Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Directory Service provides several ways to use directory-based authentication and authorization with AWS workloads. The correct option depends primarily on whether AWS should host the directory, whether an existing on-premises Microsoft Active Directory must remain authoritative, and which Active Directory features the workload requires.
The three options covered here are:
- AWS Managed Microsoft AD: A managed, Microsoft-compatible Active Directory hosted in AWS.
- AD Connector: A proxy that forwards directory requests to an existing on-premises Active Directory.
- Simple AD: A lower-cost, Samba-based directory with a smaller feature set.
Key Concepts
AWS Managed Microsoft AD
AWS Managed Microsoft AD is a managed Microsoft Active Directory deployment based on Windows Server domain controllers. AWS provisions and operates the directory infrastructure, while administrators manage directory objects, users, groups, policies, and domain configuration.
Important characteristics include:
- A highly available deployment using domain controllers in separate Availability Zones.
- Replication of directory data between the domain controllers.
- Support for standard Microsoft Active Directory capabilities, including:
- Kerberos authentication
- LDAP
- NTLM
- Group Policy
- Organizational Units
- Domain trust relationships
- Support for one-way or two-way trusts with an existing self-managed Active Directory, when hybrid identity is required.
- Ability to domain-join Windows and Linux EC2 instances and integrate with supported AWS services such as Amazon FSx, Amazon RDS for SQL Server, and Amazon WorkSpaces.
- Optional integration patterns involving federation or directory synchronization, depending on the organization’s identity architecture.
- Support for MFA through RADIUS for applicable directory-integrated use cases.
Managed Microsoft AD is usually the best fit when applications require genuine Microsoft Active Directory behavior or when AWS must host a directory that can operate independently while still supporting integration with an existing corporate directory.
AD Connector
AD Connector is not an Active Directory implementation in AWS. It is a managed proxy that forwards authentication and directory requests to an existing on-premises Active Directory over a private network connection such as AWS Site-to-Site VPN or AWS Direct Connect.
Key properties include:
- No directory database or user replication into AWS.
- On-premises Active Directory remains the source of truth.
- Requires reliable network connectivity between AWS and the on-premises directory.
- Can support authentication for services such as Amazon WorkSpaces, Amazon FSx, and applicable EC2 workloads.
- Can support federated access to the AWS Management Console by mapping directory identities to IAM roles.
- Can help domain-join Windows EC2 instances to the existing Active Directory environment.
- Deployed redundantly across two subnets for availability.
- Available in directory sizes intended for smaller or larger user populations.
AD Connector is appropriate when an organization wants to use its existing Active Directory without creating a replicated directory in AWS. It is not the right choice when AWS workloads must continue authenticating during a complete loss of connectivity to the on-premises directory.
Simple AD
Simple AD is a lightweight, Samba-based directory service hosted in AWS. It provides a subset of common directory functionality at a lower cost, but it is not a full replacement for Microsoft Active Directory.
It supports capabilities such as:
- LDAP
- Kerberos
- NTLM
- Basic group policy functionality
- Authentication for selected small-scale AWS workloads, including some EC2 and WorkSpaces scenarios
Simple AD does not provide the full range of advanced Microsoft Active Directory features and does not support trust relationships with on-premises Active Directory in the way Managed Microsoft AD does.
It is best suited to small applications that need basic directory services but do not require advanced Microsoft-specific features, complex hybrid integration, or a full enterprise Active Directory implementation.
Trusts, Replication, and Proxying
These three concepts distinguish the directory options:
| Capability | Managed Microsoft AD | AD Connector | Simple AD |
|---|---|---|---|
| Directory hosted in AWS | Yes | No; proxies to on-premises AD | Yes |
| Directory data replicated to AWS | Yes, within the managed directory | No | Yes, within the Simple AD deployment |
| Full Microsoft AD feature set | Broad support | Uses the on-premises AD feature set | No |
| Trust relationship with on-premises AD | Supported | Not required; directly uses on-premises AD | Not supported in the same enterprise trust model |
| Requires private connectivity to on-premises AD | Only for hybrid trust or integration scenarios | Yes | No, for standalone operation |
| Group Policy | Supported | Provided by the connected on-premises AD | Basic support only |
| Typical purpose | Managed enterprise AD in AWS | Use existing on-premises AD without replication | Low-cost, limited directory needs |
Exam-Relevant Takeaways
- Choose Managed Microsoft AD when the workload requires Microsoft Active Directory features such as Group Policy, organizational units, Kerberos, domain trusts, or enterprise Windows integration.
- Choose AD Connector when the organization must keep all directory identities and directory data on premises and only needs AWS to forward authentication requests.
- Choose Simple AD for basic, standalone directory needs where advanced Microsoft AD compatibility is unnecessary.
- AD Connector depends on the availability of the network path and the on-premises domain controllers. It does not provide an independent cloud directory.
- Managed Microsoft AD provides high availability through domain controllers distributed across Availability Zones and replicates directory data between them.
- A lower price does not make Simple AD a drop-in replacement for Microsoft Active Directory. Feature compatibility should drive the decision.
- A trust relationship is different from synchronization. A trust allows directories to authenticate or authorize users across domain boundaries; synchronization copies identity information between systems.
- Directory services do not replace IAM. AWS account and resource permissions still require IAM policies, roles, permission boundaries, or AWS IAM Identity Center as appropriate.
Architecture Decision Guide
| Requirement | Recommended option | Reason |
|---|---|---|
| Run a managed, full-featured Microsoft-compatible directory in AWS | Managed Microsoft AD | Provides domain controllers, replication, Group Policy, and enterprise AD capabilities |
| Extend an existing on-premises AD to AWS without copying users into AWS | AD Connector | Proxies requests to the existing directory |
| Maintain authentication if the private connection to on premises is unavailable | Managed Microsoft AD or another independent cloud identity design | AD Connector cannot authenticate independently of the on-premises directory |
| Establish a trust with an existing corporate AD | Managed Microsoft AD | Supports one-way and two-way trust relationships |
| Support a small standalone application with basic directory requirements | Simple AD | Lower-cost directory with limited functionality |
| Use advanced Microsoft AD administration and policy features | Managed Microsoft AD | Simple AD does not provide full Microsoft AD functionality |
| Authenticate WorkSpaces or other supported AWS services using existing corporate identities | AD Connector | Uses the on-premises directory as the identity source |
| Avoid replicating directory data into AWS for compliance reasons | AD Connector | Authentication requests are forwarded rather than synchronized |
Common Exam Traps
- Confusing AD Connector with a managed directory: AD Connector does not store a replicated copy of the directory in AWS.
- Assuming AD Connector removes the need for connectivity: It requires network access to on-premises domain controllers. VPN or Direct Connect design, DNS, routing, and firewall rules are operational dependencies.
- Selecting Simple AD for a feature-heavy Windows environment: Simple AD is not intended for workloads requiring the full Microsoft AD feature set or enterprise trust relationships.
- Treating Managed Microsoft AD as automatically connected to on-premises AD: A hybrid relationship requires deliberate trust and network configuration.
- Assuming directory authentication grants AWS permissions: A user successfully authenticating through a directory still needs an appropriate IAM role or service-specific authorization.
- Equating high availability with disaster recovery: Multi-AZ domain controllers improve availability within the deployment, but broader recovery requirements may require additional planning.
- Ignoring DNS requirements: Active Directory depends heavily on correct DNS resolution. Incorrect DHCP options, routing, security groups, or DNS forwarding can break domain joins and authentication.
Real-World Engineer Notes
- Place directory endpoints and dependent workloads in subnets with suitable routing and security controls. Validate DNS resolution before troubleshooting domain joins.
- For AD Connector, monitor the private connection, on-premises domain controller health, and latency. A highly available connector does not compensate for an unavailable corporate directory.
- Use Managed Microsoft AD when cloud workloads need an autonomous directory boundary, but define how users, groups, trusts, and administrative responsibilities will be governed.
- Minimize network exposure. Directory protocols such as LDAP, Kerberos, DNS, and SMB should be permitted only where required between trusted systems.
- Separate authentication design from authorization design. Directory groups may be mapped to application roles or IAM roles, but those mappings must be explicitly configured and reviewed.
- Evaluate licensing, operational ownership, compliance, and recovery requirements in addition to the directory service price.
Quick Reference Summary
- Managed Microsoft AD: Managed Microsoft Active Directory in AWS; supports replication, Group Policy, organizational units, and trust relationships.
- AD Connector: Proxy to an existing on-premises AD; no directory replication into AWS; requires private network connectivity.
- Simple AD: Lightweight Samba-based directory; lower cost and fewer enterprise features.
- Need a trust? Consider Managed Microsoft AD.
- Need to keep all identities on premises? Consider AD Connector.
- Need only basic, standalone directory capabilities? Consider Simple AD.
- Need independent cloud authentication? Do not choose AD Connector as the sole directory dependency.
Flashcards
- Q: What is AWS Managed Microsoft AD?
A: A managed Microsoft Active Directory deployment in AWS with domain controllers, replication, Group Policy, organizational units, and support for trust relationships.
- Q: Does AD Connector replicate directory users into AWS?
A: No. It forwards authentication and directory requests to the existing on-premises Active Directory.
- Q: What is the main dependency of AD Connector?
A: Reliable private connectivity to the on-premises Active Directory and its domain controllers.
- Q: Which AWS Directory Service option supports trusts with an on-premises Microsoft AD?
A: AWS Managed Microsoft AD.
- Q: What is Simple AD based on?
A: Samba, providing a lightweight directory with a subset of Microsoft AD functionality.
- Q: Which option is most appropriate when user data must remain on premises?
A: AD Connector, provided the AWS environment has reliable connectivity to the on-premises directory.
- Q: Why might Simple AD be unsuitable for an enterprise Windows workload?
A: It lacks advanced Microsoft Active Directory features and enterprise trust capabilities.
- Q: Does successful directory authentication automatically authorize access to AWS resources?
A: No. IAM roles and policies or service-specific authorization still determine AWS access.
- Q: How does Managed Microsoft AD improve availability?
A: It uses domain controllers distributed across Availability Zones with directory replication between them.
- Q: What is the key architectural difference between AD Connector and Managed Microsoft AD?
A: Managed Microsoft AD hosts a directory in AWS; AD Connector acts as a proxy to a directory hosted elsewhere.
Practice Questions
Question 1
A company is migrating Windows applications to EC2. The applications require Group Policy, organizational units, Kerberos authentication, and a two-way trust with the company’s existing on-premises Active Directory. The company wants AWS to operate the directory infrastructure.
Which solution best meets these requirements?
Correct answer: AWS Managed Microsoft AD
Explanation: Managed Microsoft AD provides Microsoft-compatible directory functionality in AWS, including Group Policy, organizational units, and trust relationships. AD Connector would use the existing on-premises directory rather than host an independent directory in AWS, while Simple AD lacks the required advanced capabilities.
Question 2
A regulated company wants Amazon WorkSpaces users to authenticate against its existing on-premises Active Directory. The company prohibits copying directory users or directory data into AWS and has a redundant Direct Connect design.
Which service should the company use?
Correct answer: AD Connector
Explanation: AD Connector forwards authentication requests to the on-premises directory without replicating directory data into AWS. The private connectivity design is essential because AD Connector depends on reaching the on-premises domain controllers.
Question 3
A development team needs a low-cost directory for a small, standalone application running in AWS. The application requires basic LDAP and Kerberos authentication but does not require domain trusts, advanced Group Policy, or full Microsoft Active Directory compatibility.
Which option is most appropriate?
Correct answer: Simple AD
Explanation: Simple AD provides basic directory capabilities at a lower cost and is suitable for small standalone workloads that do not need advanced Microsoft AD features.
Question 4
An organization deploys AD Connector for an application in AWS. During an outage, the VPN to the corporate data center becomes unavailable. Users can no longer authenticate to the application.
Why did this occur?
Correct answer: AD Connector requires access to the on-premises Active Directory for authentication
Explanation: AD Connector does not contain a replicated directory database and cannot independently authenticate users when the network path or on-premises directory is unavailable. An independent managed directory would be required for cloud-side authentication continuity.
Question 5
An architect recommends Simple AD for a workload that must establish a trust relationship with the company’s existing Microsoft Active Directory and enforce complex domain-wide Group Policy settings.
What is the primary problem with this recommendation?
Correct answer: Simple AD does not provide the required advanced Microsoft Active Directory and trust capabilities
Explanation: Simple AD is a lightweight Samba-based directory. The workload should use Managed Microsoft AD, or continue using the existing directory through an appropriate hybrid design, depending on where the directory must remain authoritative.