As you continue along your cloud migration journey with AWS, moving Windows workload to the AWS Cloud is a critical step. It is essential to have an Active Directory in the cloud to seamlessly support your group policy management, authentication, and authorization. Learn more about it in this overview session on AWS Directory Service for Microsoft Active Directory, also known as AWS Managed Microsoft Active Directory (AD). Hear from the experts about the basics of this service, how to get started and its various use cases including its ability for trust-based federation

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Microsoft Global Specialty Practice LeadMigration Patterns Global Lead
Mark Szalkiewicz
MarkSza@
AWS Professional Services
Introduction to AWS Directory Service for
Microsoft Active Directory

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Introduction to AWS Managed Microsoft AD
• Options to support Workloads
• Introduction - What is AWS Managed Microsoft AD?
• Shared Responsibilities
• Use Cases
• Deployment Models
• Pre-req’s, Post-req’s, and Considerations
• New: Directory Sharing (Cross accounts + VPCs)
• Administration
• Summary

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD Options to Support Windows Workloads
On-premises
Windows Server
DC
AD
1
VPC
EC2 for Windows
Server DC
AD
2
VPC Endpoint
AWS Managed
Microsoft AD
3
AWS Directory Service
for Microsoft Active Directory
also known as AWS
Managed Microsoft AD
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Options for AD-aware Cloud Workloads
On-premises
Windows Server
DC
AD
You manage
1
VPC
EC2 for Windows
Server DC
AD
You manage
2
You do everything…
• You install and manage domain
controllers
• You manually join EC2 instances to
your self-managed AD
Use AD Connector to simplify connecting
workloads in AWS to your self-managed AD

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Options for AD-aware Cloud Workloads
On-premises
Windows Server
DC
AD
You manage
1
VPC
EC2 for Windows
Server DC
AD
You manage
2
VPC Endpoint
AWS Managed
Microsoft AD
AWS manages
3
AWS Directory Service
for Microsoft Active Directory

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Introduction

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What AWS Managed Microsoft AD Is
AWS managed, actual Microsoft Active Directory
Windows 2012 R2 domain controllers (DC)
• ~3-click setup from directory service console
or script through API
• 2 DCs each in separate Availability Zones (AZs)
• Scale-out with additional DCs
• Dynamic DNS
• Compliance audited
Auth/
LDAP
Availability Zone
Private Subnet
10.0.2.0/24
EC2
App
Server
EC2
IIS
Server
AWS Managed
Services
D
C
AWS Managed
Microsoft AD
Auth/
LDAP
Availability Zone
Private Subnet
10.0.2.0/24
EC2
App
Server
EC2
IIS
Server
AWS Managed
Services
D
C
AWS Managed
Microsoft AD
DC
DC

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
What AWS Managed Microsoft AD Is
Enterprise Edition = Standard Edition plus enterprise features
Currently same features
Priced per DC per hour (2 DC minimum)
30-day limited free trial
Two Editions
Enterprise
Edition
Standard
Edition
Storage Capacity 17GB 1GB
Performance
Optimized
100,000+
employees
Up to 5,000
employees

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Shared Responsibility

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Managed Microsoft AD Shared Responsibilities
Customer - Administers
Configure password policies
Configure trusts (resource forest deployment)
Configure Certificate Authorities (for LDAPS)
Configure federation
Administer users, groups, GPOs, other AD content
Administration via Active Directory Users and
Computers (ADUC) and other standard AD tools
Add domain controllers as needed
Amazon - Operates
• Multi-AZ deployment, patch, monitor,
DC recovery, snapshot, restore
Auth/
LDAP
Availability Zone
Private Subnet
10.0.2.0/24
APP
App
Server
WEB
IIS
Server
AWS Managed
Services
D
C
AWS Managed
Microsoft AD
DC
Auth/
LDAP
Availability Zone
Private Subnet
10.0.2.0/24
APP
App
Server
WEB
IIS
Server
AWS Managed
Services
D
C
AWS Managed
Microsoft AD
DC

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Use Cases

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Where can AWS Managed AD help me?
• Amazon EC2 instances
• AD aware workloads
• AWS Apps and Services
• On-premise AD
• SaaS applications

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Managed Microsoft AD Use Cases
Amazon
WorkSpaces
AWS Managed
Microsoft AD
On-Premises
Microsoft Active
Directory
RDS for SQL
Server
On-Premises User
Credentials
Amazon
WorkDocs
Amazon
WorkMail
Amazon
QuickSight
AWS Management
Console
Active Directory
Federation Service
(AD FS)
Amazon
Chime
Amazon
Connect
1 AWS Apps &
Services
Amazon
Windows EC2
Instances
Amazon Linux
EC2 Instances
2 Amazon
EC2
.NET
Applications
SharePoint
3 AD-aware
Workloads
SQL ServerRemote
Desktop
Licensing
Manager
.NET SPS
SQL
Server
RD
Licensing
5 On-Premises
AD
4 SaaS
Applications
Azure AD
AD FS
Corporate Data Center
Trust
relationship
Authorization &
Access
Management &
Access
Management &
Access
Federated
Access
VPN
connection

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD Connector
AD Connector
SaaS Applications
Azure AD
Self-managed
Microsoft Active
Directory
On-premises user
credentials
Corporate data center
or Your VPCVPN
Direct
Connect
or
AD FS
Server
SAML
authenticate
Synchronize
users
Azure AD
Connect
Server
Amazon EC2
Seamless Domain Join
Amazon
Windows EC2
instances
Amazon
WorkSpaces
Amazon
WorkDocs
Amazon
WorkMail
Amazon
QuickSight
AWS Management
Console
Amazon
Chime
Amazon
Connect
AWS Apps & Services
Provision & Authenticate
.NET
Applications
Server
SharePoint
Server
SQL ServerRemote
Desktop
Licensing
Manager
Enterprise
Certificate
Authority
AD-aware Workloads
.NET SharePoint
SQL
Server
RD
Licensing
Certificate
Services

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Deployment Models

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AW S Managed Microsof t A D as a Primary D irect ory
AWS Managed
Microsoft AD
SaaS Applications
Azure ADSAML
authenticate
Synchronize
users
AD FS
Server
AD FS
Azure AD
Connect
Server
Federate
ADSync
Enabling features
• Delegated administration for built-in groups
• RAS and IAS servers
(Network Policy Server)
• Terminal Server Licensing Servers
(Remote Desktop Licensing Manager)
• Schema extensions
• Group Managed Service Accounts (gMSA)
• Kerberos Constrained Delegation
• Register for change notifications
• Add Microsoft Enterprise CA
• Enable LDAPS
Administer
users & groups
Manage, authenticate,
& authorize
.NET
Applications
Server
SharePoint
Server
SQL ServerRemote
Desktop
Licensing
Manager
.NET SharePoint
SQL
Server
RD
Licensing
Enterprise
Certificate
Authority
Certificate
Services
AD-aware Workloads
Domain join &
manage
Amazon
Windows EC2
instances
Amazon
Linux EC2
instances
Amazon EC2
Amazon
WorKSpaces
RDS for SQL
Server
Amazon
WorkDocs
Amazon
WorkMail
Amazon
QuickSight
AWS Management
Console
Amazon
Chime
Amazon
Connect
Enable, authenticate, & authorize
AWS Apps & Services

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AW S Managed Microsof t A D as a R esource direct ory
Amazon
WorkSpaces
AWS Managed
Microsoft AD
RDS for SQL
Server
Amazon
WorkDocs
Amazon
WorkMail
Amazon
QuickSight
AWS Management
Console
Amazon
Chime
Amazon
Connect
.NET
Applications
Server
SharePoint
Server
SQL ServerRemote
Desktop
Licensing
Manager
.NET SharePoint
SQL
Server
RD
Licensing
SaaS Applications
Azure AD
Enable, authenticate, &
authorize
Manage,
authenticate, & authorize
Manage, authenticate,
& authorize
Enterprise
Certificate
Authority
Certificate
Services
Self-Managed
Microsoft Active
Directory
On-premises user
credentials
Corporate
data centerVPN
Direct
Connect
or
AD FS
Server
SAML
authenticate
Synchronize
users
Azure AD
Connect
Server
Amazon
Windows EC2
instances
Amazon
Linux EC2
Instances
AD-aware Workloads
AWS Apps & Services Amazon EC2

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
D eployment Models
Resource
Directory
AWS Managed
Microsoft AD
Primary
Directory AWS Managed
Microsoft AD
On-premises data center
AD
Microsoft
Windows Server
DC (customer managed)
Primary
Directory
AD
Microsoft
Windows Server
DC (customer managed)
or
or

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Let ’s not f orget - AW S SSO
Architecture Summary:
• Leverage AWS Organizations
to manage SSO IDs
• Use AD Connector over AWS
Direct Connect to establish
trust with on-prem MSFT AD
domain controller
• SAML 2.0 token used to
verify client credentials
• Modern MSFT Application
deployed in VPC with
preferred enterprise account
configuration, tagging and
security configurations
• SSO solution permits cross-
account user management

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Using AWS Managed Microsoft AD

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Requisites to Use AWS Managed Microsoft AD
Prerequisites
• Virtual Private Cloud (VPC)
• Two subnets in different AZs
• Optional on-premises link
• Virtual Private Network (VPN)
• Amazon Direct Connect
Availability Zone
10.0.2.0/24
Availability Zone
10.0.3.0/24
Optional
VPN
Direct
Connect
OrOr
On-premises
Data Center

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Requisites to Use AWS Managed Microsoft AD
Post Directory Creation
• DHCP Option Sets
• AWS Security Group
• IAM Role & Policy for EC2
(AmazonEC2RoleforSSM)
• Key-pair (PEM) file
• EC2 Windows
(AD Administration Tools)
Availability Zone
10.0.2.0/24
Availability Zone
10.0.3.0/24
Optional
VPN
Direct
Connect
OrOr
On-premises
Data Center
DHCP
Option
Set
AD Admin
Tools
DC
AWS Managed
Microsoft AD
DC
AWS Managed
Microsoft AD

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Auth/
LDAP
Auth/
LDAP
DB
RDS for
SQL Server
Availability Zone
Private Subnet
10.0.2.0/24
APPWEB
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
APPWEB
App
Server
IIS
Server
Remote
Users/Admins
Domain
Controllers
Corporate data center
Example:
AWS Managed Microsoft
AD trust to on-premises
DB
RDS
SQL Server
AWS Managed Services
AWS Managed Services
Trust
Application
Auth/
LDAP
VPN
Direct
Connect
AD
DC
AWS Managed
Microsoft AD
DC
AWS Managed
Microsoft AD

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
C onsiderat ions f or AW S apps/services and many
VPC s
AWS Managed Microsoft AD requires a trust when used with on-
premises AD*
WorkSpaces and RDS for SQL must be in same VPC as AWS
Managed Microsoft AD, QuickSight in the same account
• Option 1 – Least cost, fewest trusts
• Deploy AWS Managed Microsoft AD in one VPC
• Deploy all RDS for SQL and WorkSpaces instances in same VPC
• Use tagging for internal billing
• Option 2 – Easiest billing, complex trust configuration, high cost
• Deploy AWS Managed Microsoft AD in each VPC
• Deploy RDS for SQL and WorkSpaces instance(s) in each VPC
*1-way trust for RDS for SQL Server, 2-way trust to provision Amazon WorkSpaces, Amazon QuickSight etc.

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Time tested, secure model
The trusting forest has no admin control over the
trusted forest
Trusted users have cloud resource access, but only if
entitled by trusting admins (you control both sides)
Cloud identities have no access to on-premises
resources unless:
1. On-premises trusts the cloud AND
2. On-premises admins grant permissions to
identities in the cloud
Forest trusts
AD
On-premises
network
VPC
Trust
Windows
AD DC
Access
Domain Local
Security group
(access entitlements here) Universal
Security group
Trusting Trusted
Cloud On-premises
AWS Managed
Microsoft AD

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
No trust vs. 1-way vs. 2-way trusts
Do you need users from one forest to access resources in another forest?
• If no, use no trust
Can you use only a 1-way trust?
• If yes, only use 1-way
• RDS for SQL Server with on-premises users requires at least 1-way
Is a 2-way trust required?
• If yes, use 2-way trust
• WorkSpaces, QuickSight Enterprise Edition, and Chime use 2-way trusts
• On-premises to AWS Managed Microsoft AD trust used only to read users/groups to
provision them into the application
Always Secure Your Trust

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Securing trusts
Leave SID filtering on when setting up the on-premises side of a trust
Turn on selective authentication on the on-premises side of a trust
• https://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx#w2k3tr_trust_security_zyzk
Only permit AD trust ports to the DCs in the cloud
• https://technet.microsoft.com/en-us/library/cc756944(v=ws.10).aspx
For cloud-client-to-AD, only permit AD authentication ports to on-premises AD;
minimize all other ports from cloud to on-premises
(e.g., WorkSpaces login using on-premises credentials)
• https://support.microsoft.com/en-us/help/179442/how-to-configure-a-firewall-for-domains-and-trusts
Don’t grant groups in the cloud access to on-premises resources

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
New Announcements
Summary: On September 25, we enabled customers to share a single AWS Directory Service for Microsoft Active Directory
(AWS Managed Microsoft AD) with multiple AWS accounts
The problem: Increased management effort and complexity, making it difficult and more expensive to deploy directory-aware
workloads in AWS
• Could not domain join EC2 instances from multiple accounts and VPCs seamlessly to a single AWS Managed Microsoft AD
• Had to deploy AWS Managed Microsoft AD in each account and VPC, or manually domain join the EC2 instances to the directory
The solution: Share a single directory with multiple AWS accounts using Directory Service S console or AP
• Directory sharing works at the account level, this also makes the directory visible to all VPCs within the accounts to which the
customer shared the directory
• To domain join EC2 instances to the directory seamlessly must establish networking connectivity between the VPCs where
they deployed the directory and the VPCs where they will deploy the EC2 instances

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Admin with AWS Managed Microsoft AD

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Managed Microsoft AD Administration Model

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Managed Microsoft AD Administration Model
88-856-43-585 88-856-43-585
Domain
“administrator”
OU
“admin”
Customer

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Managed Microsoft AD Administration Model
88-856-43-585 88-856-43-585
OU
“admin”
Customer

33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Managing f rom AW S D irect ory Service C onsole

34. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Managing f rom AW S D irect ory Service C onsole

35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Managing f rom AW S D irect ory Service C onsole

36. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Managed Microsoft AD Administration Model

37. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD options – AWS Managed Microsoft AD
AWS apps and services integration
• AWS Management Console access
VPC Endpoint
myname
myname
AWS Managed
Microsoft AD

38. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD
AD options - AWS Managed Microsoft AD
AWS apps and services integration
• AWS Management Console access
• EC2 seamless domain join
VPC Endpoint
AWS Managed
Microsoft AD
VPC Endpoint
AWS Managed
Microsoft AD

39. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD
AD options - AWS Managed Microsoft AD
AWS apps and services integration
• AWS Management Console access
• EC2 seamless domain join
• RDS for SQL Server
(Windows authentication, authorization)
VPC Endpoint
AWS Managed
Microsoft AD
VPC Endpoint
AWS Managed
Microsoft AD

40. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD
AD options - AWS Managed Microsoft AD
AWS apps and services integration
• AWS Management Console access
• EC2 seamless domain join
• RDS for SQL Server
(Windows authentication, authorization)
• WorkSpaces, WorkDocs, WorkMail, QuickSight
Enterprise, Connect, Chime Plus/Pro (provisioning
and authentication)
VPC Endpoint
AWS Managed
Microsoft AD
VPC Endpoint
AWS Managed
Microsoft AD

41. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AD
AD options - AWS Managed Microsoft AD
Example AD-aware application compatibility
• SharePoint
• SQL Server Always On Availability Groups
• Local Administrator Password Solution (LAPS)
• Active Directory Federation Service (AD FS)
• Azure AD Connect
• .NET applications
• group Managed Service Accounts (gMSA)
• Kerberos Constrained Delegation
VPC Endpoint
AWS Managed
Microsoft AD
VPC Endpoint
AWS Managed
Microsoft AD

42. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
AWS Microsoft AD - Summary
AWS managed domain controllers in different Availability Zones
Automatic patching, replication, and daily snapshots
Easy setup and administration via the AWS console and existing tools
Delegated administrative rights to dedicated OU
• Create, read, update, and delete users and groups
• Domain-joined machines added to DNS, assigned static IP addresses within
VPC
• Apply group policies
750 hour free trial for new AWS Directory Service customers

43. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
References
How to share the directory with multiple accounts
• Share Your Directory
• How to seamlessly domain join Amazon EC2 instances to a single AWS Managed Microsoft AD
directory from multiple accounts and VPCs
Documentation
• AWS Directory Service – aws.amazon.com/directoryservice
• AWS Managed Microsoft AD – aws.amazon.com/documentation/directory-service/
• RDS for SQL Server – aws.amazon.com/documentation/rds/
AWS Quick Starts – aws.amazon.com/quickstart/
• Active Directory Domain Services
• Exchange Server 2013
• SharePoint Server 2016 Enterprise
• Lync Server 2013
• SQL Server 2014 AlwaysOn
• Windows PowerShell DSC

44. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Thank You