1"), newAccessListMemberSpec("status1", "accessList1"), Equal)
-	compareTestCase(t, "cmp equal with different IneligibleStatus", newAccessListMemberSpec("status1", "accessList1"), newAccessListMemberSpec("status2", "accessList1"), Equal)
-	compareTestCase(t, "cmp not equal", newAccessListMemberSpec("status1", "accessList1"), newAccessListMemberSpec("status1", "accessList2"), Different)
-
-	// These results compare the IneligibleStatus field in accesslist.Owner, which should be ignored.
-	newAccessListOwner := func(ineligibleStatus, name string) accesslist.Owner {
-		return accesslist.Owner{
-			Name:             name,
-			IneligibleStatus: ineligibleStatus,
-		}
-	}
-	compareTestCase(t, "cmp equal with equal IneligibleStatus", newAccessListOwner("status1", "alice"), newAccessListOwner("status1", "alice"), Equal)
-	compareTestCase(t, "cmp equal with different IneligibleStatus", newAccessListOwner("status1", "alice"), newAccessListOwner("status2", "alice"), Equal)
-	compareTestCase(t, "cmp different when name differs", newAccessListOwner("status1", "alice"), newAccessListOwner("status1", "bob"), Different)
-}
-
-func compareTestCase[T any](t *testing.T, name string, resA, resB T, expected int) {
-	t.Run(name, func(t *testing.T) {
-		require.Equal(t, expected, CompareResources(resA, resB))
-	})
-}
-
-type compareResource struct {
-	Field bool
-}
-
-type compareResourceWithEqual struct {
-	ForceCompare bool
-}
-
-func (r *compareResourceWithEqual) IsEqual(_ *compareResourceWithEqual) bool {
-	return r.ForceCompare
-}
diff --git a/lib/services/reconciler.go b/lib/services/reconciler.go
index a7cae8d16f3..acd4d2059c0 100644
--- a/lib/services/reconciler.go
+++ b/lib/services/reconciler.go
@@ -97,7 +97,7 @@ func (c *GenericReconcilerConfig[K, T]) CheckAndSetDefaults() error {
 		return trace.BadParameter("missing reconciler OnDelete")
 	}
 	if c.CompareResources == nil {
-		c.CompareResources = CompareResources[T]
+		return trace.BadParameter("missing reconciler CompareResources")
 	}
 	if c.Logger == nil {
 		c.Logger = slog.With(teleport.ComponentKey, "reconciler")
diff --git a/lib/services/reconciler_test.go b/lib/services/reconciler_test.go
index aec02937619..2e58047f90e 100644
--- a/lib/services/reconciler_test.go
+++ b/lib/services/reconciler_test.go
@@ -23,6 +23,8 @@ import (
 	"maps"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 
@@ -251,7 +253,13 @@ func TestReconciler(t *testing.T) {
 						return t.Metadata.Name
 					})
 				},
-				CompareResources: test.comparator,
+				CompareResources: func(tr1, tr2 testResource) int {
+					if test.comparator != nil {
+						return test.comparator(tr1, tr2)
+					}
+
+					return EqualFromBool(cmp.Equal(tr1, tr2, cmpopts.IgnoreUnexported(headerv1.Metadata{})))
+				},
 				OnCreate: func(ctx context.Context, tr testResource) error {
 					onCreateCalls = append(onCreateCalls, tr)
 					return nil
@@ -320,6 +328,9 @@ func TestGenericReconciler(t *testing.T) {
 			}}
 			return MatchResourceLabels(selectors, tr.GetMetadata().Labels)
 		},
+		CompareResources: func(tr1, tr2 testResource) int {
+			return EqualFromBool(cmp.Equal(tr1, tr2, cmpopts.IgnoreUnexported(headerv1.Metadata{})))
+		},
 		GetCurrentResources: func() map[resourceID]testResource {
 			return registeredResources
 		},
diff --git a/lib/srv/app/watcher.go b/lib/srv/app/watcher.go
index 673d9570fd4..50e55e4cce0 100644
--- a/lib/srv/app/watcher.go
+++ b/lib/srv/app/watcher.go
@@ -38,11 +38,14 @@ func (s *Server) startReconciler(ctx context.Context) error {
 	reconciler, err := services.NewReconciler(services.ReconcilerConfig[types.Application]{
 		Matcher:             s.matcher,
 		GetCurrentResources: s.getResources,
-		GetNewResources:     s.monitoredApps.get,
-		OnCreate:            s.onCreate,
-		OnUpdate:            s.onUpdate,
-		OnDelete:            s.onDelete,
-		Logger:              s.log.With("kind", types.KindApp),
+		CompareResources: func(a1, a2 types.Application) int {
+			return services.EqualFromBool(a1.IsEqual(a2))
+		},
+		GetNewResources: s.monitoredApps.get,
+		OnCreate:        s.onCreate,
+		OnUpdate:        s.onUpdate,
+		OnDelete:        s.onDelete,
+		Logger:          s.log.With("kind", types.KindApp),
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/srv/db/watcher.go b/lib/srv/db/watcher.go
index 5aa56ae5db2..1798468c8ed 100644
--- a/lib/srv/db/watcher.go
+++ b/lib/srv/db/watcher.go
@@ -41,11 +41,14 @@ func (s *Server) startReconciler(ctx context.Context) error {
 	reconciler, err := services.NewReconciler(services.ReconcilerConfig[types.Database]{
 		Matcher:             s.matcher,
 		GetCurrentResources: s.getResources,
-		GetNewResources:     s.monitoredDatabases.getLocked,
-		OnCreate:            s.onCreate,
-		OnUpdate:            s.onUpdate,
-		OnDelete:            s.onDelete,
-		Logger:              s.log.With("kind", types.KindDatabase),
+		CompareResources: func(d1, d2 types.Database) int {
+			return services.EqualFromBool(d1.IsEqual(d2))
+		},
+		GetNewResources: s.monitoredDatabases.getLocked,
+		OnCreate:        s.onCreate,
+		OnUpdate:        s.onUpdate,
+		OnDelete:        s.onDelete,
+		Logger:          s.log.With("kind", types.KindDatabase),
 	})
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/srv/desktop/discovery.go b/lib/srv/desktop/discovery.go
index 1ac1ccb48c6..da47ac5cb74 100644
--- a/lib/srv/desktop/discovery.go
+++ b/lib/srv/desktop/discovery.go
@@ -124,6 +124,9 @@ func (s *WindowsService) startDesktopDiscovery() error {
 			_, ok := d.GetLabel(types.DiscoveryLabelWindowsOS)
 			return ok
 		},
+		CompareResources: func(wd1, wd2 types.WindowsDesktop) int {
+			return services.EqualFromBool(wd1.IsEqual(wd2))
+		},
 		GetCurrentResources: func() map[string]types.WindowsDesktop { return s.currentDesktops(s.closeCtx) },
 		GetNewResources:     s.getDesktopsFromLDAP,
 		OnCreate:            s.upsertDesktop,
@@ -445,6 +448,9 @@ func (s *WindowsService) startDynamicReconciler(ctx context.Context) error {
 			Matcher: func(desktop types.WindowsDesktop) bool {
 				return services.MatchResourceLabels(s.cfg.ResourceMatchers, desktop.GetAllLabels())
 			},
+			CompareResources: func(wd1, wd2 types.WindowsDesktop) int {
+				return services.EqualFromBool(wd1.IsEqual(wd2))
+			},
 			GetCurrentResources: func() map[string]types.WindowsDesktop { return currentResources },
 			GetNewResources:     func() map[string]types.WindowsDesktop { return newResources },
 			OnCreate:            s.upsertDesktop,
diff --git a/lib/srv/discovery/access_graph_aws.go b/lib/srv/discovery/access_graph_aws.go
index de8107a6f17..c2c0fcfd78b 100644
--- a/lib/srv/discovery/access_graph_aws.go
+++ b/lib/srv/discovery/access_graph_aws.go
@@ -803,9 +803,9 @@ func (s *Server) startCloudtrailPoller(ctx context.Context, reloadCh <-chan stru
 			}
 			return matchersMap
 		},
-		// Compare allows custom comparators without having to implement IsEqual.
-		// Defaults to `CompareResources[T]` if not specified.
-		CompareResources: services.CompareResources[*types.AccessGraphAWSSync],
+		CompareResources: func(aga1, aga2 *types.AccessGraphAWSSync) int {
+			return services.EqualFromBool(aga1.IsEqual(aga2))
+		},
 		OnCreate: func(_ context.Context, disc *types.AccessGraphAWSSync) error {
 			spawnMatcher(ctx, disc)
 			return nil
diff --git a/lib/srv/discovery/database_watcher.go b/lib/srv/discovery/database_watcher.go
index 5e476612108..34e9dbec2d9 100644
--- a/lib/srv/discovery/database_watcher.go
+++ b/lib/srv/discovery/database_watcher.go
@@ -51,6 +51,9 @@ func (s *Server) startDatabaseWatchers() error {
 		services.ReconcilerConfig[types.Database]{
 			Matcher:             func(database types.Database) bool { return true },
 			GetCurrentResources: s.getCurrentDatabases,
+			CompareResources: func(d1, d2 types.Database) int {
+				return services.EqualFromBool(d1.IsEqual(d2))
+			},
 			GetNewResources: func() map[string]types.Database {
 				mu.RLock()
 				defer mu.RUnlock()
diff --git a/lib/srv/discovery/discovery_test.go b/lib/srv/discovery/discovery_test.go
index fd25366980f..a76c2d8f36a 100644
--- a/lib/srv/discovery/discovery_test.go
+++ b/lib/srv/discovery/discovery_test.go
@@ -1453,7 +1453,7 @@ func TestDiscoveryKubeServices(t *testing.T) {
 				a1 := types.Apps(existingApps)
 				a2 := types.Apps(tt.expectedAppsToExistInAuth)
 				for k := range a1 {
-					require.Equal(t, services.Equal, services.CompareResources(a1[k], a2[k]))
+					require.True(t, a1[k].IsEqual(a2[k]))
 				}
 			})
 		})
@@ -1874,9 +1874,7 @@ func TestDiscoveryInCloudKube(t *testing.T) {
 				c1 := types.KubeClusters(tc.expectedClustersToExistInAuth).ToMap()
 				c2 := types.KubeClusters(kubeClusters).ToMap()
 				for k := range c1 {
-					if services.CompareResources(c1[k], c2[k]) != services.Equal {
-						require.Equal(t, c1[k], c2[k], "expected no differences")
-					}
+					require.True(t, c1[k].IsEqual(c2[k]), "expected no differences")
 				}
 			case <-time.After(10 * time.Second):
 				require.FailNow(t, "Didn't receive reconcile event after 10s")
diff --git a/lib/srv/discovery/kube_integration_watcher_test.go b/lib/srv/discovery/kube_integration_watcher_test.go
index ebbe303daeb..f89190a4a91 100644
--- a/lib/srv/discovery/kube_integration_watcher_test.go
+++ b/lib/srv/discovery/kube_integration_watcher_test.go
@@ -48,7 +48,6 @@ import (
 	"github.com/gravitational/teleport/lib/authz"
 	"github.com/gravitational/teleport/lib/cloud/mocks"
 	"github.com/gravitational/teleport/lib/integrations/awsoidc"
-	"github.com/gravitational/teleport/lib/services"
 	"github.com/gravitational/teleport/lib/srv/discovery/common"
 	"github.com/gravitational/teleport/lib/srv/discovery/fetchers"
 	"github.com/gravitational/teleport/lib/utils/log/logtest"
@@ -449,7 +448,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 				k1 := types.KubeServers(kubeServers).ToMap()
 				k2 := types.KubeServers(tc.expectedServersToExistInAuth).ToMap()
 				for k := range k1 {
-					require.Equal(t, services.Equal, services.CompareResources(k1[k], k2[k]), "kube server in auth server does not match expected")
+					require.True(t, k1[k].IsEqual(k2[k]), "kube server in auth server does not match expected")
 				}
 			})
 		})
diff --git a/lib/srv/discovery/kube_services_watcher.go b/lib/srv/discovery/kube_services_watcher.go
index ea5f5e64689..1e26836dc8c 100644
--- a/lib/srv/discovery/kube_services_watcher.go
+++ b/lib/srv/discovery/kube_services_watcher.go
@@ -55,6 +55,9 @@ func (s *Server) startKubeAppsWatchers() error {
 
 				return utils.FromSlice(filterResources(apps, types.OriginDiscoveryKubernetes, s.DiscoveryGroup), types.Application.GetName)
 			},
+			CompareResources: func(a1, a2 types.Application) int {
+				return services.EqualFromBool(a1.IsEqual(a2))
+			},
 			GetNewResources: func() map[string]types.Application {
 				mu.Lock()
 				defer mu.Unlock()
diff --git a/lib/srv/discovery/kube_watcher.go b/lib/srv/discovery/kube_watcher.go
index 362e6c6d685..a45273c9615 100644
--- a/lib/srv/discovery/kube_watcher.go
+++ b/lib/srv/discovery/kube_watcher.go
@@ -62,8 +62,8 @@ func (s *Server) startKubeWatchers() error {
 				return utils.FromSlice(kubeResources, types.KubeCluster.GetName)
 			},
 			CompareResources: func(kc1, kc2 types.KubeCluster) int {
-				if res := services.CompareResources(kc1, kc2); res != services.Equal {
-					return res
+				if !kc1.IsEqual(kc2) {
+					return services.Different
 				}
 				// Additionally compare Status field using its IsEqual method.
 				// This is needed because CompareResources ignores Status field of KubeCluster and for most