Enable All AWS Organization Features

More Info:

Ensure that All Features is enabled within your Amazon Organizations to achieve full control over the use of AWS services and actions across multiple AWS accounts using Service Control Policies (SCPs). An SCP is a type of organization control policy that can be used to restrict what users and even administrators can do in affected AWS accounts. For example, the master account from an organization can apply SCPs that can prevent member accounts from leaving the organization. A Service Control Policy is similar to an IAM access policy except the SCP does not grant any access permissions but instead it acts like a filter that allows only the specified services and actions to be used within the organization. SCPs make use of whitelisting and blacklisting methods to filter the permissions that are available to member accounts. When whitelisting is used, you can explicitly specify the access that is allowed and all other access is implicitly blocked. When blacklisting is used, you can explicitly specify the access that is not allowed and all other access is granted.

Risk Level

Medium

Address

Security

Compliance Standards

NIST

Remediation

How to enable all AWS Organization features

Using AWS Console

Create an AWS Organization: If you don’t have an organization already, you need to create one. Sign in to the AWS Management Console with your AWS account credentials, navigate to the AWS Organizations service, and follow the prompts to create a new organization.
Enable consolidated billing: With AWS Organizations, you can consolidate the billing for all the member accounts under a single paying account. To enable consolidated billing, you need to designate one account as the master account and link other accounts as member accounts. Follow the instructions in the AWS Organizations console to set up consolidated billing.
Set up service control policies (SCPs): SCPs allow you to establish fine-grained permissions and restrictions for member accounts within your organization. You can create SCPs that define which AWS services and actions are allowed or denied for organizational units (OUs) or accounts. Access the AWS Organizations console, navigate to the Policies section, and create and attach SCPs to the desired OUs or accounts.
Implement organizational units (OUs): OUs are a way to organize and manage your AWS accounts within an organization. You can create hierarchical structures of OUs to reflect your organizational structure. Access the AWS Organizations console, navigate to the Organize accounts section, and create and manage OUs as needed.
Establish service control policies for OUs: Once you have OUs set up, you can apply SCPs to control the permissions and access for the accounts within each OU. Navigate to the Policies section in the AWS Organizations console, create SCPs with the desired permissions, and attach them to the relevant OUs.
Enable cross-account access: AWS Organizations allows you to enable cross-account access to simplify resource sharing across accounts within the organization. You can define trusted entities (accounts or organizations) and establish cross-account IAM roles to grant access. Access the AWS Organizations console, navigate to the Organize accounts section, and configure cross-account access as needed.
Monitor and manage organization-wide services: AWS Organizations provides features like AWS Config, AWS CloudTrail, and AWS CloudWatch that allow you to monitor and manage the activities and configurations across your organization. Enable and configure these services to gain visibility and control over your organization’s resources.

Triage and Remediation

Remediation

Remediation

Using Console

To use AWS Organizations–level integrations for Route 53 (for example, sharing Resolver rules or private hosted zones across accounts), your organization must be set to “All features” rather than “Consolidated billing only.” Here’s how to switch it using the AWS Management Console.

Prerequisites

You must sign in to the management account (formerly “master account”) of the organization.
Your user/role must have permissions for AWS Organizations (e.g., organizations:EnableAllFeatures).
Be aware: enabling all features allows use of Service Control Policies (SCPs) and other org-wide controls.

Step-by-step: Enable All AWS Organization Features (Console)

Sign in to AWS Management Console
- Log in as the management account (or an IAM user/role in that account with the required permissions).
Open AWS Organizations
- In the console search bar, type “Organizations”.
- Select AWS Organizations.
Check your organization status
- In the left navigation pane, click Settings or Organization (depending on the current console layout).
- Look for the organization type:
  - If it says “All features”, nothing else is needed.
  - If it says “Consolidated billing only”, continue.
Start enabling all features
- In the main Organizations page, locate the banner or button that says something like:
  - “Enable all features” or
  - “Turn on all features”.
- Click Enable all features.
Review the information and confirm
- A dialog will describe what enabling all features does (e.g., allows SCPs, tagging, more services at org level).
- Review the implications.
- Click Enable all features or Confirm.
Have all member accounts approve (if prompted)
- In some cases, member accounts must approve the change:
  - AWS sends an invitation to each member account to approve enabling all features.
  - For each member account:
    1. Log into that account’s AWS console.
    2. Open AWS Organizations.
    3. On the Invitations or Notifications area, accept the request to enable all features.
- Once all member accounts accept, AWS completes the transition.
Verify the change
- Back in the management account, refresh the AWS Organizations console.
- Confirm the organization now shows “All features” enabled.

After enabling (for Route 53 use-cases)

Once “All features” is enabled, you can:

Use AWS Resource Access Manager (RAM) to share:
- Route 53 Resolver rules across accounts,
- Outposts resolvers and other related resources where supported.
Apply Service Control Policies (SCPs) that can control Route 53 actions at the org or OU level if needed.

If you tell me your exact Route 53 use-case (e.g., share a Resolver rule across accounts), I can give the next set of console steps.

Using CLI

To “Enable All AWS Organization Features” is an AWS Organizations setting that applies to the whole org, not specifically to Route 53. But if a security tool flags this against a Route 53 account, the fix is still to enable All Features in Organizations for the management account and have all member accounts accept the handshake.Below are the minimal AWS CLI steps.

1. Verify current organization status (Management account)

aws organizations describe-organization

Check the FeatureSet field in the output:

If FeatureSet is ALL → nothing to do.
If FeatureSet is CONSOLIDATED_BILLING → proceed.

2. Enable All Features (Management account)

aws organizations enable-all-features

This will start an enablement process and send a handshake that each invited member account must accept.

3. List required handshakes (each member account)

aws organizations list-handshakes-for-account --filter ActionType=ENABLE_ALL_FEATURES

Copy the Id of the handshake that has ActionType = ENABLE_ALL_FEATURES and State = REQUESTED.

4. Accept the handshake (each member account)

aws organizations accept-handshake --handshake-id <HANDSHAKE_ID>

Repeat for each member account that has such a handshake.

5. Confirm All Features is enabled (Management account)

After every member account has accepted:

aws organizations describe-organization

Ensure FeatureSet is now ALL.

Once this is done, the organization has All Features enabled, which satisfies the misconfiguration finding (even if the scanner labels it under Route 53). No Route 53–specific CLI change is required.

Using Python

Enabling all AWS Organizations features is an AWS Organizations setting, not a Route53‑specific one. Some Route53 capabilities (e.g., sharing resources across accounts) may require “all features” to be enabled at the org level, but the change itself is done in Organizations.Below are step‑by‑step instructions and a Python (boto3) example to enable all features.

Step 1 – Prerequisites

You must run this from the management (formerly master) account of the AWS Organization.
Your IAM identity must have permissions for:
- organizations:DescribeOrganization
- organizations:EnableAllFeatures
- organizations:ListAWSServiceAccessForOrganization
- organizations:ListRoots
- (Optionally) organizations:ListHandshakesForOrganization, organizations:AcceptHandshake
Install boto3 and configure credentials for the management account:

pip install boto3
aws configure

Step 2 – Understand the flow

Enabling all features is a two‑step process:

Call EnableAllFeatures (creates a handshake).
Accept the handshake (can be manual in console or via API).

In some older org setups, member accounts may also need to accept, but typically it’s just handled centrally by the management account.

Step 3 – Python code to enable all features

import boto3
from botocore.exceptions import ClientError

org = boto3.client('organizations')

def get_org_status():
    resp = org.describe_organization()
    return resp['Organization']['FeatureSet']  # 'ALL' or 'CONSOLIDATED_BILLING'

def enable_all_features():
    try:
        status = get_org_status()
        if status == 'ALL':
            print("All features are already enabled for this organization.")
            return

        print("Current FeatureSet:", status)
        print("Requesting enablement of all features...")

        resp = org.enable_all_features()
        handshake_id = resp['Handshake']['Id']
        print(f"EnableAllFeatures handshake created: {handshake_id}")
        return handshake_id

    except ClientError as e:
        print(f"Error enabling all features: {e}")
        raise

def find_enable_all_features_handshake():
    # Look for any OPEN handshake of type ENABLE_ALL_FEATURES
    paginator = org.get_paginator('list_handshakes_for_organization')
    for page in paginator.paginate(Filter={'ActionType': 'ENABLE_ALL_FEATURES'}):
        for h in page['Handshakes']:
            if h['State'] == 'OPEN':
                return h['Id']
    return None

def accept_handshake(handshake_id):
    try:
        resp = org.accept_handshake(HandshakeId=handshake_id)
        print(f"Accepted handshake: {handshake_id}")
        return resp
    except ClientError as e:
        print(f"Error accepting handshake {handshake_id}: {e}")
        raise

def main():
    status = get_org_status()
    print("Initial FeatureSet:", status)

    if status == 'ALL':
        print("No action needed; all features already enabled.")
        return

    # Step 1: Request enabling all features
    handshake_id = enable_all_features()

    # If the API call did not return an ID (rare), try to discover it
    if not handshake_id:
        handshake_id = find_enable_all_features_handshake()

    if not handshake_id:
        print("No open ENABLE_ALL_FEATURES handshake found; check the AWS Console.")
        return

    # Step 2: Accept the handshake
    accept_handshake(handshake_id)

    # Verify final status
    final_status = get_org_status()
    print("Final FeatureSet:", final_status)

if __name__ == "__main__":
    main()

Step 4 – Verify in the console

In the management account, go to AWS Organizations Console.
On the Settings / Organization page, confirm:
- Feature set shows “All features”.
Route53 features that require all‑features Organizations (e.g., some cross‑account sharing patterns) should now work, assuming IAM and service‑level configs are correct.

If you describe what exactly you’re trying to do in Route53 (e.g., share private hosted zones, Resolver rules, DNS firewall across accounts), I can add the Route53‑specific configuration steps after enabling all features.

Using Terraform

resource "aws_organizations_organization" "this" {
  # REQUIRED: enable all AWS Organizations features so services like Route 53
  # can use org‑level integrations
  feature_set = "ALL"

  # OPTIONAL: keep or add any other org settings you already manage here
  aws_service_access_principals = [
    # e.g. enable Organizations integration for Route53 Resolver DNS Firewall if needed
    # "fms.amazonaws.com",
    # "route53.amazonaws.com",
  ]

  enabled_policy_types = [
    # Add policy types you actually use, for example:
    # "SERVICE_CONTROL_POLICY",
    # "TAG_POLICY",
    # "BACKUP_POLICY",
    # "AISERVICES_OPT_OUT_POLICY",
  ]
}

Enabling feature_set = "ALL" is a one‑way change in AWS Organizations and cannot be reverted to consolidated billing only; review before applying.Verification: terraform plan should show feature_set changing (or being created) with value "ALL" on aws_organizations_organization.this and no other unexpected changes.

Additional Reading:

[https://aws.amazon.com/organizations/features/]

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Enable All AWS Organization Features

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

Prerequisites

Step-by-step: Enable All AWS Organization Features (Console)

After enabling (for Route 53 use-cases)

1. Verify current organization status (Management account)

2. Enable All Features (Management account)

3. List required handshakes (each member account)

4. Accept the handshake (each member account)

5. Confirm All Features is enabled (Management account)

Step 1 – Prerequisites

Step 2 – Understand the flow

Step 3 – Python code to enable all features

Step 4 – Verify in the console

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Remediation

​Using AWS Console

​Triage and Remediation

​Remediation

​Prerequisites

​Step-by-step: Enable All AWS Organization Features (Console)

​After enabling (for Route 53 use-cases)

​1. Verify current organization status (Management account)

​2. Enable All Features (Management account)

​3. List required handshakes (each member account)

​4. Accept the handshake (each member account)

​5. Confirm All Features is enabled (Management account)

​Step 1 – Prerequisites

​Step 2 – Understand the flow

​Step 3 – Python code to enable all features

​Step 4 – Verify in the console

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation

Remediation

Prerequisites

Step-by-step: Enable All AWS Organization Features (Console)

After enabling (for Route 53 use-cases)

1. Verify current organization status (Management account)

2. Enable All Features (Management account)

3. List required handshakes (each member account)

4. Accept the handshake (each member account)

5. Confirm All Features is enabled (Management account)

Step 1 – Prerequisites

Step 2 – Understand the flow

Step 3 – Python code to enable all features

Step 4 – Verify in the console

Additional Reading: