🚨 AWS Error: 'OptInRequired: You are not subscribed to this service' — Cause, Fix, and Troubleshooting Guide

Overview

OptInRequired means AWS knows who you are and what you’re asking for, but your account hasn’t been enabled for the thing you’re using — a disabled opt-in region, a Marketplace AMI you haven’t subscribed to, or an account that isn’t fully activated. Unlike a permissions error, no IAM change fixes it; you must complete an opt-in or subscription step.

You will see it surface from the CLI or an SDK:

An error occurred (OptInRequired) when calling the RunInstances operation: You are not subscribed to this service. Please see http://aws.amazon.com/marketplace

It occurs most often when launching a Marketplace AMI you haven’t accepted terms for, when operating in an opt-in region that is disabled for the account, or when the account itself isn’t finished activating.

Symptoms

• RunInstances, CreateFleet, or a launch-template deploy fails with OptInRequired.
• The same AMI/action works in one account but fails in another (new or restricted) account.
• API calls to an opt-in region (e.g. certain regions that are disabled by default) fail even with valid credentials.
• Terraform/ASG launches fail immediately for a Marketplace-based AMI.

aws ec2 run-instances --image-id ami-0marketplaceREDACTED --instance-type t3.medium \
  --count 1

An error occurred (OptInRequired) when calling the RunInstances operation: You are not subscribed to this service. Please see http://aws.amazon.com/marketplace

Common Root Causes

1. Unsubscribed Marketplace AMI

The AMI comes from AWS Marketplace and the account hasn’t accepted the product’s subscription/terms.

2. A disabled opt-in region

The target region is an opt-in region that hasn’t been enabled for the account.

3. Account not fully activated

A new account (or one pending verification/payment) isn’t yet enabled to launch resources.

4. A shared AMI referencing a Marketplace product code

A copied/shared AMI still carries a Marketplace product code, so each launching account must subscribe.

How to diagnose

Step 1: Check whether the AMI has a Marketplace product code

aws ec2 describe-images --image-ids ami-0marketplaceREDACTED \
  --query 'Images[].[Name,ProductCodes]' --output json

A non-empty ProductCodes with marketplace type means you must subscribe to that product.

Step 2: Check region opt-in status

aws account list-regions \
  --query "Regions[?RegionOptStatus=='DISABLED'].RegionName" --output table

If your target region is listed as DISABLED, that’s the block.

Step 3: Confirm the account is active

aws sts get-caller-identity --query Account --output text

A brand-new account failing every launch (not just one AMI) points at activation, not subscription.

Fixes

Subscribe to the Marketplace product

Open the product’s page in AWS Marketplace and click Subscribe / Accept terms (this is a console/Marketplace action; there’s no direct CLI “subscribe” for the AMI terms). After subscribing, retry the launch.

Enable the opt-in region

aws account enable-region --region-name ap-southeast-3
# then wait for it to become ENABLED
aws account get-region-opt-status --region-name ap-southeast-3 \
  --query RegionOptStatus --output text

Finish account activation

For a new account, complete payment-method and identity verification in the console; launches succeed once activation finishes (usually minutes, occasionally longer).

Use a non-Marketplace AMI

If you don’t need the Marketplace product, switch to an AWS-owned or self-built AMI with no product code.

What to watch out for

• OptInRequired is not an IAM problem — no policy change resolves it; complete the opt-in/subscription instead.
• Marketplace subscriptions are per-account: sharing or copying an AMI doesn’t share the subscription, so each account must accept terms.
• Enabling an opt-in region can take a few minutes to propagate; poll get-region-opt-status before retrying.
• Automated ASG/launch-template deploys fail silently on OptInRequired for Marketplace AMIs — subscribe before wiring them into autoscaling.

Related

• AWS Error: ‘UnauthorizedOperation’ on EC2 — the permissions-based cousin on the same launch calls.
• AWS Error: ‘InsufficientInstanceCapacity’ — a capacity (not subscription) reason a launch fails.
• AWS Error: ‘InvalidClientTokenId: The security token … is invalid’ — a credential/account-context failure on API calls.