Terraform AWS provider "OptInRequired" (not subscribed) in CI

AWS returned OptInRequired: the account is not subscribed to the service, or the target Region is not enabled for the account. The credentials work, but the account is not entitled to use this service or Region.

What this error means

terraform apply fails with "OptInRequired: The AWS Access Key Id needs a subscription for the service" or a Region-not-enabled variant.

Terraform

Error: creating Marketplace resource: operation error: https response
error StatusCode: 401, api error OptInRequired: The AWS Access Key Id
needs a subscription for the service.

Common causes

The service is not subscribed in the account

Some services (Marketplace offerings, certain managed products) require an explicit subscription before any API call succeeds.

The target Region is opt-in and not enabled

Opt-in Regions must be enabled per account; targeting one before enabling it returns OptInRequired.

How to fix it

Enable the opt-in Region for the account

Check the Region the provider targets against the account's enabled Regions.
Enable the opt-in Region in Account settings.
Re-run apply once the Region shows as enabled.

Terminal

aws account list-regions \
  --region-opt-status-contains ENABLED ENABLING

Subscribe to the service first

For a service that needs a subscription, complete the subscription in the console before Terraform calls its API.

How to prevent it

Enable opt-in Regions before pointing Terraform at them.
Subscribe to services that require it ahead of the first apply.
Keep the provider Region within the account's enabled set.