SubscriptionRequiredException on Textract DetectDocumentText despite valid IAM policy, payment method, and multiple regions tested

Hello.

Is your AWS account a recently created free account?
If it's a free account, try switching to a paid account.
It seems that free accounts may have problems accessing some service features.
https://repost.aws/questions/QUScuupiDZTGeZbF89dT7yMg/unable-to-access-lightsail-free-tier-despite-account-activation-403-error#ANFfcvl696T9G6Ggec6LWXJA

Even if you switch from a free account to a paid account, you can still use the credits provided by AWS as long as they are within their expiration date.
https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/free-tier-plans.html

Please also check the contents of the following document.
https://repost.aws/knowledge-center/error-access-service

Hi,

First, a housekeeping note: please edit your post to remove the AWS account ID. It isn't a credential, but it's an identifier that's better not published, and it isn't needed for anyone here to help you.

Now the substance. Your troubleshooting has been methodical, but it has been aimed at the wrong layer, and there's one specific thing you were told that is incorrect and is currently blocking you.

Direct answer to your question: no, Textract has no separate activation step

There is no account-level opt-in, subscription, or activation for Amazon Textract that sits alongside IAM. There is no "activate Textract" button in the console, and you are not missing a step. So you can stop looking for one.

The error-access-service knowledge center article that mentions subscribing to each service individually as it is released describes a legacy account model. It does not apply to Textract, and following it will send you looking for a toggle that does not exist.

Why your IAM work could never have fixed this

SubscriptionRequiredException is not an authorization error. It is raised at the account-subscription layer, and it is evaluated independently of your IAM policy. Concretely: if you attached AdministratorAccess to that IAM user right now, you would get the identical error.

This matters because it re-frames everything you've ruled out. Your observation that "authentication succeeds and the request reaches Textract and gets rejected there" is exactly right, and it's the most useful thing in your post. It tells you the problem is between your account and the service, not between your principal and the action. The minimal inline policy is fine and is not a factor.

Two related exclusions worth stating, so you don't spend time on them:

• SCPs are not the cause. If an AWS Organizations service control policy were blocking textract:DetectDocumentText, you would get AccessDeniedException with an explicit-deny message naming the SCP, not SubscriptionRequiredException. Different error, different layer.
• Region opt-in is not the cause, and your two-region test was valid. I confirmed Textract is a supported service in both of the Regions you tried: both eu-south-2 and eu-west-1 appear in the Textract endpoint list, and both textract.eu-south-2.amazonaws.com and textract.eu-west-1.amazonaws.com respond as live Textract endpoints. Also note that a Region that wasn't enabled would surface as UnrecognizedClientException or an endpoint resolution failure, not this error.

So: credentials fine, policy fine, Region fine. What's left is the state of the account itself.

The correction that actually unblocks you

You were told that this needs a technical answer that Basic support doesn't cover. That routing is wrong. SubscriptionRequiredException is an account-state question, and account and billing support cases are available on every support plan, including Basic, at no cost. This is documented:

• AWS Support Plans: Basic Support offers assistance for account and billing questions and service quota increases.
• Getting help with your bills and payments: all AWS account owners have access to account and billing support free of charge; only personalized technical support requires a paid plan.

So go back to Support Center and open a new case with type "Account and billing" rather than technical. That case type will be accepted on Basic. In the case, be explicit that you are reporting a suspected account subscription state issue rather than asking for help writing code, and include:

• the exact exception name and message,
• one full API error response including the request ID, the timestamp in UTC, and the Region,
• the fact that it reproduces in two Regions with a policy scoped to only textract:DetectDocumentText.

To capture a request ID, run the call with debug output:

aws textract detect-document-text \
  --document '{"S3Object":{"Bucket":"your-bucket","Name":"your-file.png"}}' \
  --region eu-west-1 --debug 2>&1 | grep -i -E "x-amzn-requestid|RequestId"

This matters because nobody on re:Post, including AWS employees answering here, can inspect or change your account's subscription state. Support is the only path, and it's available to you for free. That single misrouting is probably the main reason you're still stuck.

What to check yourself in the meantime

1. Determine which account plan you're on. This is my leading hypothesis, and I want to be clear that it is a hypothesis rather than something documented for Textract specifically. AWS now offers a Free account plan, described as being for customers experimenting and building proofs of concept at no cost for a limited period, until you upgrade to a paid account plan. Open the Billing and Cost Management console home and look for free account plan information: credit balance, days remaining, expiration. If the account shows a free account plan and offers an upgrade to a paid plan, that's the highest-probability lead.

What makes me suspect it: the same SubscriptionRequiredException with the same "needs a subscription for the service" message has been reported on re:Post recently against Amazon Transcribe, Amazon Redshift, AWS Elemental MediaConvert and Amazon Lightsail, and the common factor in those reports is a new or free account rather than any one service. What I have not found is documentation confirming that the free account plan blocks Textract, so treat this as the lead to test, not the established answer. If you do upgrade, note that per the docs any Free Tier credits remain usable until their expiration date.

2. Distinguish "payment method valid" from "account activation complete". These are separate states. The Billing console can show a verified, current card while account activation is still incomplete on the AWS side. Check the Account page for any pending verification prompt.

3. Run this test, because it will tell you the answer in one command. Call a completely different service that this account has never used, from the same credentials, in the same Region. For example:

aws comprehend detect-dominant-language --text "hello world" --region eu-west-1

• If this also returns SubscriptionRequiredException, the problem is definitively account-wide and has nothing to do with Textract. That is a strong, concrete finding to put in your Support case, and it removes any remaining ambiguity.
• If it succeeds, the problem is scoped to Textract on this account, which is a different and more unusual situation, and worth stating explicitly in the case.

Either outcome is valuable, which is why I'd run it before or alongside opening the case. Add --profile for the dedicated IAM user if you have multiple profiles configured, and give that user a temporary comprehend:DetectDominantLanguage permission for the test, since otherwise you'd get AccessDeniedException and learn nothing.

Just ran into this thread and wanted to share something that might unblock you faster.

The SubscriptionRequiredException is not an IAM or credentials problem at all. It fires at the account-subscription layer, after authentication succeeds, so swapping policies or testing regions won't change anything. AWS has a Knowledge Center article specifically for this: https://repost.aws/knowledge-center/textract-subscription-required-exception

The fix is a support case filed under "Account & Billing" (not a technical support category). That case type is free on the Basic support plan, regardless of what you may have been told. Here's the generic version of the same error if you want more context: https://repost.aws/knowledge-center/subscription-required-exception

Quick question before you file: have you already tried opening a case specifically under Account & Billing, or were you steered toward a technical support category? That one detail changes whether this is a 5-minute fix or needs escalation.

I'll pull together a drafted case submission with the exact context AWS Support needs if that would help. Just reply here or DM me.