Study guide
Technical reference and lesson notes
This lesson covers the main AWS Directory Service options used to provide directory-based authentication and identity integration inside AWS. For the AWS Certified Solutions Architect – Professional SAP-C02 exam, this topic matters because many scenario questions involve hybrid identity, Windows workloads, domain joins, WorkSpaces, FSx, RDS for SQL Server, IAM role mapping, and cost-sensitive directory design.
At the Professional level, the key skill is not just knowing what each directory option does. You need to know when to choose AWS Managed Microsoft AD, AD Connector, or Simple AD based on requirements such as hybrid connectivity, trust relationships, user replication, group policy support, high availability, cost, and compliance.
Key Concepts
AWS Directory Service Overview
AWS Directory Service provides managed directory options for workloads that need Active Directory-style authentication or integration with Microsoft-based identity systems.
The three main options covered are:
- AWS Managed Microsoft AD
- AD Connector
- Simple AD
Each option solves a different identity architecture problem.
AWS Managed Microsoft AD gives you a full Microsoft Active Directory environment running in AWS. AD Connector lets AWS services use your existing on-premises Active Directory without replicating directory data into AWS. Simple AD provides a lower-cost, lightweight directory for smaller or less complex workloads.
AWS Managed Microsoft AD
AWS Managed Microsoft AD is a fully managed Microsoft Active Directory service hosted in AWS. It runs on Windows Server and provides real Microsoft AD capabilities without requiring you to build and maintain your own domain controllers on EC2.
AWS deploys the service with a highly available pair of domain controllers across multiple Availability Zones. These domain controllers replicate directory data between each other, allowing either domain controller to respond to authentication requests.
This option supports many familiar Microsoft AD features, including:
- Group Policy
- Kerberos authentication
- LDAP
- NTLM authentication
- Custom organizational units
- Domain joins for Windows and Linux EC2 instances
- Trust relationships with other Active Directory environments
- Multi-AZ replication for high availability
- Integration with AWS services such as Amazon WorkSpaces, Amazon FSx, and Amazon RDS for SQL Server
- MFA integration through RADIUS
The important exam point is that AWS Managed Microsoft AD is the closest AWS-native equivalent to a full Microsoft Active Directory deployment.
Trust Relationships with On-Premises Active Directory
AWS Managed Microsoft AD can establish trust relationships with an existing on-premises Microsoft Active Directory environment.
Trusts can be:
- One-way trust
- Two-way trust
This is important in hybrid cloud scenarios where organizations want AWS-hosted workloads to authenticate users from an existing corporate directory.
For example, a company may have its main Active Directory domain on-premises but wants to run Windows workloads in AWS. By creating a trust, AWS resources can participate in an identity design that still recognizes the existing enterprise directory.
Domain Joining EC2 Instances
AWS Managed Microsoft AD can be used to join both Windows and Linux EC2 instances to a domain.
This is useful when AWS-hosted servers need centralized authentication, domain policies, or integration with existing administrative models.
Common use cases include:
- Windows Server EC2 instances requiring domain authentication
- Linux EC2 instances that need centralized identity
- Application servers that depend on LDAP, Kerberos, or NTLM
- Workloads that need group-based access control
- Environments where administrators want familiar AD management patterns
AWS Managed Microsoft AD Use Cases
AWS Managed Microsoft AD is usually the right choice when the environment needs full AD capabilities inside AWS.
Typical use cases include:
- Extending an on-premises Active Directory environment into AWS
- Supporting Windows-based workloads in AWS
- Providing identity services for Amazon WorkSpaces
- Supporting Amazon FSx workloads
- Supporting Amazon RDS for SQL Server authentication patterns
- Applying Group Policy to domain-joined systems
- Building a hybrid cloud identity architecture
- Supporting applications that require Kerberos, LDAP, or NTLM
From an exam perspective, choose AWS Managed Microsoft AD when the question mentions full Microsoft AD compatibility, trust relationships, Group Policy, or hybrid AD integration with AWS-hosted workloads.
AD Connector
AD Connector is different from AWS Managed Microsoft AD. It does not create a new Active Directory domain in AWS. Instead, it acts as a proxy between AWS services and an existing on-premises Active Directory.
Authentication requests are forwarded from AWS to the on-premises AD environment over a network connection such as:
- Site-to-Site VPN
- AWS Direct Connect
No directory data is replicated into AWS.
This is the core design point: AD Connector allows AWS services to use on-premises AD identities without storing or syncing those identities into AWS.
AD Connector Authentication Flow
With AD Connector, the actual identity source remains on-premises.
The flow looks like this:
| Step | What Happens |
|---|---|
| 1 | A user or AWS service attempts to authenticate. |
| 2 | AD Connector receives the request in AWS. |
| 3 | AD Connector forwards the request to on-premises Active Directory. |
| 4 | On-premises AD validates the identity. |
| 5 | AWS receives the authentication result through AD Connector. |
This is useful when the organization wants centralized authentication but does not want to replicate user accounts into AWS.
AD Connector and IAM Role Mapping
AD Connector can support federated sign-in to the AWS Management Console by mapping Active Directory identities to IAM roles.
This matters for exam scenarios where an organization wants users to sign in using corporate AD credentials and then receive AWS permissions through IAM role mapping.
The key distinction is that AD Connector is not replacing IAM. It is helping bridge existing directory identities into AWS access patterns.
AD Connector Deployment Sizes
AD Connector has two deployment sizes:
| AD Connector Size | Intended Scale |
|---|---|
| Small | Up to 500 users |
| Large | More than 500 users |
This may show up in exam questions where the user count is part of the scenario.
AD Connector High Availability
AD Connector is deployed redundantly across two subnets.
This matters because authentication becomes a dependency for services using the directory. If identity services are unavailable, users may not be able to access WorkSpaces, applications, or other AWS-integrated resources.
AD Connector Use Cases
AD Connector is a strong choice when the organization already has Active Directory and wants AWS workloads to authenticate against it without copying directory data into AWS.
Common use cases include:
- Extending on-premises AD authentication into AWS
- Avoiding directory data replication into AWS
- Supporting Amazon WorkSpaces authentication
- Supporting Amazon FSx authentication
- Supporting SQL Server workloads
- Joining Windows EC2 instances to the on-premises domain
- Meeting compliance or security requirements that require identity data to remain on-premises
From an SAP-C02 perspective, AD Connector is often the correct answer when the scenario says:
- “Do not replicate user data to AWS”
- “Use existing on-premises Active Directory”
- “Proxy authentication requests”
- “Keep identities centralized on-premises”
- “Use corporate credentials for AWS services”
Simple AD
Simple AD is a lightweight, lower-cost directory option based on Samba 4.
It provides some Active Directory-compatible capabilities but does not provide the full feature set of Microsoft Active Directory.
Simple AD supports:
- LDAP
- Kerberos
- NTLM
- Basic Group Policy functionality
However, it does not support trust relationships with on-premises Active Directory.
This is a major exam distinction. If the scenario requires trusts with an existing AD domain, Simple AD is not the right answer.
Simple AD Deployment Sizes
Simple AD has two deployment sizes:
| Simple AD Size | Intended Scale |
|---|---|
| Small | Up to 500 users |
| Large | Up to 5,000 users |
Simple AD can be useful for small standalone workloads that need basic directory services but do not require enterprise Microsoft AD features.
Simple AD Use Cases
Simple AD is best for simpler, cost-sensitive use cases.
Common use cases include:
- Small-scale applications that need directory authentication
- Standalone Linux or Unix authentication
- Basic Amazon WorkSpaces authentication
- Basic EC2 authentication
- Environments that do not require full Microsoft AD
- Environments that do not need trust relationships
From an exam perspective, Simple AD is usually the answer when the workload needs a low-cost directory but does not need advanced Microsoft AD features.
Cost and Capability Tradeoffs
The three directory options have different cost and capability profiles.
| Service | Capability Level | Cost Profile | Primary Tradeoff |
|---|---|---|---|
| AWS Managed Microsoft AD | Full Microsoft AD capabilities | Higher cost | More features, managed HA, trusts, Group Policy |
| AD Connector | Proxy to existing AD | Lower cost than full managed AD | No directory data stored in AWS, depends on on-prem AD connectivity |
| Simple AD | Lightweight Samba-based directory | Lower cost | Limited features, no trusts, not full Microsoft AD |
For SAP-C02, always match the service to the business requirement. Do not automatically choose the most feature-rich option if the scenario emphasizes cost or avoiding replication.
Exam-Relevant Takeaways
AWS Managed Microsoft AD is the best choice when the scenario requires a full Microsoft Active Directory experience in AWS. Look for requirements such as Group Policy, Kerberos, LDAP, NTLM, custom OUs, domain joins, trust relationships, and Microsoft workload integration.
AD Connector is the best choice when AWS services need to authenticate against an existing on-premises Active Directory without replicating directory data into AWS. It proxies requests back to the on-premises directory and is useful for compliance-sensitive environments.
Simple AD is the best choice for smaller, standalone, lower-cost directory needs where full Microsoft AD features are not required.
Trust relationships are supported by AWS Managed Microsoft AD, not Simple AD.
AD Connector does not create a new directory and does not replicate users into AWS.
Simple AD is Samba-based and supports basic directory capabilities, but it lacks advanced Microsoft AD features.
AWS Managed Microsoft AD is deployed with a highly available pair of domain controllers across multiple Availability Zones.
AD Connector is deployed redundantly across two subnets and forwards authentication requests to the existing directory.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| Company needs full Microsoft Active Directory in AWS | AWS Managed Microsoft AD | Provides managed Windows Server-based AD with Group Policy, Kerberos, LDAP, NTLM, custom OUs, and HA domain controllers. |
| Company wants AWS workloads to authenticate against existing on-prem AD without syncing users to AWS | AD Connector | Proxies authentication requests to on-premises AD and avoids directory data replication. |
| Company needs trust relationships between AWS and on-prem AD | AWS Managed Microsoft AD | Supports one-way and two-way trusts with existing Microsoft AD environments. |
| Small application needs basic directory authentication at low cost | Simple AD | Provides lightweight Samba-based directory services without full Microsoft AD overhead. |
| Organization must avoid storing identity data in AWS for compliance reasons | AD Connector | Keeps identity data in the on-premises directory and forwards authentication requests. |
| WorkSpaces users need to authenticate with existing corporate AD credentials | AD Connector | Allows WorkSpaces to use on-prem AD identities without replication. |
| AWS-hosted Windows servers need Group Policy support | AWS Managed Microsoft AD | Supports Group Policy and domain-joined Windows workloads. |
| Standalone Linux or Unix workloads need basic LDAP/Kerberos authentication | Simple AD | Provides basic directory services suitable for simpler standalone authentication needs. |
| Environment needs Amazon FSx or RDS for SQL Server integration with AD | AWS Managed Microsoft AD or AD Connector | Managed AD is appropriate for AWS-hosted directory services; AD Connector is appropriate when using existing on-prem AD. |
| Lowest-cost option is required and advanced AD features are unnecessary | Simple AD | Lower-cost, lightweight directory option. |
Common Exam Traps
Trap 1: Choosing Simple AD When Trusts Are Required
Simple AD does not support trust relationships with on-premises Active Directory. If the question requires a one-way or two-way trust, choose AWS Managed Microsoft AD.
Trap 2: Choosing AWS Managed Microsoft AD When the Requirement Says No Replication
If the scenario says user accounts must remain only in the on-premises directory and must not be replicated or stored in AWS, AD Connector is usually the better answer.
Trap 3: Thinking AD Connector Is a Directory
AD Connector is not a standalone directory service. It is a proxy. The actual directory remains the existing on-premises Active Directory.
Trap 4: Ignoring Network Dependency for AD Connector
AD Connector depends on connectivity back to the on-premises Active Directory. If the VPN or Direct Connect path is unavailable, authentication can be impacted.
Trap 5: Assuming Simple AD Is Full Microsoft AD
Simple AD supports some AD-like functionality, but it is not the same as AWS Managed Microsoft AD. It is Samba-based and lacks advanced Microsoft AD features.
Trap 6: Overbuilding for Small Workloads
If the workload only needs basic directory functionality and does not need trusts, advanced Group Policy, or full Microsoft AD compatibility, AWS Managed Microsoft AD may be more than required.
Trap 7: Missing the Hybrid Identity Requirement
For hybrid cloud scenarios, pay close attention to whether the company wants to extend AD into AWS using trusts or simply proxy authentication back to on-premises AD. That distinction often determines the correct answer.
Real-World Engineer Notes
In a real environment, the decision between AWS Managed Microsoft AD, AD Connector, and Simple AD usually comes down to ownership, connectivity, compliance, and operational risk.
AWS Managed Microsoft AD is attractive when you want AWS to manage the domain controllers, patching, availability, and replication. This reduces operational overhead compared to building your own AD domain controllers on EC2. However, it is still a directory service that becomes part of your identity architecture, so you need to plan DNS, trusts, OU structure, administrative delegation, security groups, and backup or recovery expectations.
AD Connector is useful when the organization does not want another directory. This is common in enterprises where Active Directory is already centralized and heavily governed. The tradeoff is that AWS authentication now depends on network connectivity back to the data center. From an engineering standpoint, that means VPN or Direct Connect resilience matters. You would want redundant paths, proper DNS resolution, firewall rules, monitoring, and clear troubleshooting steps.
Simple AD is useful for small or isolated use cases, but it should not be treated as a replacement for enterprise Microsoft Active Directory. If future requirements might include trusts, complex Group Policy, hybrid identity, or advanced Microsoft workload support, Simple AD can become limiting.
For migrations, the key question is whether AWS is becoming an extension of the existing enterprise identity environment or whether AWS needs its own managed identity island. If the goal is hybrid integration, AWS Managed Microsoft AD with trusts or AD Connector are more likely. If the goal is a small standalone workload, Simple AD may be enough.
From a governance perspective, directory design affects access control, auditability, incident response, and operational ownership. Identity architecture should not be treated as a small configuration choice. It directly impacts who can log in, what policies apply, how authentication flows, and how outages are handled.
Quick Reference Summary
AWS Directory Service provides multiple ways to support directory-based authentication in AWS.
AWS Managed Microsoft AD is a fully managed Microsoft Active Directory service. Use it when you need full AD features, Group Policy, Kerberos, LDAP, NTLM, custom OUs, trust relationships, and highly available domain controllers in AWS.
AD Connector proxies authentication requests from AWS to an existing on-premises Active Directory. Use it when you want AWS services to use corporate AD credentials without replicating identity data into AWS.
Simple AD is a lightweight Samba-based directory. Use it for small, standalone, lower-cost workloads that need basic directory features but not full Microsoft AD capabilities.
For the SAP-C02 exam, focus on matching the directory option to the scenario’s requirements: full AD features, hybrid trust, no replication, low cost, or basic standalone authentication.
Flashcards
Q: What is AWS Managed Microsoft AD?
A: A fully managed Microsoft Active Directory service running in AWS with features such as Group Policy, Kerberos, LDAP, NTLM, custom OUs, multi-AZ domain controllers, and trust relationships.
Q: When should you choose AWS Managed Microsoft AD?
A: Choose it when you need full Microsoft AD functionality in AWS, including Group Policy, domain joins, trusts, and integration with Windows-based workloads.
Q: What is AD Connector?
A: AD Connector is a proxy that forwards authentication requests from AWS services to an existing on-premises Active Directory.
Q: Does AD Connector replicate directory data into AWS?
A: No. AD Connector does not replicate users or directory data into AWS.
Q: When is AD Connector the best choice?
A: When AWS services need to authenticate against existing on-premises AD and the organization wants to avoid storing or syncing identity data in AWS.
Q: What network connectivity is commonly used with AD Connector?
A: AD Connector typically uses Site-to-Site VPN or AWS Direct Connect to reach the on-premises Active Directory.
Q: What is Simple AD based on?
A: Simple AD is based on Samba 4 and provides lightweight directory functionality.
Q: Does Simple AD support trust relationships with on-premises AD?
A: No. Simple AD does not support trust relationships with on-premises Active Directory.
Q: What authentication protocols are supported by AWS Managed Microsoft AD?
A: AWS Managed Microsoft AD supports Kerberos, LDAP, and NTLM.
Q: What are the deployment sizes for AD Connector?
A: Small for up to 500 users and Large for more than 500 users.
Q: What are the deployment sizes for Simple AD?
A: Small for up to 500 users and Large for up to 5,000 users.
Q: Which AWS Directory Service option is most appropriate for low-cost basic directory services?
A: Simple AD.
Q: Which AWS Directory Service option supports one-way or two-way trusts?
A: AWS Managed Microsoft AD.
Q: Which option should you choose if identity data must remain on-premises?
A: AD Connector.
Q: Why is AWS Managed Microsoft AD considered highly available?
A: It is deployed with a pair of domain controllers across multiple Availability Zones.
Practice Questions
Question 1:
A company has an existing on-premises Microsoft Active Directory environment. The security team requires that user accounts must not be replicated or stored in AWS. The company wants AWS services to authenticate users against the existing directory. Which AWS Directory Service option should be used?
A. AWS Managed Microsoft AD
B. AD Connector
C. Simple AD
D. IAM Identity Center only
Correct Answer:
B. AD Connector
Explanation:
AD Connector proxies authentication requests from AWS to the existing on-premises Active Directory and does not replicate directory data into AWS.
Question 2:
A company is deploying Windows-based workloads in AWS and needs full Microsoft Active Directory capabilities, including Group Policy, Kerberos authentication, custom OUs, and a trust relationship with the on-premises AD environment. Which option is the best fit?
A. Simple AD
B. AD Connector
C. AWS Managed Microsoft AD
D. Amazon Cognito
Correct Answer:
C. AWS Managed Microsoft AD
Explanation:
AWS Managed Microsoft AD provides full Microsoft AD capabilities in AWS and supports trust relationships, Group Policy, Kerberos, LDAP, NTLM, and domain joins.
Question 3:
A small standalone application needs basic directory authentication in AWS. The application does not require trust relationships, advanced Microsoft AD features, or hybrid integration. Cost is an important factor. Which service should be selected?
A. Simple AD
B. AWS Managed Microsoft AD
C. AD Connector
D. AWS Organizations
Correct Answer:
A. Simple AD
Explanation:
Simple AD is a lightweight, lower-cost Samba-based directory option suitable for small-scale workloads that only need basic directory services.
Question 4:
An architect is evaluating AD Connector for AWS WorkSpaces authentication. Which statement correctly describes AD Connector?
A. It creates a full Microsoft Active Directory domain in AWS.
B. It replicates all users and groups from on-premises AD into AWS.
C. It forwards authentication requests to an existing on-premises Active Directory.
D. It supports trust relationships with Simple AD.
Correct Answer:
C. It forwards authentication requests to an existing on-premises Active Directory.
Explanation:
AD Connector is a proxy service. It does not create a new AD domain and does not replicate directory data into AWS.
Question 5:
A company wants a directory service in AWS that supports one-way or two-way trust relationships with its existing on-premises Microsoft Active Directory. Which option should the solutions architect recommend?
A. Simple AD
B. AWS Managed Microsoft AD
C. AD Connector
D. Amazon Cloud Directory
Correct Answer:
B. AWS Managed Microsoft AD
Explanation:
AWS Managed Microsoft AD supports trust relationships with existing Microsoft Active Directory environments. Simple AD does not support trusts, and AD Connector proxies authentication rather than creating a managed AD domain with trusts.