AWS Directory Service Product Details

Microsoft AD is a managed Microsoft Active Directory, powered by Windows Server 2012 R2. It is designed to support up to 50,000 users (approximately 200,000 directory objects including users, groups and computers). Microsoft AD allows you to manage user accounts and group memberships, create and apply group policies, domain-join Amazon EC2 instances, and provide Kerberos-based single sign-on (SSO).

The applications and tools you use that require Microsoft Active Directory support can be used with Microsoft AD. Microsoft AD enables you to run directory-aware Windows workloads in the AWS cloud, including SharePoint, custom .NET and SQL Server-based applications. You can also create trust relationships between Microsoft AD domains in the AWS cloud, and on-premises Microsoft Active Directory domains. You can use a trust relationship to allow your on-premises users to authenticate to applications and workloads in the AWS cloud. For example, you can use Microsoft AD to allow your users to authenticate using their corporate credentials to AWS Applications such as Amazon WorkSpaces, Amazon WorkDocs, or Amazon WorkMail, and to manage AWS resources via AWS Identity and Access Management (IAM) role-based access to the AWS Management Console.

Microsoft AD is designed to reduce management tasks. There is no need to build out your own complex, highly-available directory topology because each Microsoft AD directory is deployed across multiple Availability Zones (AZ), and monitoring automatically detects and replaces domain controllers that fail. In addition, data replication and automated daily snapshots are configured for you. There is no software to install and AWS handles all of the patching and software updates.

Simple AD is a stand-alone, managed directory that is powered by Samba 4 Active Directory Compatible Server. Simple AD is available in two sizes; small and large. A small Simple AD supports up to 500 users (approximately 2,000 objects including users, groups and computers). A large Simple AD supports up to 5,000 users (approximately 20,000 objects including users, groups and computers).

Simple AD provides a subset of the functionality offered by Microsoft AD, including allowing you to manage user accounts and group memberships, create and apply group policies, domain-join Amazon EC2 instances, and provide Kerberos-based single sign-on (SSO). Simple AD does not support features such as trust relationships with other domains, AD Administrative Center, PowerShell support, AD recycle bin, fine-grained password policies, group managed service accounts, and schema extensions for POSIX and Microsoft applications.

Simple AD makes it easier to manage Amazon EC2 instances running Linux and Windows, and deploy Windows applications in the AWS cloud. Many of the applications and tools you use today that require Microsoft Active Directory support can be used with Simple AD. User accounts in Simple AD can also be used to access AWS applications such as Amazon WorkSpaces, Amazon WorkDocs, or Amazon WorkMail, and to manage AWS resources via AWS Identity and Access Management (IAM) role-based access to the AWS Management Console. Simple AD also provides daily automated snapshots by default to enable point-in-time recovery.

AD Connector is a directory gateway that allows you to proxy directory requests to your on-premises Microsoft Active Directory, without caching any information in the cloud. AD Connector comes in 2 sizes; small and large. A small AD Connector is designed for smaller organizations of up to 500 users. A large AD Connector is designed for larger organizations of up to 5,000 users.

Once set up, your end users and IT administrators can use their existing corporate credentials to log on to AWS applications such as Amazon Workspaces, Amazon WorkDocs, or Amazon WorkMail, and to manage AWS resources (e.g. Amazon EC2 instances or Amazon S3 buckets) via AWS Identity and Access Management (IAM) role-based access to the AWS Management Console. As well as providing a streamlined experience for your end users and IT administrators, this also means that your existing security policies such as password expiration, password history, and account lockouts can be enforced consistently whether users or IT administrators are accessing resources in your on-premises infrastructure or the AWS cloud. You can also use AD Connector to enable multi-factor authentication by integrating with your existing RADIUS-based MFA infrastructure to provide an additional layer of security when users access AWS applications.

When you use AWS Directory Service, you can focus on your applications and business while AWS Directory Service handles time-consuming directory management tasks such as patch management, host monitoring, backups and automatic recovery. For Microsoft AD and Simple AD, this includes snapshot backups, replication monitoring, and point-in-time restores.

Each directory is deployed across multiple Availability Zones in your selected region to ensure high availability. Automatic host replacement support is designed to promptly replace directory servers in the event of a host level failure.

Provisioning directories with AWS Directory Service is easy to do using the AWS Management Console. All you need to do is choose the type and size of directory that best meets your scale needs. You can also easily provision a new directory using the AWS Directory Service APIs. Download the latest AWS SDK or CLI or learn more about the APIs in our developer guide.

You can use AWS Directory Service to join your Amazon EC2 Linux and Windows instances to a domain. You can join an instance to both Microsoft AD and Simple AD directories, as well as an existing, on-premises Microsoft Active Directory using AD Connector. You can use the AWS Management Console to seamlessly join EC2 Windows instances when they launch. You can also use the EC2 API to domain join preexisting EC2 Linux and Windows instances, as well as domain join at the time of launch.

To get started, please see our blog and documentation.

AWS Directory Service enables single sign-on, which is designed to provide the users in your organization the ability to leverage their existing, corporate credentials to access cloud resources including domain joined EC2 instances, AWS applications such as Amazon WorkSpaces, Amazon WorkDocs, Amazon WorkMail, and the AWS Management Console, as well as Microsoft workloads including SharePoint, custom .NET and SQL Server-based applications.