Fix: OptInRequired: You are not subscribed to this service

An AWS call failed with OptInRequired: You are not subscribed to this service, even though the credentials are valid and the principal has permission. This error is not about IAM at all. It means the account has not opted in to something the call requires: most often a region that is disabled by default, but sometimes a Marketplace or service subscription that has not been accepted, or an account that is not fully activated. The fix is to identify which of those three is missing and enable it, then retry.

OptInRequired: You are not subscribed to this service.

What this error means

Some things in AWS require an explicit opt-in before you can use them. Regions launched after March 2019 are disabled by default and must be enabled per account before their endpoints will accept calls. Certain products, including many AWS Marketplace AMIs and some services, require you to accept a subscription first. And a newly created account is not fully usable until its activation and billing are confirmed. In all of these cases, a call that touches the un-opted-in resource returns OptInRequired, regardless of how much IAM permission the caller has. So the fix is administrative: turn on the region, accept the subscription, or complete account activation, depending on which one the call needs.

Common causes

• The target region is an opt-in region that has not been enabled for the account.
• The call launches or uses a Marketplace product (often an AMI) the account has not subscribed to.
• A service that requires enrollment or subscription is being used before it was enabled.
• The account is newly created and not yet fully activated, or billing has not been confirmed.
• A pipeline or template targets a region that is enabled in one account but not in the account it actually ran in.

How to fix it

STABILIZE

1. Confirm the region in the failing request and check its opt-in status for this account. Opt-in regions report an explicit status:

aws account get-region-opt-status --region-name ap-east-1

A status of DISABLED means the region is the cause. ENABLED means look at a subscription or activation instead.

DIAGNOSE

1. List every region and its opt-in status so you can see which are enabled for the account:

aws account list-regions \
  --query 'Regions[].[RegionName,RegionOptStatus]' \
  --output table

2. If the region is enabled, check whether the call uses a Marketplace product. A launch from a Marketplace AMI that has not been subscribed to is the usual non-region cause; the error appears at RunInstances time. Confirm the AMI’s product and whether it requires a subscription.
3. If neither region nor Marketplace applies, verify the account is fully activated and billing is confirmed. A brand-new account that cannot make calls in any region is usually pending activation.

FIX

1. If the cause is a disabled region, enable it. This is an account-level action and takes a few minutes to complete:

aws account enable-region --region-name ap-east-1

2. Wait until the status reports enabled before retrying the workload:

aws account get-region-opt-status --region-name ap-east-1 \
  --query RegionOptStatus --output text

Retry only once this returns ENABLED rather than ENABLING.

3. If the cause is a Marketplace product, accept the subscription for that product in AWS Marketplace (through the console’s Marketplace subscriptions page or the product’s subscribe action), then retry the launch. There is no single generic CLI subscribe call; it is done per product.
4. If the cause is account activation or billing, complete activation in the account’s billing and account settings and confirm a valid payment method, then retry.

How to prevent it

• Enable the opt-in regions your organization uses as part of account provisioning, so new accounts are ready before workloads target them.
• Track which regions each account has enabled and fail fast in deploys that target a disabled one.
• Subscribe to required Marketplace products ahead of time in every account that will launch them.
• Confirm account activation and billing immediately after creating an account, before wiring it into pipelines.
• In multi-account setups, standardize the enabled region list so a template that works in one account does not break in another.

When to call a senior engineer

Call for help when opt-in region status is inconsistent across a multi-account organization and deploys break unpredictably, when Marketplace subscriptions must be managed at scale across accounts, or when a region enable appears stuck and you cannot tell whether activation or billing is the real blocker. Erzon engineers can standardize region opt-in and subscriptions across your accounts, make deploys detect a disabled region before they fail, and clear whatever activation issue is holding the account back.