More Info:

Ensure that All Features is enabled within your Amazon Organizations to achieve full control over the use of AWS services and actions across multiple AWS accounts using Service Control Policies (SCPs). An SCP is a type of organization control policy that can be used to restrict what users and even administrators can do in affected AWS accounts. For example, the master account from an organization can apply SCPs that can prevent member accounts from leaving the organization. A Service Control Policy is similar to an IAM access policy except the SCP does not grant any access permissions but instead it acts like a filter that allows only the specified services and actions to be used within the organization. SCPs make use of whitelisting and blacklisting methods to filter the permissions that are available to member accounts. When whitelisting is used, you can explicitly specify the access that is allowed and all other access is implicitly blocked. When blacklisting is used, you can explicitly specify the access that is not allowed and all other access is granted

Risk Level

Medium

Address

Security

Compliance Standards

CBP

Triage and Remediation

Remediation

To remediate the misconfiguration “Enable All AWS Organization Features” for AWS using AWS console, follow these steps:

  1. Log in to your AWS Management Console.
  2. Navigate to the AWS Organizations service.
  3. Click on the “Settings” tab in the left navigation menu.
  4. Scroll down to the “Feature Configuration” section.
  5. Click on the “Enable All Features” button.
  6. Review the features that will be enabled and click “Confirm”.
  7. Wait for the process to complete.

Once the process is complete, all the AWS organization features will be enabled and the misconfiguration will be remediated.

Additional Reading: