qontract-reconcile 0.10.2.dev125__py3-none-any.whl → 0.10.2.dev127__py3-none-any.whl

{qontract_reconcile-0.10.2.dev125.dist-info → qontract_reconcile-0.10.2.dev127.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev125
+Version: 0.10.2.dev127
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev125.dist-info → qontract_reconcile-0.10.2.dev127.dist-info}/RECORD

@@ -144,10 +144,10 @@ reconcile/automated_actions/config/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQe
 reconcile/automated_actions/config/integration.py,sha256=cf1VxolcjlGP-xO7IIH5A00Qr4znNJTT7a_sU18ABig,10755
 reconcile/aws_account_manager/README.md,sha256=_XFM3GZNHUzv--e_navqJuaUWpjC6QrHfulreHynFf0,262
 reconcile/aws_account_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/aws_account_manager/integration.py,sha256=v-l4fdWTgX_vSYiBKAfDvT_g0_ZKNPDQnDKUyhrSzIs,15143
+reconcile/aws_account_manager/integration.py,sha256=o-6NCzub7apFgpCGaH4uIg5wJKMT3flBEfFlq45G1AQ,15207
 reconcile/aws_account_manager/merge_request_manager.py,sha256=q8t-YwD4y_4UpxdoG9TQrEbDpjlzasOQIynFoCjP2OE,3947
 reconcile/aws_account_manager/metrics.py,sha256=YB10ea4kIGwJfs5N14RF-RoXPb-QQWaDBz1jLZ3YWE0,917
-reconcile/aws_account_manager/reconciler.py,sha256=8mwwcWVVNoUzmttzxgnLyePqN823v1t_dQCNCrx1mG0,15035
+reconcile/aws_account_manager/reconciler.py,sha256=A3pYZiLX8QZTyGqQLuVvTCL1AmVQvNpor5qPIE-npiA,17025
 reconcile/aws_account_manager/utils.py,sha256=iYPPOtbZ7FiKkz9v5f1YXRIHw5YFOtSavUkF8oMwfJY,1439
 reconcile/aws_ami_cleanup/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/aws_ami_cleanup/integration.py,sha256=KG7g9NpbKmoaveDD3oi9SinqUE29NaM-4lGo-6YuHlM,9302
@@ -227,7 +227,7 @@ reconcile/glitchtip_project_alerts/integration.py,sha256=BgMx-NyV9mTuv7Sotb2OioC
 reconcile/glitchtip_project_dsn/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/glitchtip_project_dsn/integration.py,sha256=2iugub-kHYkHNK33n0v9_TeWonuxCPah_VkoTPvaajE,8077
 reconcile/gql_definitions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/introspection.json,sha256=eHbVnokhdU5AjF1vnm2I_zHzU7-eH4rozjv45iZgHPs,2282580
+reconcile/gql_definitions/introspection.json,sha256=AK7hGfvHjHL6Nqg3KNL4dmOiy4rOPkDSZ8zAWeA5kqU,2283098
 reconcile/gql_definitions/acs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/acs/acs_instances.py,sha256=L91WW9LbhJbBSrECqShQpFtjoBOsmNIYLRpMbx1io5o,2181
 reconcile/gql_definitions/acs/acs_policies.py,sha256=bN5i4mks10Z23KJSj7jqp966Osq2dps4d-sPH9gjxEA,7008
@@ -243,7 +243,7 @@ reconcile/gql_definitions/app_sre_tekton_access_revalidation/users.py,sha256=XdV
 reconcile/gql_definitions/automated_actions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/automated_actions/instance.py,sha256=D50v0exLeK5hvjQKvxQ5V-6DnYZo_L6cX_Gaf3PGREs,5491
 reconcile/gql_definitions/aws_account_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/gql_definitions/aws_account_manager/aws_accounts.py,sha256=YnS_CDwKMNCxE5ySaKC_72pG9_WmW3nz8ZyyCzX1yV4,5119
+reconcile/gql_definitions/aws_account_manager/aws_accounts.py,sha256=vF51KrY2gwX0J9vESiaRMPQqdAMEtz9f_tBq52bInp0,5148
 reconcile/gql_definitions/aws_ami_cleanup/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/aws_ami_cleanup/aws_accounts.py,sha256=jIgOa888MYLLvVsn1ir3nbkhWLG5T6dBg7oDnp1q8BI,4108
 reconcile/gql_definitions/aws_saml_idp/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -314,7 +314,7 @@ reconcile/gql_definitions/endpoints_discovery/apps.py,sha256=aBWRAwDUJQ32ghJS4cP
 reconcile/gql_definitions/external_resources/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/external_resources/aws_accounts.py,sha256=XR69j9dpTQ0gv8y-AZN7AJ0dPvO-wbHscyCDgrax6Bk,2046
 reconcile/gql_definitions/external_resources/external_resources_modules.py,sha256=JViHtDWEBwjStBUo_bUdm_sxdpjCHcoATeFvwFRLQpU,3009
-reconcile/gql_definitions/external_resources/external_resources_namespaces.py,sha256=qGslq_4LdKd0jt8-TYySBU9c6rTTPVxG613xLSDFxBQ,44622
+reconcile/gql_definitions/external_resources/external_resources_namespaces.py,sha256=4omzQPYGofq1HgCrmh_ToouVCIX_Cz967H_8wpZjOBc,44740
 reconcile/gql_definitions/external_resources/external_resources_settings.py,sha256=WBkJqnoyYCe1Vimwbp_Pa0RdyTdmWNf6oEWyA749QzA,3589
 reconcile/gql_definitions/external_resources/fragments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/external_resources/fragments/external_resources_module_overrides.py,sha256=T_qWCRtzU8F9frebBXG9TkeQdrKGt3R9YinSngPoFqM,1262
@@ -323,7 +323,7 @@ reconcile/gql_definitions/fleet_labeler/fleet_labels.py,sha256=XPk1YFmiCtGlwrldx
 reconcile/gql_definitions/fragments/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 reconcile/gql_definitions/fragments/aus_organization.py,sha256=uBKbTuBa3CZmTXR5HOcGhRcu2U9kM93KbYmoWTxcpB0,4767
 reconcile/gql_definitions/fragments/aws_account_common.py,sha256=3-7ZAP6GSff7Z2Syz2VQCLY4IySqBOSVmceaRiVNQpw,2385
-reconcile/gql_definitions/fragments/aws_account_managed.py,sha256=sM5J4TczyqpzhBFkX0IIQifRYvYpDIMY7pOhEDOUXCY,1789
+reconcile/gql_definitions/fragments/aws_account_managed.py,sha256=V_9pH0wVza2sPyq8ckkabNMYIRZt6VW4Nixw_jAxaMc,1892
 reconcile/gql_definitions/fragments/aws_account_sso.py,sha256=ITR3PLz4Iq1SiWAoYGWPDuHJnAmTyZ0QQqs2Zsi8pxA,979
 reconcile/gql_definitions/fragments/aws_infra_management_account.py,sha256=uAmALVRF2gBM3p_Dmez_ew6KVAtetamwOPkRIPZAlGc,1254
 reconcile/gql_definitions/fragments/aws_vpc.py,sha256=T2egTwi2Rb0IRBBmsyag8xKpu_m6GbIAy80fhZNZwk8,1434
@@ -663,7 +663,7 @@ reconcile/utils/acs/notifiers.py,sha256=nHVw9C_2-K4nv5zq26jlOTSw1roY6TKlovi1sOfp
 reconcile/utils/acs/policies.py,sha256=jpbi3qpGkBD_X6MfzsX12dPajUbmACmhIOz_0rDvYzs,5489
 reconcile/utils/acs/rbac.py,sha256=ugsLM9Pb7FbUbdq85E3VzXGMaB9ZovXob7tdWCxwqZ8,8808
 reconcile/utils/aws_api_typed/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-reconcile/utils/aws_api_typed/account.py,sha256=puYfDsWF1E1Ub5e8yh0Hqz-whqERGn819N08i-g4zgY,626
+reconcile/utils/aws_api_typed/account.py,sha256=f1UQul336_9rC_iCdzkbTQkhcFh5BjIZsf3X18SACfY,2048
 reconcile/utils/aws_api_typed/api.py,sha256=1h_dQXnE7FUAZi4RRgBEU7nbyAz8awRo0cpuilXyhHE,9239
 reconcile/utils/aws_api_typed/dynamodb.py,sha256=AKUbz8HGzmSq4cnpjJe7PgqsikMkjbpbzUD2UJv2b58,383
 reconcile/utils/aws_api_typed/iam.py,sha256=a9lFtwqj6YJM1_W4fi2U3y7N0fX8TTPg08JjQwWPTio,2251
@@ -791,7 +791,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=UfwwRLS5Ya4_Nh1w5n1dvoYtchQvYE9yj1VANt2IKqI,3925
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=zEDbGr18ZeHNQwW8pUsr2JRjuXIPz--WAGJxZo9sv_Y,894
-qontract_reconcile-0.10.2.dev125.dist-info/METADATA,sha256=0CAmKlRzqxs2IzOmfBggloZaP381t54Ava7CEdNQ3AI,24566
-qontract_reconcile-0.10.2.dev125.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-qontract_reconcile-0.10.2.dev125.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev125.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev127.dist-info/METADATA,sha256=MZa1Z75ScJTRAg6c6E1GS6exq7gFyWYwIoxaIk8m5A0,24566
+qontract_reconcile-0.10.2.dev127.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+qontract_reconcile-0.10.2.dev127.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev127.dist-info/RECORD,,

reconcile/aws_account_manager/integration.py

@@ -227,6 +227,7 @@ class AwsAccountMgmtIntegration(
             alias=account.alias,
             quotas=[q for ql in account.quota_limits or [] for q in ql.quotas],
             security_contact=account.security_contact,
+            regions=account.supported_deployment_regions or [],
         )
 
     def reconcile_payer_accounts(

reconcile/aws_account_manager/reconciler.py

@@ -4,6 +4,7 @@ from textwrap import dedent
 from typing import Any, Protocol
 
 from reconcile.aws_account_manager.utils import state_key
+from reconcile.utils.aws_api_typed.account import OptStatus
 from reconcile.utils.aws_api_typed.api import AWSApi
 from reconcile.utils.aws_api_typed.iam import (
     AWSAccessKey,
@@ -26,6 +27,7 @@ TASK_CHECK_SERVICE_QUOTA_STATUS = "check-service-quota-status"
 TASK_ENABLE_ENTERPRISE_SUPPORT = "enable-enterprise-support"
 TASK_CHECK_ENTERPRISE_SUPPORT_STATUS = "check-enterprise-support-status"
 TASK_SET_SECURITY_CONTACT = "set-security-contact"
+TASK_SET_SUPPORTED_REGIONS = "set-supported-regions"
 
 
 class Quota(Protocol):
@@ -62,7 +64,7 @@ class AWSReconciler:
                 # account already exists, nothing to do
                 return _state.value
 
-            logging.info(f"Creating account {name}")
+            logging.info(f"{name}: Creating account")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -83,7 +85,7 @@ class AWSReconciler:
                 # account checked and exists, nothing to do
                 return _state.value
 
-            logging.info(f"Checking account creation status {name}")
+            logging.info(f"{name}: Checking account creation status")
             status = aws_api.organizations.describe_create_account_status(
                 create_account_request_id=create_account_request_id
             )
@@ -110,7 +112,7 @@ class AWSReconciler:
                 # account already tagged, nothing to do
                 return
 
-            logging.info(f"Tagging account {name}: {tags}")
+            logging.info(f"{name}: Setting tags {tags}")
             _state.value = tags
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
@@ -133,7 +135,7 @@ class AWSReconciler:
                 # account already moved, nothing to do
                 return
 
-            logging.info(f"Moving account {name} to {ou}")
+            logging.info(f"{name}: Moving account to OU {ou}")
             destination = self._get_destination_ou(aws_api, destination_path=ou)
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
@@ -153,7 +155,7 @@ class AWSReconciler:
             if _state.exists and _state.value == new_alias:
                 return
 
-            logging.info(f"Set account alias '{new_alias}' for {name}")
+            logging.info(f"{name}: Set account alias '{new_alias}'")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -179,7 +181,7 @@ class AWSReconciler:
                 if quota.value > q.value:
                     # a quota can be already higher than requested, because it was may set manually or enforced by the payer account
                     logging.info(
-                        f"Cannot lower quota {q.service_code=}, {q.quota_code=}: {quota.value} -> {q.value}. Skipping."
+                        f"{name}: Cannot lower quota {q.service_code=}, {q.quota_code=}: {quota.value} -> {q.value}. Skipping."
                     )
                 elif quota.value < q.value:
                     quota.value = q.value
@@ -187,7 +189,7 @@ class AWSReconciler:
 
             for q in new_quotas:
                 logging.info(
-                    f"Setting quota for {name}: {q.service_name}/{q.quota_name} ({q.service_code}/{q.quota_code}) -> {q.value}"
+                    f"{name}: Setting quota: {q.service_name}/{q.quota_name} ({q.service_code}/{q.quota_code}) -> {q.value}"
                 )
 
             if self.dry_run:
@@ -203,7 +205,7 @@ class AWSReconciler:
                     )
                 except AWSResourceAlreadyExistsException:
                     raise AbortStateTransaction(
-                        f"A quota increase for this {new_quota.service_code}/{new_quota.quota_code} already exists. Try it again later."
+                        f"{name}: A quota increase for this {new_quota.service_code}/{new_quota.quota_code} already exists. Try it again later."
                     ) from None
                 ids.append(req.id)
 
@@ -223,7 +225,7 @@ class AWSReconciler:
             if _state.exists and _state.value == request_ids:
                 return
 
-            logging.info(f"Checking quota change requests for {name}")
+            logging.info(f"{name}: Checking quota change requests")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -258,7 +260,7 @@ class AWSReconciler:
                     raise AbortStateTransaction("Dry run")
                 return None
 
-            logging.info(f"Enabling enterprise support for {name}")
+            logging.info(f"{name}: Enabling enterprise support")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -277,7 +279,9 @@ class AWSReconciler:
             _state.value = case_id
             return case_id
 
-    def _check_enterprise_support_status(self, aws_api: AWSApi, case_id: str) -> None:
+    def _check_enterprise_support_status(
+        self, aws_api: AWSApi, name: str, case_id: str
+    ) -> None:
         """Check the status of the enterprise support case."""
         with self.state.transaction(
             state_key(case_id, TASK_CHECK_ENTERPRISE_SUPPORT_STATUS), True
@@ -285,7 +289,7 @@ class AWSReconciler:
             if _state.exists:
                 return
 
-            logging.info(f"Checking enterprise support case {case_id}")
+            logging.info(f"{name}: Checking enterprise support case {case_id}")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -316,7 +320,7 @@ class AWSReconciler:
             if _state.exists and _state.value == security_contact:
                 return
 
-            logging.info(f"Setting security contact for {account}")
+            logging.info(f"{name}: Setting security contact")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -325,6 +329,55 @@ class AWSReconciler:
             )
             _state.value = security_contact
 
+    def _set_supported_regions(
+        self,
+        aws_api: AWSApi,
+        name: str,
+        regions: Iterable[str],
+    ) -> None:
+        """Set the supported regions for the account."""
+        with self.state.transaction(
+            state_key(name, TASK_SET_SUPPORTED_REGIONS)
+        ) as _state:
+            if _state.exists and _state.value == regions:
+                return
+
+            aws_regions = aws_api.account.list_regions()
+            if invalid_regions := set(regions) - {r.name for r in aws_regions}:
+                raise RuntimeError(
+                    f"{name}: Regions {invalid_regions} are not available"
+                )
+
+            # ATTENTION: Regions can be "enabled by default".
+            # That means we cannot enable or disable them manually. We just gently ignore them!
+            to_enable_regions = [
+                r.name
+                for r in aws_regions
+                if r.status == OptStatus.DISABLED and r.name in regions
+            ]
+
+            to_disable_regions = [
+                r.name
+                for r in aws_regions
+                if r.status == OptStatus.ENABLED and r.name not in regions
+            ]
+
+            if to_enable_regions:
+                logging.info(f"{name}: Enabling regions {to_enable_regions}")
+
+            if to_disable_regions:
+                logging.info(f"{name}: Disabling regions {to_disable_regions}")
+
+            if self.dry_run:
+                raise AbortStateTransaction("Dry run")
+
+            for aws_region in to_enable_regions:
+                aws_api.account.enable_region(aws_region)
+            for aws_region in to_disable_regions:
+                aws_api.account.disable_region(aws_region)
+
+            _state.value = regions
+
     #
     # Public methods
     #
@@ -353,7 +406,7 @@ class AWSReconciler:
             if _state.exists and _state.value == user_name:
                 return None
 
-            logging.info(f"Creating IAM user '{user_name}' for {name}")
+            logging.info(f"{name}: Creating IAM user '{user_name}'")
             if self.dry_run:
                 raise AbortStateTransaction("Dry run")
 
@@ -379,7 +432,7 @@ class AWSReconciler:
         if enterprise_support and (
             case_id := self._enable_enterprise_support(aws_api, name, uid)
         ):
-            self._check_enterprise_support_status(aws_api, case_id)
+            self._check_enterprise_support_status(aws_api, name, case_id)
 
     def reconcile_account(
         self,
@@ -388,6 +441,7 @@ class AWSReconciler:
         alias: str | None,
         quotas: Iterable[Quota],
         security_contact: Contact,
+        regions: Iterable[str],
     ) -> None:
         """Reconcile/update the AWS account. Return the initial user access key if a new user was created."""
         self._set_account_alias(aws_api, name, alias)
@@ -401,3 +455,4 @@ class AWSReconciler:
             email=security_contact.email,
             phone_number=security_contact.phone_number,
         )
+        self._set_supported_regions(aws_api, name, regions)

reconcile/gql_definitions/aws_account_manager/aws_accounts.py

@@ -45,6 +45,7 @@ fragment AWSAccountManaged on AWSAccount_v1 {
     email
     phoneNumber
   }
+  supportedDeploymentRegions
 }
 
 fragment VaultSecret on VaultSecret_v1 {

reconcile/gql_definitions/external_resources/external_resources_namespaces.py

@@ -117,6 +117,7 @@ query ExternalResourcesNamespaces {
                 blue_green_deployment {
                     enabled
                     switchover
+                    switchover_timeout
                     delete
                     target {
                         allocated_storage
@@ -598,6 +599,7 @@ class RDSBlueGreenDeploymentTargetV1(ConfiguredBaseModel):
 class RDSBlueGreenDeploymentV1(ConfiguredBaseModel):
     enabled: Optional[bool] = Field(..., alias="enabled")
     switchover: Optional[bool] = Field(..., alias="switchover")
+    switchover_timeout: Optional[int] = Field(..., alias="switchover_timeout")
     delete: Optional[bool] = Field(..., alias="delete")
     target: Optional[RDSBlueGreenDeploymentTargetV1] = Field(..., alias="target")
 

reconcile/gql_definitions/fragments/aws_account_managed.py

@@ -55,3 +55,4 @@ class AWSAccountManaged(ConfiguredBaseModel):
     organization: Optional[AWSOrganizationV1] = Field(..., alias="organization")
     quota_limits: Optional[list[AWSQuotaLimitsV1]] = Field(..., alias="quotaLimits")
     security_contact: Optional[AWSContactV1] = Field(..., alias="securityContact")
+    supported_deployment_regions: Optional[list[str]] = Field(..., alias="supportedDeploymentRegions")

reconcile/gql_definitions/introspection.json

@@ -44387,6 +44387,18 @@
                             "isDeprecated": false,
                             "deprecationReason": null
                         },
+                        {
+                            "name": "switchover_timeout",
+                            "description": null,
+                            "args": [],
+                            "type": {
+                                "kind": "SCALAR",
+                                "name": "Int",
+                                "ofType": null
+                            },
+                            "isDeprecated": false,
+                            "deprecationReason": null
+                        },
                         {
                             "name": "delete",
                             "description": null,

reconcile/utils/aws_api_typed/account.py

@@ -1,3 +1,4 @@
+from enum import StrEnum
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -5,6 +6,21 @@ if TYPE_CHECKING:
 else:
     AccountClient = object
 
+from pydantic import BaseModel
+
+
+class OptStatus(StrEnum):
+    """Optional status enum."""
+
+    ENABLED = "ENABLED"
+    DISABLED = "DISABLED"
+    ENABLED_BY_DEFAULT = "ENABLED_BY_DEFAULT"
+
+
+class Region(BaseModel):
+    name: str
+    status: OptStatus
+
 
 class AWSApiAccount:
     def __init__(self, client: AccountClient) -> None:
@@ -21,3 +37,29 @@ class AWSApiAccount:
             Title=title,
             PhoneNumber=phone_number,
         )
+
+    def list_regions(self) -> list[Region]:
+        """List all regions in the account."""
+        regions = []
+        paginator = self.client.get_paginator("list_regions")
+        for page in paginator.paginate():
+            for region in page["Regions"]:
+                match region["RegionOptStatus"]:
+                    case "DISABLED" | "DISABLING":
+                        status = OptStatus.DISABLED
+                    case "ENABLED" | "ENABLING":
+                        status = OptStatus.ENABLED
+                    case "ENABLED_BY_DEFAULT":
+                        status = OptStatus.ENABLED_BY_DEFAULT
+                    case _:
+                        raise ValueError(f"Unknown status: {region['RegionOptStatus']}")
+                regions.append(Region(name=region["RegionName"], status=status))
+        return regions
+
+    def enable_region(self, region: str) -> None:
+        """Enable a region in the account."""
+        self.client.enable_region(RegionName=region)
+
+    def disable_region(self, region: str) -> None:
+        """Disable a region in the account."""
+        self.client.disable_region(RegionName=region)