EnableRegion

AWS

EnableRegion

service: AWS - Account Management

tactics:

Stealth

techniques:

T1535

tags:

AWS Account Management

Event

Enables a previously disabled AWS region for the account, making its services available for use.

Security Context

• Detective controls (GuardDuty, CloudWatch, Config, CloudTrail event rules) are typically deployed per-region, so enabling an opt-in region the organization does not monitor gives an adversary a blind spot to operate resources in without tripping regional alarms.

Log Source

CloudTrail

Sample Event

Adversarial. Draco enables ap-east-1 (Hong Kong) — an opt-in region the org has never used and has no detective controls in. Once enabled, he can spin up EC2 / Lambda infrastructure there knowing the SOC’s CloudWatch/GuardDuty footprint is us-east-1 / us-west-2 / eu-west-1 only. T1535 (Unused/Unsupported Cloud Regions).

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "AKIADRAC0MALF0YEXAMP5",
    "userName": "draco"
  },
  "eventTime": "2026-04-15T20:54:33Z",
  "eventSource": "account.amazonaws.com",
  "eventName": "EnableRegion",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
  "requestParameters": {
    "regionName": "ap-east-1"
  },
  "responseElements": null,
  "requestID": "90000000-0000-4000-8000-000100110110",
  "eventID": "90000000-0000-4000-8000-000100110111",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "account.us-east-1.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Stealth

Techniques:

• T1535 — Unused/Unsupported Cloud Regions — Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.