Enable or disable Amazon Web Services Regions in your account - Amazon Account Management
Considerations before enabling and disabling RegionsEnable or disable a Region for standalone accountsEnable or disable a Region in your organization
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Enable or disable Amazon Web Services Regions in your account

An Amazon Web Services Region is a physical location in the world where we have multiple Availability Zones. Availability Zones consist of one or more discrete Amazon data centers, each with redundant power, networking, and connectivity, housed in separate facilities. This means that each Amazon Web Services Region is physically isolated and independent of the other Regions. Regions provide fault tolerance, stability, and resilience, and can also reduce latency. For a map of available and upcoming Regions, see Regions and Availability Zones.

The resources that you create in one Region do not exist in any other Region unless you explicitly use a replication feature offered by an Amazon service. For example, Amazon S3 and Amazon EC2 support cross-Region replication. Some services, such as Amazon Identity and Access Management (IAM), do not have Regional resources.

Your account determines the Regions that are available to you.

  • An Amazon Web Services account provides multiple Regions so that you can launch Amazon resources in locations that meet your requirements. For example, you might want to launch Amazon EC2 instances in Europe to be closer to your European customers or to meet legal requirements.

  • An Amazon GovCloud (US-West) account provides access to the Amazon GovCloud (US-West) Region and the Amazon GovCloud (US-East) Region. For more information, see Amazon GovCloud (US).

  • An Amazon Amazon (China) account provides access to the Beijing and Ningxia Regions only. For more information, see Amazon Web Services in China.

Important

Amazon recommends that you use regional Amazon Security Token Service (Amazon STS) endpoints instead of the global endpoint to reduce latency. Session tokens from regional Amazon STS endpoints are valid in all Amazon Regions. If you use regional Amazon STS endpoints, you don't need to make any changes. However, session tokens from the global Amazon STS endpoint (https://sts.amazonaws.com.cn) are valid only in Amazon Web Services Regions that you enable, or that are enabled by default. If you intend to enable a new Region for your account, you can either use session tokens from regional Amazon STS endpoints or activate the global Amazon STS endpoint to issue session tokens that are valid in all Amazon Web Services Regions. Session tokens that are valid in all Regions are larger. If you store session tokens, these larger tokens might affect your systems. For more information about how Amazon STS endpoints work with Amazon Regions, see Managing Amazon STS in an Amazon Region.

Show moreShow less

Considerations before enabling and disabling Regions

Before you enable or disable a Region, it's important to consider the following:

  • Regions introduced before March 20, 2019 are enabled by default – Amazon originally enabled all new Amazon Web Services Regions by default, which means you can begin creating and managing resources in these Regions immediately. You cannot enable or disable a Region that is enabled by default. Today, when Amazon adds a Region, the new Region is disabled by default. If you want your users to be able to create and manage resources in a new Region, you first need to enable that Region. The following Regions are enabled by default.

    Name Code
    US East (N. Virginia) us-east-1
    US East (Ohio) us-east-2
    US West (N. California) us-west-1
    US West (Oregon) us-west-2
    Asia Pacific (Tokyo) ap-northeast-1
    Asia Pacific (Seoul) ap-northeast-2
    Asia Pacific (Osaka) ap-northeast-3
    Asia Pacific (Mumbai) ap-south-1
    Asia Pacific (Singapore) ap-southeast-1
    Asia Pacific (Sydney) ap-southeast-2
    Canada (Central) ca-central-1
    Europe (Frankfurt) eu-central-1
    Europe (Stockholm) eu-north-1
    Europe (Ireland) eu-west-1
    Europe (London) eu-west-2
    Europe (Paris) eu-west-3
    South America (São Paulo) sa-east-1

  • You can use IAM permissions to control access to Regions – Amazon Identity and Access Management (IAM) includes four permissions that let you control which users can enable, disable, get, and list Regions. For more information, see Amazon: Allows enabling and disabling Amazon Web Services Regions in the IAM User Guide. You can also use the aws:RequestedRegion condition key to control access to Amazon Web Services services in an Amazon Web Services Region.

  • Enabling a Region is free – There is no charge to enable a Region. You're charged only for resources that you create in the new Region.

  • Disabling a Region disables IAM access to resources in the Region – If you disable a Region that still contains Amazon resources, such as Amazon Elastic Compute Cloud (Amazon EC2) instances, you lose IAM access to the resources in that Region. For example, you can't use the Amazon Web Services Management Console to view or change the configuration of any EC2 instances in a disabled Region.

  • Charges for active resources continue if you disable a Region – If you disable a Region that still contains Amazon resources, charges for those resources (if any) continue to accrue at the standard rate. For example, if you disable a Region that contains Amazon EC2 instances, you still have to pay the charges for those instances even though the instances are inaccessible.

  • Disabling a Region isn't always immediately visible – Services and consoles might be temporarily visible after disabling a region. Disabling a Region can takes a few minutes to several hours to take effect.

  • Enabling a Region takes a few minutes to several hours in some cases – When you enable a Region, Amazon performs actions to prepare your account in that Region, such as distributing your IAM resources to the Region. This process takes a few minutes for most accounts, but can sometimes take several hours. You cannot use the Region until this process is complete.

  • Organizations can have 50 region-opt requests open at a given time across an Amazon organization – The management account can at any point in time have 50 open requests pending completion for its organization. One request is equal to either an enable or disable of one particular region for one account.

  • A single account can have 6 region-opt requests in progress at any given time – One request is equal to either an enable or disable of one particular region for one account.

  • Amazon EventBridge integration – Customers can subscribe to region-opt status update notifications in EventBridge. An EventBridge notification will be created for each status change, allowing customers to automate work flows.

  • Expressive Region-opt status – Due to the asynchronous nature of enabling/disabling an opt-in region, there are four potential statuses for a region-opt request:

    • ENABLING

    • DISABLING

    • ENABLED

    • DISABLED

    You cannot cancel an opt-in or opt-out when it is in either ENABLING or DISABLING status. Otherwise, a ConflictException will be thrown. A completed (Enabled/Disabled) region-opt request is dependent on the provisioning of key underlying Amazon services. There might be some Amazon services that will not be immediately usable despite the status being ENABLED.

  • Full integration with Amazon Organizations – A management account can modify or read region-opt for any member account of that Amazon organization. A member account is able to read/write their region state as well.

Show moreShow less

Enable or disable a Region for standalone accounts

To update which Regions your Amazon Web Services account has access to, perform the steps in the following procedure. The Amazon Web Services Management Console procedure below always works only in the standalone context. You can use the Amazon Web Services Management Console to view or update only the available Regions in the account you used to call the operation.

Amazon Web Services Management Console
To enable or disable a Region for a standalone Amazon Web Services account
Minimum permissions

To perform the steps in the following procedure, an IAM user or role must have the following permissions:

  • account:ListRegions (needed to view the list of Amazon Web Services Regions and whether they are currently enabled or disabled).

  • account:EnableRegion

  • account:DisableRegion

  1. Sign in to the Amazon Web Services Management Console as either the Amazon Web Services account root user or as an IAM user or role that has the minimum permissions.

  2. Choose your account name on the top right of the window, and then choose Account.

  3. On the Account page, scroll down to the section Amazon Web Services Regions.

    Note

    You might be prompted to approve your access to this information. Amazon sends a request to the email address associated with the account and to the primary contact phone number. Choose the link in the request to open it in your browser, and approve the access.

  4. Next to each Amazon Web Services Region with an option in the Action column, choose either Enable or Disable, depending on whether you want the users in your account to be able to create and access resources in that Region.

  5. If prompted, confirm your choice.

  6. After you have made all of your changes, choose Update.

Amazon CLI & SDKs

You can enable, disable, read and list region opt status by using the following Amazon CLI commands or their Amazon SDK equivalent operations:

  • EnableRegion

  • DisableRegion

  • GetRegionOptStatus

  • ListRegions

Minimum permissions

To perform the following steps, you must have the permission that maps to that operation:

  • account:EnableRegion

  • account:DisableRegion

  • account:GetRegionOptStatus

  • account:ListRegions

If you use these individual permissions, you can grant some users the ability to only read region opt information, and grant others the ability to both read and write.

The following example enables a region for the specified member account in an organization. The credentials used must be from either the organization’s management account, or from the Account Management’s delegated admin account.

Note that you can also disable a region using the same command and then replacing enable-region with disable-region.

aws account enable-region --region-name af-south-1

This command produces no output if it's successful.

The operation is asynchronous. The following command will allow you to see the latest status of the request.

aws account get-region-opt-status --region-name af-south-1
  {
    "RegionName": "af-south-1",
    "RegionOptStatus": "ENABLING"
  }

Enable or disable a Region in your organization

To update the enabled Regions for member accounts of your Amazon Organizations, perform the steps in the following procedure.

Note

The Amazon Organizations managed policies AWSOrganizationsReadOnlyAccess or AWSOrganizationsFullAccess are updated to provide permission to access the Amazon Account Management APIs so you can access account data from the Amazon Organizations console. To view the updated managed policies, see Updates to Organizations Amazon managed policies.

Note

Before you can perform these operations from the management account or a delegated admin account in an organization for use with member accounts, you must:

  • Enable all features in your organization to manage settings on your member accounts. This allows admin control over the member accounts. This is set by default when you create your organization. If your organization is set to consolidated billing only, and you want to enable all features, see Enabling all features in your organization.

  • Enable trusted access for the Amazon Account Management service. To set this up, see Enable trusted access for Amazon Account Management.

Show moreShow less
Amazon Web Services Management Console
To enable or disable a Region in your organization

  1. Sign in to the Amazon Organizations console with your organization's management account credentials.

  2. On the Amazon Web Services accounts page, select the account that you want to update.

  3. Choose the Account settings tab.

  4. Under Regions, select the Region you want to enable or disable.

  5. Choose Actions, and then choose either Enable or Disable option.

  6. If you chose the Enable option, review the displayed text and then choose Enable region.

  7. If you chose the Disable option, review the displayed text, type disable to confirm, and then choose Disable region.

Amazon CLI & SDKs

You can enable, disable, read and list region opt status for organization member accounts by using the following Amazon CLI commands or their Amazon SDK equivalent operations:

  • EnableRegion

  • DisableRegion

  • GetRegionOptStatus

  • ListRegions

Minimum permissions

To perform the following steps, you must have the permission that maps to that operation:

  • account:EnableRegion

  • account:DisableRegion

  • account:GetRegionOptStatus

  • account:ListRegions

If you use these individual permissions, you can grant some users the ability to only read region opt information, and grant others the ability to both read and write.

The following example enables a region for the specified member account in an organization. The credentials used must be from either the organization’s management account, or from the Account Management’s delegated admin account.

Note that you can also disable a region using the same command and then replacing enable-region with disable-region.

aws account enable-region --account-id 123456789012 --region-name af-south-1

This command produces no output if it's successful.

Note

An organization can only have up to 20 region requests at a given time. Otherwise, you will receive a TooManyRequestsException.

The operation is asynchronous. The following command will allow you to see the latest status of the request.

aws account get-region-opt-status --account-id 123456789012 --region-name af-south-1
  {
    "RegionName": "af-south-1",
    "RegionOptStatus": "ENABLING"
  }