New account has subnets, security groups, and VPCs in 17 regions.

This is normal and expected. Original regions are enabled by default. See the docs for more:

The original AWS Regions (the Regions that existed before we added the ability to enable and disable Regions) are all enabled by default and can't be disabled.

You can (and should) use Service Control Policies to limit regions services can be enabled in.

Your Amazon Web Services account has a default VPC in each AWS Region. The default VPC includes a default public subnet in each Availability Zone and an internet gateway that is attached to your VPC. The VPC also includes a default security group. For more details, please refer to following link: https://docs.aws.amazon.com/appstream2/latest/developerguide/default-vpc-with-public-subnet.html

Each Region in your AWS account is provided a default VPC. You can use the default VPC instead of creating and configuring your own VPC. A default VPC is suitable for getting started quickly and for launching public instances such as a blog or simple website. You can modify the components of your default VPC as needed.

Additional resources: https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html https://aws.amazon.com/premiumsupport/knowledge-center/deleted-default-vpc/