Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

OptInRequired error when running StackSet manually on new account (previously worked automatically)

0

Hi everyone,

I’m facing an issue when creating a new account via AWS Organizations and deploying a CloudFormation StackSet to configure cross-account access.

Context: I have a payer account (from a customer) under our management. Inside this payer, I created a new member account via AWS Organizations, using the customer’s email address. The StackSet I’m using is the same one I successfully used about 2 weeks ago for another account from the same customer, following the exact same steps. In that previous case, the StackSet ran automatically right after account creation, as expected.

Problem: In this new account (created now), the StackSet did not run automatically. When I try to run the stack manually (via StackSet), I get the following error: "The AWS Access Key Id needs a subscription for the service (Service: AmazonCloudFormation; Status Code: 403; Error Code: OptInRequired; Proxy: null)"

I cannot edit the trusted entity of the role because the cross-account stack has not completed. I do not have root access to the customer’s email to log in and check/activate anything in the account console.

What I’ve tried so far:

  • Checked StackSet permissions and IAM roles in the payer account — all correct.
  • Waited several hours in case it was a propagation delay — no success.
  • Tried canceling the operation (stuck in “Stopping”).
  • Reviewed the official AWS article: https://repost.aws/knowledge-center/error-access-service, but I’m still unclear why this now requires manual activation, while a few days ago the exact same operation worked without it.

Questions: 1 Has AWS recently changed the behavior so that services like CloudFormation must be manually activated on newly created accounts? 2 Is root access required to open CloudFormation in the new account before it can be used via StackSet? 3 Given that the account email used during creation belongs to the customer (and I do not have root access), is the only workaround to temporarily change the account’s email to activate CloudFormation and run the StackSet, and then switch it back, or to ask the customer to log in as root and do it manually? Should we open an AWS case?

Topics
Management & GovernanceSecurity, Identity, & Compliance
Tags
AWS Identity and Access ManagementAWS OrganizationsAWS Account ManagementSecurity, Identity, & Compliance
Language
English

asked a year ago344 views

1 Answer
0

The error you're encountering is related to AWS Regions that are disabled by default. AWS Regions introduced after March 20, 2019 (such as Asia Pacific Hong Kong) require explicit activation before they can be used.

For CloudFormation StackSets to work properly:

  1. The target account must have the Region enabled
  2. The StackSet's administrator account (or organization's management account if using service-managed permissions) must also have the same Region enabled

This explains why you're getting the "OptInRequired" error. Even though the process worked previously, it's likely that the current deployment is targeting a Region that hasn't been enabled in the new account.

To address your specific questions:

  1. AWS hasn't changed the behavior regarding CloudFormation activation. However, if your StackSet is deploying to a Region that's disabled by default, this would require activation.

  2. Yes, root access (or an account with sufficient permissions) is required to enable disabled Regions in the new account.

  3. Given your situation, your options are:

  • Ask the customer to log in as root to enable the required Region
  • If you have delegated administrator privileges, you may be able to enable the Region through Organizations
  • Opening an AWS support case could help, especially if you believe there's an inconsistency in behavior

It's worth noting that if you're using service-managed permissions with StackSets, the service doesn't deploy stack instances to the organization's management account, even if that account is in your organization or in an OU in your organization. If you need to deploy to the management account, you would need to either use SELF_MANAGED permissions mode or deploy directly to the management account as a regular CloudFormation stack.
Sources
Management account as a StackSet target | AWS re:Post
Prepare to perform StackSet operations in AWS Regions that are disabled by default - AWS CloudFormation

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content