How to Enable AWS Opt-in Regions in Your Account

Default Regions and opt-in Regions

There are two kinds of Regions. Default Regions, launched before March 20, 2019 (for example us-east-1, ap-northeast-1 and eu-west-1), work as soon as the account is active and can't be enabled or disabled. Opt-in Regions, launched after that date, start disabled: they don't appear in the console's Region selector and you can't create resources in them.

Current opt-in Regions are af-south-1 (Cape Town), ap-east-1 (Hong Kong), ap-east-2 (Taipei), ap-south-2 (Hyderabad), ap-southeast-3 (Jakarta), ap-southeast-4 (Melbourne), ap-southeast-5 (Malaysia), ap-southeast-6 (New Zealand), ap-southeast-7 (Thailand), ca-west-1 (Calgary), eu-central-2 (Zurich), eu-south-1 (Milan), eu-south-2 (Spain), il-central-1 (Tel Aviv), me-central-1 (UAE), me-south-1 (Bahrain) and mx-central-1 (Mexico Central).

Enabling or disabling a Region is free; you pay only for resources you create there. Enabling copies your IAM data and credentials to the Region, after which your existing IAM identities work there too.

Enable a Region in the console

1. Sign in to the AWS Management Console as the root user or as an IAM user or role with the permissions listed below.
2. Choose your account name at the top right, then choose Account.
3. On the Account page, scroll down to the AWS Regions section.
4. Select the Region you want and choose Enable.
5. Review the prompt and choose Enable region. Once activation completes, the Region appears in the navigation bar's Region selector.

These steps are for standalone accounts that signed up with Sign up for AWS (advanced) or have activated advanced features. For organization member accounts, the management account can select the account under AWS accounts in the AWS Organizations console and enable Regions from the Account settings tab.

Enable and check status with the Account API or CLI

AWS Account Management provides EnableRegion, DisableRegion, GetRegionOptStatus and ListRegions. Enabling is asynchronous and the command prints nothing on success, so check progress with a status call:

aws account enable-region --region-name ap-east-1

aws account get-region-opt-status --region-name ap-east-1

aws account list-regions --region-opt-status-contains ENABLING ENABLED

There are five statuses: ENABLED_BY_DEFAULT (default Regions), DISABLED, ENABLING, ENABLED and DISABLING. Omit AccountId for a standalone account. The organization's management account or a delegated administrator can pass --account-id for a member account, but the management account can't specify its own ID.

How long it takes and what limits apply

• Most accounts finish in a few minutes, but it can take several hours, and the Region isn't usable until it's done.
• Some services may not be usable immediately even after the status reads ENABLED.
• A request in ENABLING or DISABLING can't be cancelled. Enabling a Region that is DISABLING returns ConflictException, and you can't disable a Region until enabling has finished.
• One account can have at most six enable or disable requests in progress at a time.
• You can subscribe to Region opt status changes in Amazon EventBridge to automate follow-up work.

Required IAM permissions

The permissions are account:ListRegions (view the list), account:GetRegionOptStatus (read status), account:EnableRegion and account:DisableRegion. The account:TargetRegion condition key restricts which Regions a principal can change, for example only Hong Kong:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EnableDisableHongKong",
            "Effect": "Allow",
            "Action": ["account:EnableRegion", "account:DisableRegion"],
            "Resource": "*",
            "Condition": { "StringEquals": { "account:TargetRegion": "ap-east-1" } }
        },
        {
            "Sid": "ViewConsole",
            "Effect": "Allow",
            "Action": ["account:ListRegions"],
            "Resource": "*"
        }
    ]
}

Before you disable a Region

Disabling a Region removes IAM access to its resources but doesn't delete them, and they keep incurring charges at standard rates, so clean up first. In the console, choose Disable and type disable to confirm. It can take minutes to hours to take effect, and services may briefly remain visible in the console.

Enabling Regions in CloudPilot

CloudPilot's Regions page uses ListRegions to show the status of every Region for the selected credentials and can submit EnableRegion for Regions that are DISABLED. Submitted Regions show as enabling; status isn't cached, so refresh until it reads ENABLED before deploying. The credentials need the account permissions listed above.

FAQ