Aws organizations all features remediation

Using Console

To use AWS Organizations–level integrations for Route 53 (for example, sharing Resolver rules or private hosted zones across accounts), your organization must be set to “All features” rather than “Consolidated billing only.” Here’s how to switch it using the AWS Management Console.

Prerequisites

You must sign in to the management account (formerly “master account”) of the organization.
Your user/role must have permissions for AWS Organizations (e.g., organizations:EnableAllFeatures).
Be aware: enabling all features allows use of Service Control Policies (SCPs) and other org-wide controls.

Step-by-step: Enable All AWS Organization Features (Console)

Sign in to AWS Management Console
- Log in as the management account (or an IAM user/role in that account with the required permissions).
Open AWS Organizations
- In the console search bar, type “Organizations”.
- Select AWS Organizations.
Check your organization status
- In the left navigation pane, click Settings or Organization (depending on the current console layout).
- Look for the organization type:
  - If it says “All features”, nothing else is needed.
  - If it says “Consolidated billing only”, continue.
Start enabling all features
- In the main Organizations page, locate the banner or button that says something like:
  - “Enable all features” or
  - “Turn on all features”.
- Click Enable all features.
Review the information and confirm
- A dialog will describe what enabling all features does (e.g., allows SCPs, tagging, more services at org level).
- Review the implications.
- Click Enable all features or Confirm.
Have all member accounts approve (if prompted)
- In some cases, member accounts must approve the change:
  - AWS sends an invitation to each member account to approve enabling all features.
  - For each member account:
    1. Log into that account’s AWS console.
    2. Open AWS Organizations.
    3. On the Invitations or Notifications area, accept the request to enable all features.
- Once all member accounts accept, AWS completes the transition.
Verify the change
- Back in the management account, refresh the AWS Organizations console.
- Confirm the organization now shows “All features” enabled.

After enabling (for Route 53 use-cases)

Once “All features” is enabled, you can:

Use AWS Resource Access Manager (RAM) to share:
- Route 53 Resolver rules across accounts,
- Outposts resolvers and other related resources where supported.
Apply Service Control Policies (SCPs) that can control Route 53 actions at the org or OU level if needed.

If you tell me your exact Route 53 use-case (e.g., share a Resolver rule across accounts), I can give the next set of console steps.

Using CLI

To “Enable All AWS Organization Features” is an AWS Organizations setting that applies to the whole org, not specifically to Route 53. But if a security tool flags this against a Route 53 account, the fix is still to enable All Features in Organizations for the management account and have all member accounts accept the handshake.Below are the minimal AWS CLI steps.

1. Verify current organization status (Management account)

aws organizations describe-organization

Check the FeatureSet field in the output:

If FeatureSet is ALL → nothing to do.
If FeatureSet is CONSOLIDATED_BILLING → proceed.

2. Enable All Features (Management account)

aws organizations enable-all-features

This will start an enablement process and send a handshake that each invited member account must accept.

3. List required handshakes (each member account)

aws organizations list-handshakes-for-account --filter ActionType=ENABLE_ALL_FEATURES

Copy the Id of the handshake that has ActionType = ENABLE_ALL_FEATURES and State = REQUESTED.

4. Accept the handshake (each member account)

aws organizations accept-handshake --handshake-id <HANDSHAKE_ID>

Repeat for each member account that has such a handshake.

5. Confirm All Features is enabled (Management account)

After every member account has accepted:

aws organizations describe-organization

Ensure FeatureSet is now ALL.

Once this is done, the organization has All Features enabled, which satisfies the misconfiguration finding (even if the scanner labels it under Route 53). No Route 53–specific CLI change is required.

Using Python

Enabling all AWS Organizations features is an AWS Organizations setting, not a Route53‑specific one. Some Route53 capabilities (e.g., sharing resources across accounts) may require “all features” to be enabled at the org level, but the change itself is done in Organizations.Below are step‑by‑step instructions and a Python (boto3) example to enable all features.

Step 1 – Prerequisites

You must run this from the management (formerly master) account of the AWS Organization.
Your IAM identity must have permissions for:
- organizations:DescribeOrganization
- organizations:EnableAllFeatures
- organizations:ListAWSServiceAccessForOrganization
- organizations:ListRoots
- (Optionally) organizations:ListHandshakesForOrganization, organizations:AcceptHandshake
Install boto3 and configure credentials for the management account:

pip install boto3
aws configure

Step 2 – Understand the flow

Enabling all features is a two‑step process:

Call EnableAllFeatures (creates a handshake).
Accept the handshake (can be manual in console or via API).

In some older org setups, member accounts may also need to accept, but typically it’s just handled centrally by the management account.

Step 3 – Python code to enable all features

import boto3
from botocore.exceptions import ClientError

org = boto3.client('organizations')

def get_org_status():
    resp = org.describe_organization()
    return resp['Organization']['FeatureSet']  # 'ALL' or 'CONSOLIDATED_BILLING'

def enable_all_features():
    try:
        status = get_org_status()
        if status == 'ALL':
            print("All features are already enabled for this organization.")
            return

        print("Current FeatureSet:", status)
        print("Requesting enablement of all features...")

        resp = org.enable_all_features()
        handshake_id = resp['Handshake']['Id']
        print(f"EnableAllFeatures handshake created: {handshake_id}")
        return handshake_id

    except ClientError as e:
        print(f"Error enabling all features: {e}")
        raise

def find_enable_all_features_handshake():
    # Look for any OPEN handshake of type ENABLE_ALL_FEATURES
    paginator = org.get_paginator('list_handshakes_for_organization')
    for page in paginator.paginate(Filter={'ActionType': 'ENABLE_ALL_FEATURES'}):
        for h in page['Handshakes']:
            if h['State'] == 'OPEN':
                return h['Id']
    return None

def accept_handshake(handshake_id):
    try:
        resp = org.accept_handshake(HandshakeId=handshake_id)
        print(f"Accepted handshake: {handshake_id}")
        return resp
    except ClientError as e:
        print(f"Error accepting handshake {handshake_id}: {e}")
        raise

def main():
    status = get_org_status()
    print("Initial FeatureSet:", status)

    if status == 'ALL':
        print("No action needed; all features already enabled.")
        return

    # Step 1: Request enabling all features
    handshake_id = enable_all_features()

    # If the API call did not return an ID (rare), try to discover it
    if not handshake_id:
        handshake_id = find_enable_all_features_handshake()

    if not handshake_id:
        print("No open ENABLE_ALL_FEATURES handshake found; check the AWS Console.")
        return

    # Step 2: Accept the handshake
    accept_handshake(handshake_id)

    # Verify final status
    final_status = get_org_status()
    print("Final FeatureSet:", final_status)

if __name__ == "__main__":
    main()

Step 4 – Verify in the console

In the management account, go to AWS Organizations Console.
On the Settings / Organization page, confirm:
- Feature set shows “All features”.
Route53 features that require all‑features Organizations (e.g., some cross‑account sharing patterns) should now work, assuming IAM and service‑level configs are correct.

If you describe what exactly you’re trying to do in Route53 (e.g., share private hosted zones, Resolver rules, DNS firewall across accounts), I can add the Route53‑specific configuration steps after enabling all features.

Using Terraform

resource "aws_organizations_organization" "this" {
  # REQUIRED: enable all AWS Organizations features so services like Route 53
  # can use org‑level integrations
  feature_set = "ALL"

  # OPTIONAL: keep or add any other org settings you already manage here
  aws_service_access_principals = [
    # e.g. enable Organizations integration for Route53 Resolver DNS Firewall if needed
    # "fms.amazonaws.com",
    # "route53.amazonaws.com",
  ]

  enabled_policy_types = [
    # Add policy types you actually use, for example:
    # "SERVICE_CONTROL_POLICY",
    # "TAG_POLICY",
    # "BACKUP_POLICY",
    # "AISERVICES_OPT_OUT_POLICY",
  ]
}

Enabling feature_set = "ALL" is a one‑way change in AWS Organizations and cannot be reverted to consolidated billing only; review before applying.Verification: terraform plan should show feature_set changing (or being created) with value "ALL" on aws_organizations_organization.this and no other unexpected changes.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Aws organizations all features remediation

Triage and Remediation

Remediation

Prerequisites

Step-by-step: Enable All AWS Organization Features (Console)

After enabling (for Route 53 use-cases)

1. Verify current organization status (Management account)

2. Enable All Features (Management account)

3. List required handshakes (each member account)

4. Accept the handshake (each member account)

5. Confirm All Features is enabled (Management account)

Step 1 – Prerequisites

Step 2 – Understand the flow

Step 3 – Python code to enable all features

Step 4 – Verify in the console

​Triage and Remediation

​Remediation

​Prerequisites

​Step-by-step: Enable All AWS Organization Features (Console)

​After enabling (for Route 53 use-cases)

​1. Verify current organization status (Management account)

​2. Enable All Features (Management account)

​3. List required handshakes (each member account)

​4. Accept the handshake (each member account)

​5. Confirm All Features is enabled (Management account)

​Step 1 – Prerequisites

​Step 2 – Understand the flow

​Step 3 – Python code to enable all features

​Step 4 – Verify in the console

Triage and Remediation

Remediation

Prerequisites

Step-by-step: Enable All AWS Organization Features (Console)

After enabling (for Route 53 use-cases)

1. Verify current organization status (Management account)

2. Enable All Features (Management account)

3. List required handshakes (each member account)

4. Accept the handshake (each member account)

5. Confirm All Features is enabled (Management account)

Step 1 – Prerequisites

Step 2 – Understand the flow

Step 3 – Python code to enable all features

Step 4 – Verify in the console