AWS Directory Service
Using Microsoft Active Directory with AWS: AWS Managed Microsoft AD with domain controllers across Availability Zones and trusts with on-premises AD, AD Connector as a proxy to your existing AD, Simple AD and its closure to new customers, seamless domain join, and how Directory Service works with IAM Identity Center.
4 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Directory Service provides several ways to use Microsoft Active Directory (AD) with AWS services. It is for workloads and services that need AD or LDAP (Lightweight Directory Access Protocol)A protocol for reading and updating a directory, such as the users and groups in Microsoft Active Directory. Applications use it to look up and authenticate users.Glossary entry: Windows servers that join a domain, AD-aware applications such as SharePoint and SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry Server, and AWS services such as Amazon WorkSpaces and Amazon Quick that authenticate users against AD.
Choose Directory Service when a question mentions Active Directory: running a managed AD in AWS, using existing On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry AD credentials with AWS services, or joining EC2 Windows instances to a domain.
Directory options
| Option | What it is | Choose when |
|---|---|---|
| AWS Managed Microsoft AD | An actual Microsoft Windows Server Active Directory, managed by AWS. It creates a HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry pair of domain controllers in different AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry in your VPC | You need a real AD in AWS for AD-aware apps such as SharePoint, SQL Server Always On, and .NET apps, or a trust with on-premises AD |
| AD Connector | A proxy that forwards sign-in requests to your existing on-premises AD, with no directory synchronization and no federation infrastructure to host | Users keep their on-premises AD credentials for services such as WorkSpaces and Amazon Quick, and for console sign-in |
| Simple AD | A standalone directory powered by Samba 4, AD-compatible with a subset of features | No longer open to new customers; use AWS Managed Microsoft AD or AD Connector instead |
- Trusts: AWS Managed Microsoft AD can establish trust relationships with your self-managed (on-premises) AD, so users from either domain can access resources in the other.
- Seamless domain join: join EC2 Windows instances to the domain automatically, including to your on-premises domain through AD Connector.
- IAM Identity Center can use AWS Managed Microsoft AD, or on-premises AD through AD Connector, as its identity source. Both must be in the Organizations management account.
Security, resilience, performance, and cost
- Security: directories run in your VPC; control access with Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry and AD group policies. Both AWS Managed Microsoft AD and AD Connector support MFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entry.
- Resilience: AWS Managed Microsoft AD runs domain controllers in two Availability Zones, and AWS manages host monitoring, recovery, data replication, snapshots, and software updates. Multi-AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry replication extends a directory to other Regions.
- Cost: pay per directory per hour. AWS Managed Microsoft AD comes in Standard, Enterprise, and Hybrid editions.
Directory Service or another option?
| If the requirement is | Choose |
|---|---|
| Managed Microsoft AD in AWS for AD-aware applications | AWS Managed Microsoft AD |
| Use on-premises AD credentials with AWS services, nothing stored in AWS | AD Connector |
| Trust between AWS and on-premises domains | AWS Managed Microsoft AD with a trust |
| Employees sign in to AWS accounts with AD credentials | IAM Identity Center with AD as the identity source |
| Customer identities for an app | Amazon Cognito |
Reverse mindmap: when the question points here
- Yes, when the question says
- Managed Active Directory in AWS leads to AWS Managed Microsoft AD
- SharePoint or SQL Server needs AD leads to AWS Managed Microsoft AD
- Trust with the on-premises domain leads to Managed Microsoft AD trust
- Use existing AD credentials, no directory sync leads to AD Connector
- WorkSpaces users sign in with corporate AD leads to AD Connector or Managed AD
- Join EC2 Windows instances to the domain leads to Seamless domain join
- Know the status
- Simple AD leads to Closed to new customers
- No, when the question says
- App customers sign in leads to Cognito
Key takeaways
- Directory Service brings Microsoft Active Directory to AWS.
- AWS Managed Microsoft AD is a real Windows AD with domain controllers in two Availability Zones and supports trusts with on-premises AD.
- AD Connector proxies authentication to your existing AD without synchronization.
- Simple AD is closed to new customers.
- IAM Identity Center can use Managed AD or AD Connector as its identity source.
Sources
- AWS Directory Service Administration Guide: What is AWS Directory Service?
- AWS Directory Service Administration Guide: AWS Managed Microsoft AD
- AWS Directory Service Administration Guide: Creating a trust relationship with self-managed AD
- AWS Directory Service Administration Guide: AD Connector
- AWS Directory Service Administration Guide: Simple AD
- AWS Directory Service Administration Guide: Simple AD availability changes
- IAM Identity Center User Guide: Microsoft AD directory
- AWS Directory Service Administration Guide: Configure Multi-Region replication
- AWS Directory Service Administration Guide: MFA for AWS Managed Microsoft AD
- AWS Directory Service Administration Guide: MFA for AD Connector
- AWS Directory Service pricing