Purpose of This Lesson

This lesson explains how AWS directory services connect users, applications, AWS accounts, and on-premises Microsoft Active Directory environments. The key assessment skill is recognizing whether a scenario requires a managed directory, a proxy to an existing directory, federated temporary credentials, or centralized single sign-on.

Key Concepts

AWS Managed Microsoft AD

AWS Managed Microsoft AD is a fully managed Microsoft Active Directory implementation running on Windows Server in AWS. AWS provides a highly available pair of domain controllers.

It can be used in two broad ways:

• As a standalone Active Directory in AWS, allowing EC2 instances and servers to join the domain.
• As a directory that establishes a one-way or two-way trust relationship with an on-premises Active Directory.

A connection to an on-premises environment requires network connectivity through a VPN or AWS Direct Connect. With a trust relationship, users and groups from either domain can access authorized resources in the other domain using single sign-on.

AWS Managed Microsoft AD supports features such as group policy, schema extensions, single sign-on to supported applications and services, and multi-factor authentication through RADIUS. It can also support synchronization and federation connectivity with Azure AD and Microsoft 365 using technologies such as Azure AD Sync and Active Directory Federation Services (ADFS).

The lecture identifies AWS Managed Microsoft AD as the preferred choice when an organization has more than 5,000 users or needs a trust relationship between AWS-hosted and on-premises Active Directory environments.

AD Connector

AD Connector is a directory gateway that redirects directory requests to an existing, self-managed on-premises Active Directory. It does not replace that directory with a new managed domain.

AD Connector requires VPN or Direct Connect connectivity to the on-premises directory. It can be used to:

• Authenticate to AWS applications such as Amazon WorkSpaces, WorkDocs, and WorkMail using on-premises credentials.
• Federate access to the AWS Management Console by mapping Active Directory identities to IAM roles.
• Join Windows EC2 instances to the on-premises Active Directory domain.

The lecture describes two sizes:

• Small: Organizations with up to 500 users.
• Large: Organizations with up to 5,000 users.

For environments larger than 5,000 users, or for scenarios requiring a managed directory and trust relationships, AWS Managed Microsoft AD is the more appropriate choice.

SAML 2.0 Federation

SAML 2.0 federation is commonly used when identities are stored in an enterprise identity system such as on-premises Active Directory. A typical flow is:

1. The user authenticates through an identity provider, such as ADFS.
2. ADFS returns a SAML assertion.
3. The application calls AWS Security Token Service using AssumeRoleWithSAML.
4. STS returns temporary AWS security credentials.
5. The application uses those credentials to access resources such as DynamoDB or other AWS services.

The decisive API action is AssumeRoleWithSAML. The application does not receive long-term AWS access keys; it receives temporary credentials associated with an IAM role.

Web Identity Federation

Web identity federation is designed for applications, especially mobile applications, that authenticate users through a social or OIDC-compatible identity provider. Examples mentioned in the lecture include Amazon, Google, and Facebook.

The flow is:

1. The user authenticates with the external identity provider.
2. The application presents the resulting identity information to AWS STS.
3. STS processes AssumeRoleWithWebIdentity.
4. STS returns temporary credentials.
5. The application uses those credentials to access AWS services such as DynamoDB.

AWS recommends Amazon Cognito for most web identity federation use cases. The older direct STS method remains a supported concept, but Cognito is generally the preferred AWS service for this pattern.

IAM Identity Center

IAM Identity Center is the successor to AWS Single Sign-On (AWS SSO). References to AWS SSO and IAM Identity Center describe the same service and should be interpreted accordingly.

IAM Identity Center provides centralized permissions management and single sign-on across AWS accounts and supported applications. Its identity source can be:

• The built-in IAM Identity Center directory.
• An on-premises Microsoft Active Directory connected through AD Connector or AWS Managed Microsoft AD.
• Another standard identity provider using SAML 2.0, such as Azure AD.

IAM Identity Center can provide access to AWS accounts through AWS Organizations or through direct account connections. It also offers built-in SSO integrations for business applications such as GoToMeeting, Microsoft 365, Confluence, and G Suite.

Directory and Federation Architecture Decisions

Choosing AWS Managed Microsoft AD versus AD Connector

Choose AWS Managed Microsoft AD when AWS should host and operate the Microsoft Active Directory domain, when a standalone directory is needed in AWS, when a trust relationship is required, or when the organization exceeds the AD Connector sizing guidance.

Choose AD Connector when the organization already has an on-premises Active Directory and wants AWS applications or EC2 instances to use that existing directory without creating a separate managed domain. Connectivity to the existing directory remains essential.

Choosing SAML versus Web Identity Federation

Choose SAML 2.0 federation when an enterprise identity provider such as ADFS authenticates users from an Active Directory-based identity store and the application needs temporary AWS credentials through AssumeRoleWithSAML.

Choose web identity federation when an application, commonly a mobile app, authenticates users through a social or OIDC-compatible provider and then calls AssumeRoleWithWebIdentity. For most AWS implementations, evaluate Amazon Cognito as the preferred approach.

Choosing IAM Identity Center

Choose IAM Identity Center when the primary requirement is centralized user access and single sign-on across multiple AWS accounts, directories, or supported business applications. It can consume identities from its own directory, Active Directory, or a SAML 2.0 identity provider.

Exam- or Assessment-Relevant Takeaways

• AWS Managed Microsoft AD is a managed Microsoft Active Directory service with a highly available pair of domain controllers.
• A VPN or Direct Connect connection is required for integration with on-premises Active Directory.
• Managed Microsoft AD is the stronger fit for more than 5,000 users or for Active Directory trust relationships.
• AD Connector redirects requests to an existing on-premises directory; it is not a replacement directory.
• AD Connector supports small deployments up to 500 users and large deployments up to 5,000 users according to the lecture.
• AssumeRoleWithSAML identifies SAML 2.0 federation.
• AssumeRoleWithWebIdentity identifies web identity federation.
• SAML federation is associated with enterprise identity providers such as ADFS; web identity federation is associated with mobile applications and social or OIDC providers.
• AWS recommends Cognito for most web identity federation scenarios.
• IAM Identity Center is the current name for AWS SSO and provides centralized permissions management and single sign-on.
• Federation and IAM Identity Center workflows provide temporary or centrally managed access rather than requiring users to maintain long-term AWS access keys.

Tool / Feature Decision Guide

Requirement	Best-fit service or feature	Decisive reason
Host a Microsoft Active Directory domain in AWS	AWS Managed Microsoft AD	AWS operates a managed, highly available Microsoft AD environment.
Trust an AWS directory with on-premises AD	AWS Managed Microsoft AD	It supports trust relationships, with VPN or Direct Connect connectivity.
Use an existing on-premises AD without creating a new domain in AWS	AD Connector	It redirects directory requests to the existing directory.
Authenticate to WorkSpaces, WorkDocs, or WorkMail with corporate AD credentials	AD Connector or AWS Managed Microsoft AD, depending on directory architecture	These services can use AWS Directory Service authentication.
Enterprise application access using ADFS and an Active Directory identity	SAML 2.0 federation	The flow uses a SAML assertion and AssumeRoleWithSAML.
Mobile application access using Google, Facebook, Amazon, or OIDC	Web identity federation, preferably through Cognito	The application exchanges external identity information for temporary AWS credentials.
Centralized SSO across AWS accounts and business applications	IAM Identity Center	It centralizes permissions and integrates with multiple identity sources.

Common Traps / Misconceptions

• Treating AD Connector as a managed Active Directory: AD Connector is a gateway to an existing on-premises directory. It does not provide a new standalone domain.
• Forgetting network connectivity: Integration with on-premises Active Directory requires VPN or Direct Connect.
• Confusing the STS API actions: AssumeRoleWithSAML is for SAML federation, while AssumeRoleWithWebIdentity is for web identity federation.
• Using SAML and web identity interchangeably: SAML is associated with enterprise identity providers such as ADFS; web identity federation is associated with social or OIDC providers and application scenarios.
• Ignoring Cognito: Direct web identity federation is supported, but AWS recommends Cognito for most web identity federation cases.
• Assuming AWS SSO is a different service: AWS SSO is the former name for IAM Identity Center.
• Selecting AD Connector for a trust relationship: Trust relationships and a managed AWS-hosted AD point toward AWS Managed Microsoft AD instead.
• Assuming federation produces permanent credentials: The described federation flows use AWS STS to issue temporary security credentials.

Real-World Engineer / Analyst Notes

• Start directory design by identifying where the authoritative identities live: on-premises Active Directory, a cloud directory, IAM Identity Center, or an external SAML/OIDC provider.
• Separate authentication from authorization. The identity provider authenticates the user, while IAM roles and permissions determine what the resulting AWS session can do.
• Confirm network paths before troubleshooting directory authentication. A correct trust or connector configuration cannot work if VPN or Direct Connect connectivity is unavailable.
• For application architectures, prefer temporary STS credentials over embedding long-term AWS credentials in mobile or application code.
• When several AWS accounts and SaaS applications are involved, IAM Identity Center can reduce duplicated account-by-account sign-in configuration.
• Use the user population and the need for trust relationships as early filters when comparing AD Connector with AWS Managed Microsoft AD.

Quick Reference Summary

• AWS Managed Microsoft AD: Managed Microsoft AD in AWS; supports standalone use, group policy, schema extensions, RADIUS MFA, and trust relationships.
• AD Connector: Proxy or gateway to an existing on-premises AD; supports AWS application authentication and EC2 domain joining.
• SAML 2.0: Enterprise federation pattern using ADFS or another identity provider and AssumeRoleWithSAML.
• Web identity federation: Application or mobile pattern using social/OIDC identities and AssumeRoleWithWebIdentity.
• Amazon Cognito: AWS-recommended choice for most web identity federation implementations.
• IAM Identity Center: Formerly AWS SSO; centralizes permissions and SSO across AWS accounts and supported applications.
• Required hybrid connectivity: VPN or Direct Connect for on-premises directory integration.

Flashcards

Q: An organization has an existing on-premises Active Directory and wants WorkSpaces users to authenticate with their corporate credentials without deploying a new directory in AWS. Which service fits best?

A: AD Connector, because it redirects authentication requests to the existing on-premises Active Directory. VPN or Direct Connect connectivity is required.

Q: When should AWS Managed Microsoft AD generally be selected instead of AD Connector?

A: Select Managed Microsoft AD when AWS should host the directory, when a standalone AWS directory is needed, when a trust relationship is required, or when the organization is larger than the AD Connector sizing guidance.

Q: What does AD Connector do with directory requests?

A: It redirects them to the organization’s existing on-premises Active Directory rather than creating or replacing that directory.

Q: A SAML assertion from ADFS must be exchanged for temporary AWS credentials. Which STS API action is used?

A: AssumeRoleWithSAML. The returned temporary credentials are associated with an IAM role.

Q: A mobile application authenticates users through Google and then needs access to DynamoDB. Which federation pattern is relevant?

A: Web identity federation, typically implemented through Amazon Cognito. The direct STS action associated with the pattern is AssumeRoleWithWebIdentity.

Q: What is the key difference between SAML federation and web identity federation in the described architectures?

A: SAML federation commonly uses an enterprise identity provider such as ADFS, while web identity federation commonly uses social or OIDC providers for application or mobile access.

Q: Which AWS service is recommended for most web identity federation implementations?

A: Amazon Cognito. It is the preferred AWS approach even though direct web identity federation is supported.

Q: What is the current name for AWS Single Sign-On?

A: IAM Identity Center. AWS SSO is the former name for the same service.

Q: A company wants centralized SSO across multiple AWS accounts and supported business applications. Which service should be evaluated first?

A: IAM Identity Center, because it centralizes permissions management and SSO and can integrate with AWS Organizations, directories, and SAML identity providers.

Q: What connectivity is required to integrate AWS directory services with an on-premises Active Directory?

A: A VPN or AWS Direct Connect connection is required for the described hybrid integration scenarios.

Q: What is the significance of the AssumeRoleWithWebIdentity API action in a question?

A: It indicates web identity federation, where an external social or OIDC identity is exchanged for temporary AWS credentials.

Q: An organization needs a trust relationship between its on-premises Active Directory and an AWS-hosted Microsoft AD, including access by users from either domain. Which service is the better fit?

A: AWS Managed Microsoft AD, because it supports trust relationships and single sign-on between domains when the environments are connected.

Practice Questions

Question 1

A company has 8,000 users in an on-premises Microsoft Active Directory. It wants a trust relationship with a Microsoft AD domain hosted in AWS. Which option best fits the stated requirements?

A. AD Connector small
B. AD Connector large
C. AWS Managed Microsoft AD
D. Web identity federation

Correct answer: C. AWS Managed Microsoft AD

The decisive clues are the population exceeding 5,000 users and the requirement for a trust relationship. The lecture identifies Managed Microsoft AD as the better choice for this scenario.

Question 2

A mobile application allows users to sign in with Google. After authentication, the application must access a DynamoDB table without storing long-term AWS credentials. Which approach is most appropriate?

A. ADFS with AssumeRoleWithSAML
B. Web identity federation, preferably using Amazon Cognito
C. AD Connector with a two-way trust
D. IAM Identity Center connected only to the built-in directory

Correct answer: B. Web identity federation, preferably using Amazon Cognito

The social identity provider and mobile application indicate web identity federation. The lecture specifically recommends Cognito for most implementations and describes temporary credentials for DynamoDB access.

Question 3

An enterprise application uses ADFS to authenticate an on-premises Active Directory user. The application then needs temporary permissions to read AWS data. Which sequence is correct?

A. ADFS returns a SAML assertion, then STS processes AssumeRoleWithSAML
B. ADFS returns an OIDC token, then STS processes AssumeRoleWithWebIdentity
C. AD Connector creates permanent IAM access keys for the user
D. IAM Identity Center replaces ADFS and removes the need for an IAM role

Correct answer: A. ADFS returns a SAML assertion, then STS processes AssumeRoleWithSAML

The identity provider and SAML assertion identify SAML federation. STS then returns temporary credentials associated with the assumed IAM role.

Question 4

An organization wants one sign-in experience for several AWS accounts and applications such as Microsoft 365 and Confluence. Its users may come from Active Directory or a SAML 2.0 provider. Which service is the best match?

A. IAM Identity Center
B. AD Connector small
C. AWS STS only
D. A standalone EC2 domain controller

Correct answer: A. IAM Identity Center

IAM Identity Center provides centralized permissions management and SSO across AWS accounts and supported applications, with support for multiple identity sources.

WordPress Metadata

Suggested Slug:
aws-directory-services-federation-soa-c03

Meta Description:
Study AWS Managed Microsoft AD, AD Connector, SAML and web identity federation, and IAM Identity Center for CloudOps security and compliance scenarios.

Tags:
AWS, AWS Certified CloudOps Engineer, Directory Services, AWS Managed Microsoft AD, AD Connector, IAM Identity Center, Identity Federation, SAML 2.0, Web Identity Federation, AWS STS, Active Directory, Single Sign-On