This document describes how to set up AWS Managed Microsoft Active Directory (AD) to connect an on-premises AD to the cloud. It involves creating an AWS Directory Service for Microsoft AD in a VPC with domains controllers in two availability zones for high availability. The AWS-managed AD can then be joined to the on-premises AD by creating a trust relationship between the two forests. This allows users in the on-premises AD to access AWS resources and applications that are connected to the cloud-based AD. The document provides details on directory structure, access control, and best practices for the setup.

1. AWS – Managed Microsoft AD for SAFE to connect to On-Premises AD

2. VPC
AWS Cloud – SAFE
Availability Zone 1 Availability Zone 2
Seamless Domain Join
Instance
Amazon EC2 Auto
Scaling
SAFE Users
Private subnet
Corporate
data center
AWS Direct Connect
Elastic Load
Balancing
Private subnet
On-Premises ADEC2 InstancesEC2 Instances
EC2 Instances
Internet
gateway Internet
SAFE AWS Architecture in a VPC in a Region – with Managed MS AD.
AWS Managed Microsoft AD

3. AWS Directory Service for Microsoft Active Directory:
(also known as AWS Managed Microsoft AD)
Shared responsibilities

4. • MS AD Deployed in a VPC.
• 2 DCs each in separate Availability Zones (AZs).
• Scale-out with additional DCs, VPCs and Regions.

5. AWS Managed Microsoft AD: Shared Responsibilities:
Amazon—operates
• Multi-AZ deployment, patch, monitor, DC recovery, snapshot, restore
Customer—administers
• Configure password policies
• Configure trusts (resource forest deployment)
• Configure certificate authorities (for LDAPS)
• Configure federation
• Administer users, groups, GPOs, other AD content
• Administration via Active Directory Users and Computers (ADUC) and other
standard AD tools
• Add domain controllers as needed

6. AWS Managed Microsoft AD: Two Editions:

7. Prerequisites needed:
• Virtual Private Cloud (VPC)
• Two subnets in different AZs
• Optional on-premises link
• Virtual Private Network (VPN)
• Amazon Direct Connect

8. Expending On-Premises AD to AWS:

9. Enable the firewall as below at On-Premises:

10. Created AWS MS AD:

11. MS AD created on AWS:

12. AWS DNS name and IP addresses of master servers on the AWS
MS AD:

13. Add trust relationship on MS AD:

14. Configure On-Premises details on MS AD:

15. Configure IP of On-Premises as Conditional forwarder:

16. Share this directory with other AWS accounts to extend user
access to your AWS applications and services:

17. Application Management – Enable all AWS applications and
services that are available to users in this directory:

18. Trust - Forest trusts:
• Time tested, secure model
• The trusting forest has no admin control over the trusted forest
• Trusted users have cloud resource access, but only if entitled by
trusting admins (you control both sides)
• Cloud identities have no access to on-premises resources unless:
1.On-premises trusts the cloud AND
2.On-premises admins grant permissions to identities in the
cloud

20. Securing trusts:
• Leave SID (Security IDentifier) filtering on (Windows default).
(Sid (Statement ID) value is just a sub-ID of the policy document's ID)
• Use selective authentication (on-premises side of trust)
• Don’t grant AD groups from the cloud access to on premises
resources
• Open only ports for AD trust communications between DCs.
• Open ports for AD authentication from cloud to on-premises AD;
minimize all other ports from cloud to on premises.

21. Best Practice After Creation:
• DHCP option sets.
(Domain names resolution)
• AWS security group
• IAM role/ policy for EC2
(AmazonEC2RoleforSSM)
• Key-pair (PEM) file
• EC2 Windows
(Install AD Administration Tools
to manage the AD
Service account)

22. AWS Managed Microsoft AD as a Resource Directory - MS AD
used my the multiple AWS applications:

23. VPC and Account Considerations: Multiple VPC’s connected
through VPC Peering.

24. Appendix:
Step 1: Prepare Your On-Premises Domain
https://docs.aws.amazon.com/directoryservice/latest/admin-
guide/ms_ad_tutorial_setup_trust_prepare_onprem.html
Step 2: Prepare Your AWS Managed Microsoft AD
https://docs.aws.amazon.com/directoryservice/latest/admin-
guide/ms_ad_tutorial_setup_trust_prepare_mad.html
Step 3: Create the Trust Relationship
https://docs.aws.amazon.com/directoryservice/latest/admin-
guide/ms_ad_tutorial_setup_trust_create.html

25. Tutorial: Setting Up Your Base AWS Managed Microsoft AD Test
Lab in AWS:
https://docs.aws.amazon.com/directoryservice/latest/admin-
guide/ms_ad_tutorial_test_lab_base.html