AWS Managed Microsoft AD
As identity has become the new security perimeter, every organization is focusing on the authentication and authorization of identities. These identities are users, applications, and devices.
What is an Active Directory?
As the name suggests It is a directory of active users, groups, applications, and devices. These users, applications, and devices are categorized according to their names and attributes. Active Directory is a service that runs on Microsoft Windows Server.
As Active Directory has become an umbrella term for various directory-based identity-related services, AWS has a managed service that enables users to run Microsoft Active Directory (AD) in the AWS Cloud and is known as AWS Directory Services. Being a managed service AWS automatically configures and manages software updates, data replication, host monitoring and recovery, and snapshots.
To launch the Directory Services from the AWS console, select Set up a directory:
AWS Directory Services gives various numbers of different options to deploy Active Directory in the AWS cloud. The users can configure an Active directory that fits their requirements.
The first option AWS Microsoft AD is a managed service. It also allows the connectivity of AWS resources with an existing on-premises Microsoft Active Directory. The only requirement is configuring a one-way or two-way trust between the AWS-managed Microsoft AD and an already existing on-prem Microsoft AD.
Select the directory type and click Next.
As you can see in the above diagram, Microsoft Managed AD is powered by Windows Server 2019. It operates at the 2012 R2 Forest and Domain functional levels.
Get Reeti’s stories in your inbox
Join Medium for free to get updates from this writer.
It is available in two versions, Standard and Enterprise. The Standard edition supports 1GB of storage for directory objects and is suitable for small to medium-sized businesses. The Enterprise edition supports 17 GB of storage for directory objects and is suitable for large businesses.
The next step is to assign a fully qualified domain name. This name needs not be publicly resolvable as it will only resolve inside the user’s VPC. Give an admin password and keep it safe. Click on Next.
Next, select a VPC where you want your Managed AD to be deployed and ensure you select two different subnets for high availability. On deployment, this directory service creates a pair of domain controllers in your virtual private cloud (VPC). For high availability, these two domain controllers run in different Availability Zones in a Region.
Next, click on Create Managed Active Directory.
This creates a Managed Active in the VPC of your choice. This AD on the AWS cloud can be used for the following purposes:
- To manage users and groups
- Applications and services can leverage it for single sign-on.
- The group policy can be created and applied in the same manner as AD.
- The cloud-based Linux and Microsoft Windows workloads can be deployed and managed easily.
- RADIUS-based MFA can be integrated for an extra layer of security.
- When connecting to Amazon EC2 Linux instances, Secure Shell (SSH) authentication can be used.
Cost:
Pay only for Windows Server instances that are being used. The licensing of Windows Server instances is managed by AWS. For admin purposes, a remote connection is provided to each instance.
Thanks for reading!
