This document discusses automating the deployment of Active Directory on AWS using infrastructure as code tools like Packer, Terraform, and Chocolatey. It provides an overview of setting up a VPC, customizing an AMI with Packer, and deploying Active Directory domains and domain controllers with Terraform. Methodologies for automating builds, deployments, and provisioning are also covered.

1. Automation of Active
Directory’s Deployments
on AWS

2. @JeremieRodon
jeremie.rodon@d2-si.eu

3. Sommaire
1
Live Build:
▪ VPC from scratch
▪ NAT instance and Bastion
▪ Custom AMI 2016 Core
▪ Active Directory
2 Methodology
3 Tools

4. D2SI
AUTOMATION DEAUTOMATION
CLOUD
CONTINUOUS DEPLOYMENT
INFRA AS CODE
RUNBOOK AUTOMATION
AGILITY
DEVOPS
INNOVATION
KNOWLEDGE
BOOK : THE RISE OF AUTOMATION
AUTOMATION TRAINING
PARIS AWS USER GROUP
DEAUTOMATION PUBLICATIONS
GAMEDAY & BYOP
HUMAN OPS & RESPONSIVE ORGANISATION

5. Launch DEMO

6. First Step: VPC
Infrastructure As Code

7. Second Step: custom AMI with Packer
Automation

8. Third Step: Active Directory
Infrastructure As Code + Automation

9. Methodology
Automate
Build
Deploy
Context
Provision
Anywhere
Run
Everywhere

10. Methodology

11. Tools

12. Big Picture

13. Packer configuration file

14. Packer : Variables
- Declared at the beginning of the main JSON
- 3 ways of giving their value (in order of
increasing priority):
- default value in the declaration
- separated parameter file
- “-var var=value” on packer command line

15. Packer : Builders
- Second part of the main JSON file
- Describe how packer should build:
- Is it AWS ? Azure ? VMWare ?
- What kind of instance/VM ?
- Which VPC ? Subnet ? SGs ?
- What about the result ? Name ? Tags ?

16. Packer : Provisioners
- Third and last part of the main JSON file
- Describe what packer should do in the build:
- Launch a script ? With ENV VARS ?
- Copy a file ?
- Code inline ?
- Reboot ?
- Provisioners are played in order of
declaration

17. Packer : How we do it ?
- Trying to keep packer JSON files as static as
possible
- Most of the magic is done by Powershell
scripts
- Of course we rely big time on Chocolatey

18. Chocolatey
• A Package Manager compatible with
Windows systems.
• Similar to apt-get, yum or pacman
• Can manage dependencies between
packages
• Can be use simply to execute scripts once

19. Package Chocolatey

20. Terraform
• IaC - Infrastructure As Code
• Based on blocks : Resource, Data, Module
• Really up-to-date
• Can easily build upon existing infra (Data blocks)
• Can take over management of existing infra
(importation)

21. Terraform
module "Create_AD" {
source = "......ModulesMicrosoft_Instance«
region = "${var.region}«
key_name = "${var.key_name}«
iam_instance_profile = "packer-builder"
ami= "${var.ami}" instance_type = "t2.small"
rootVolume_size = "30"
volume_type = "gp2"
vpc_security_group_ids = "${aws_security_group.sg_dcs.id}
subnet_id = "${data.terraform_remote_state.vpc.private_subnets_id[0]}«
Tag_Dependency = "ON«
Tag_Application = "Active Directory«
Tag_Role = "Domain Controller"
Available_Name = "${var.environment}-${var.stack}-DC01"
Vendor = "Microsoft"
Product = "ADDS"
Action = "CreateNewForest"
Environment = "${var.environment}"
BootstrapPrefix = "bootstrap"
SetupScripts = "win_userdata"
}
resource "null_resource" "Wait_Dependency" {
provisioner "local-exec" {
command = "powershell.exe -file ......filesWait_Dependency.ps1"
}
depends_on = ["module.Create_AD"]}
module "Join_AD" { source = "......ModulesMicrosoft_Instance"
region = "${var.region}"
key_name = "${var.key_name}"
iam_instance_profile = "packer-builder"
ami= "${var.ami}"
instance_type = "t2.small"
rootVolume_size = "30"
volume_type = "gp2"
vpc_security_group_ids = "${aws_security_group.sg_dcs.id}"
subnet_id = "${data.terraform_remote_state.vpc.private_subnets_id[1]}"
private_ip = ""
Tag_Application = "Active Directory"
Tag_Role = "Domain Controller"
depends_id = "${null_resource.Wait_Dependency.id}"
Available_Name = "${var.environment}-${var.stack}-DC02"
Vendor = "Microsoft"
Product = "ADDS" Action = "AddNewDC"
Environment = "${var.environment}"
BootstrapPrefix = "bootstrap"
SetupScripts = "win_userdata"}
resource "aws_vpc_dhcp_options" "dns_resolver" {
domain_name_servers =
["${module.Create_AD.private_ip}","${module.Join_AD.private_ip}"]}
resource "aws_vpc_dhcp_options_association" "dns_resolver" {
vpc_id = "${data.terraform_remote_state.vpc.vpc_id}"
dhcp_options_id = "${aws_vpc_dhcp_options.dns_resolver.id}"}

22. Orchestration
?DC02
TDAY.LAN
DC01

23. Results !

25. Bienvenue
Julien BICHON
julien.bichon@d2-si.eu
06.30.40.75.67
Proposez nous vos talks et les sujets que vous souhaitez aborder !

26. D2SI
Toulouse

27. AWSome Day Toulouse
Le 8 juin 2018 - @Home
https://aws.amazon.com/fr/awsomeday/toulouse/