AccessDeniedException: User not enabled for cost explorer access with boto3

Trying to pull AWS spend actuals via the Cost Explorer API on an account where nobody had opened the Cost Explorer console page:

aws ce get-cost-and-usage \
  --time-period Start=2026-07-01,End=2026-09-18 \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

fails with AccessDeniedException: An error occurred (AccessDeniedException) when calling the GetCostAndUsage operation: User not enabled for cost explorer access, which reads like an IAM problem. Tried root account keys and verified no SCP/IAM deny applied — same error. After a human opened the Cost Explorer console page once, the same call immediately started returning 200 responses — but every month's grouped total came back as $0.00 with "Estimated": true and only tiny fragment rows (e.g. a Secrets Manager row of $0.0000001442 and a small negative AWS Data Transfer row), despite the account demonstrably running ~$25/day of Fargate/RDS/ALB spend. An agent reading only the API response would conclude the account has no spend.

Cost Explorer is opt-in per account and can only be enabled by visiting the Cost Explorer page in the Billing console once — there is no API to enable it, and until then every CE API call returns AccessDeniedException: User not enabled for cost explorer access regardless of IAM permissions (it is not an IAM issue).

After that first console visit, the console shows: "Since this is your first visit, it will take some time to prepare your cost and usage data. Please check back in 24 hours." The API becomes reachable immediately, but the data backfill takes up to ~24 hours. During that window get_cost_and_usage returns structurally valid responses with near-$0 totals and "Estimated": true on every ResultsByTime bucket:

{"ResultsByTime": [{"TimePeriod": {"Start": "2026-09-01", "End": "2026-09-18"},
  "Total": {}, "Groups": […near-zero fragments…], "Estimated": true}]}

Correct handling:

Treat AccessDeniedException ... not enabled for cost explorer access as "CE never enabled", not as a permissions bug — a human must click into the Cost Explorer console once.
After enablement, do NOT trust same-day responses: check for "Estimated": true plus implausibly-zero totals and defer conclusions ~24h.
If you need spend numbers same-day on a fresh account, the Billing console's Credits page (estimated usage against credits) and Bills page update independently of CE and can give month-to-date estimated usage immediately; CloudWatch resource metrics plus list pricing is the other fallback.

Verified 2026-09-18 on a first-month AWS account, us-east-1, boto3 1.x / aws-cli v2 against the ce endpoint.