> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Aws organizations all features remediation ### Triage and Remediation ### Remediation To use AWS Organizations–level integrations for Route 53 (for example, sharing Resolver rules or private hosted zones across accounts), your organization must be set to “All features” rather than “Consolidated billing only.” Here’s how to switch it using the AWS Management Console. ### Prerequisites * You must sign in to the **management account** (formerly “master account”) of the organization. * Your user/role must have permissions for AWS Organizations (e.g., `organizations:EnableAllFeatures`). * Be aware: enabling all features allows use of Service Control Policies (SCPs) and other org-wide controls. *** ### Step-by-step: Enable All AWS Organization Features (Console) 1. **Sign in to AWS Management Console** * Log in as the management account (or an IAM user/role in that account with the required permissions). 2. **Open AWS Organizations** * In the console search bar, type **“Organizations”**. * Select **AWS Organizations**. 3. **Check your organization status** * In the left navigation pane, click **Settings** or **Organization** (depending on the current console layout). * Look for the organization type: * If it says **“All features”**, nothing else is needed. * If it says **“Consolidated billing only”**, continue. 4. **Start enabling all features** * In the main Organizations page, locate the banner or button that says something like: * **“Enable all features”** or * **“Turn on all features”**. * Click **Enable all features**. 5. **Review the information and confirm** * A dialog will describe what enabling all features does (e.g., allows SCPs, tagging, more services at org level). * Review the implications. * Click **Enable all features** or **Confirm**. 6. **Have all member accounts approve (if prompted)** * In some cases, member accounts must approve the change: * AWS sends an **invitation** to each member account to approve enabling all features. * For each member account: 1. Log into that account’s AWS console. 2. Open **AWS Organizations**. 3. On the **Invitations** or **Notifications** area, accept the request to enable all features. * Once all member accounts accept, AWS completes the transition. 7. **Verify the change** * Back in the management account, refresh the **AWS Organizations** console. * Confirm the organization now shows **“All features”** enabled. *** ### After enabling (for Route 53 use-cases) Once “All features” is enabled, you can: * Use **AWS Resource Access Manager (RAM)** to share: * Route 53 **Resolver rules** across accounts, * **Outposts resolvers** and other related resources where supported. * Apply **Service Control Policies (SCPs)** that can control Route 53 actions at the org or OU level if needed. If you tell me your exact Route 53 use-case (e.g., share a Resolver rule across accounts), I can give the next set of console steps. To “Enable All AWS Organization Features” is an **AWS Organizations** setting that applies to the whole org, not specifically to Route 53. But if a security tool flags this against a Route 53 account, the fix is still to enable **All Features** in Organizations for the management account and have all member accounts accept the handshake. Below are the minimal AWS CLI steps. *** ### 1. Verify current organization status (Management account) ```bash theme={null} aws organizations describe-organization ``` Check the `FeatureSet` field in the output: * If `FeatureSet` is `ALL` → nothing to do. * If `FeatureSet` is `CONSOLIDATED_BILLING` → proceed. *** ### 2. Enable All Features (Management account) ```bash theme={null} aws organizations enable-all-features ``` This will start an **enablement process** and send a handshake that each **invited** member account must accept. *** ### 3. List required handshakes (each **member** account) Log in with credentials for each member account and list handshakes: ```bash theme={null} aws organizations list-handshakes-for-account --filter ActionType=ENABLE_ALL_FEATURES ``` Copy the `Id` of the handshake that has `ActionType` = `ENABLE_ALL_FEATURES` and `State` = `REQUESTED`. *** ### 4. Accept the handshake (each member account) ```bash theme={null} aws organizations accept-handshake --handshake-id ``` Repeat for each member account that has such a handshake. *** ### 5. Confirm All Features is enabled (Management account) After every member account has accepted: ```bash theme={null} aws organizations describe-organization ``` Ensure `FeatureSet` is now `ALL`. *** Once this is done, the organization has **All Features** enabled, which satisfies the misconfiguration finding (even if the scanner labels it under Route 53). No Route 53–specific CLI change is required. Enabling **all AWS Organizations features** is an **AWS Organizations** setting, not a Route53‑specific one. Some Route53 capabilities (e.g., sharing resources across accounts) may require “all features” to be enabled at the org level, but the change itself is done in Organizations. Below are step‑by‑step instructions and a Python (boto3) example to enable all features. *** ## Step 1 – Prerequisites 1. You must run this from the **management (formerly master) account** of the AWS Organization. 2. Your IAM identity must have permissions for: * `organizations:DescribeOrganization` * `organizations:EnableAllFeatures` * `organizations:ListAWSServiceAccessForOrganization` * `organizations:ListRoots` * (Optionally) `organizations:ListHandshakesForOrganization`, `organizations:AcceptHandshake` 3. Install boto3 and configure credentials for the management account: ```bash theme={null} pip install boto3 aws configure ``` *** ## Step 2 – Understand the flow Enabling all features is a **two‑step** process: 1. Call `EnableAllFeatures` (creates a handshake). 2. Accept the handshake (can be manual in console or via API). In some older org setups, member accounts may also need to accept, but typically it’s just handled centrally by the management account. *** ## Step 3 – Python code to enable all features ```python theme={null} import boto3 from botocore.exceptions import ClientError org = boto3.client('organizations') def get_org_status(): resp = org.describe_organization() return resp['Organization']['FeatureSet'] # 'ALL' or 'CONSOLIDATED_BILLING' def enable_all_features(): try: status = get_org_status() if status == 'ALL': print("All features are already enabled for this organization.") return print("Current FeatureSet:", status) print("Requesting enablement of all features...") resp = org.enable_all_features() handshake_id = resp['Handshake']['Id'] print(f"EnableAllFeatures handshake created: {handshake_id}") return handshake_id except ClientError as e: print(f"Error enabling all features: {e}") raise def find_enable_all_features_handshake(): # Look for any OPEN handshake of type ENABLE_ALL_FEATURES paginator = org.get_paginator('list_handshakes_for_organization') for page in paginator.paginate(Filter={'ActionType': 'ENABLE_ALL_FEATURES'}): for h in page['Handshakes']: if h['State'] == 'OPEN': return h['Id'] return None def accept_handshake(handshake_id): try: resp = org.accept_handshake(HandshakeId=handshake_id) print(f"Accepted handshake: {handshake_id}") return resp except ClientError as e: print(f"Error accepting handshake {handshake_id}: {e}") raise def main(): status = get_org_status() print("Initial FeatureSet:", status) if status == 'ALL': print("No action needed; all features already enabled.") return # Step 1: Request enabling all features handshake_id = enable_all_features() # If the API call did not return an ID (rare), try to discover it if not handshake_id: handshake_id = find_enable_all_features_handshake() if not handshake_id: print("No open ENABLE_ALL_FEATURES handshake found; check the AWS Console.") return # Step 2: Accept the handshake accept_handshake(handshake_id) # Verify final status final_status = get_org_status() print("Final FeatureSet:", final_status) if __name__ == "__main__": main() ``` *** ## Step 4 – Verify in the console 1. In the management account, go to **AWS Organizations Console**. 2. On the **Settings** / **Organization** page, confirm: * **Feature set** shows **“All features”**. 3. Route53 features that require all‑features Organizations (e.g., some cross‑account sharing patterns) should now work, assuming IAM and service‑level configs are correct. *** If you describe what exactly you’re trying to do in Route53 (e.g., share private hosted zones, Resolver rules, DNS firewall across accounts), I can add the Route53‑specific configuration steps after enabling all features. ```hcl theme={null} resource "aws_organizations_organization" "this" { # REQUIRED: enable all AWS Organizations features so services like Route 53 # can use org‑level integrations feature_set = "ALL" # OPTIONAL: keep or add any other org settings you already manage here aws_service_access_principals = [ # e.g. enable Organizations integration for Route53 Resolver DNS Firewall if needed # "fms.amazonaws.com", # "route53.amazonaws.com", ] enabled_policy_types = [ # Add policy types you actually use, for example: # "SERVICE_CONTROL_POLICY", # "TAG_POLICY", # "BACKUP_POLICY", # "AISERVICES_OPT_OUT_POLICY", ] } ``` Enabling `feature_set = "ALL"` is a one‑way change in AWS Organizations and cannot be reverted to consolidated billing only; review before applying. Verification: `terraform plan` should show `feature_set` changing (or being created) with value `"ALL"` on `aws_organizations_organization.this` and no other unexpected changes.