by Ron Cully, Product Management Manager, AWS Active Directory (AD) is essential for Windows workloads in the cloud. AWS offers customers multiple ways to integrate AD with cloud workloads like EC2, RDS, and AWS Enterprise Applications: AWS Directory Service for Microsoft Active Directory (Enterprise Edition) as a managed service and Active Directory running on AWS EC2 Windows instances. Which option is right for you? This session will discuss the key deployment considerations for each option to help you identify which best meets your project goals, and the effort involved. The session will cover options for integrating with your on-premises directory, port and security considerations, application considerations, and best practices. Level 200

1. Pop-up Loft
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Best Practices for Active Directory with AWS Workloads
Ron Cully,
Sr. Product Manager

2. What to expect from the session
How AD is used – Why AD is important in the cloud
Deployment Options – Supporting Windows workloads in the cloud
How to choose – Considerations for selection
Trusts vs. Sync – Alternatives to replication

3. How AD is used – Why AD is important in the cloud

4. Why AD is important in the cloud
Migration path
Source: Implementing an Identity Strategy for Amazon Web Services, Gartner Group, 24 Feb 2017

5. How AD Works with Computers
Domain Join/Machine AuthN/GPO/LDAP
AuthN – Authentication
GPO – Group Policy Object
LDAP – Lightweight Directory Access Protocol

6. How AD Works with User
User AuthN/Group Membership/Login Scripts
Domain Join/Machine AuthN/GPO/LDAP
AuthN – Authentication
GPO – Group Policy Object
LDAP – Lightweight Directory Access Protocol

7. How AD Works with Services
User AuthN/Group Mbrshp/Login Scripts
Domain Join/Machine AuthN/GPO/LDAP

8. This image cannot currently be displayed.
How AD Works in Federated SaaS Solutions
App
DB
App
User AuthN/Group Mbrshp/Login Scripts
Federated AuthN
(SAML) Kerb
AuthN
Domain Join/Machine AuthN/GPO/LDAP

9. Amazon EC2
Amazon
DynamoDB
Amazon
WorkSpaces
Amazon EC2
What if You Migrate These Parts to ASW?
App
User AuthN/Group Mbrshp/Login Scripts
Federated AuthN
(SAML) Kerb
AuthN
Domain Join/Machine AuthN/GPO/LDAP
?RDS for
SQL Server

10. Deployment Options – Supporting Windows
workloads in the cloud

11. AD options – Where to run AD
On-premises
Windows Server
DC
AD
You Manage
1
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC

12. AD options – On-premises
Create VPN or Amazon Direct
Connect link to your VPC
Manually domain join EC2
instances to on-premises
Use VPC as an extension of
your network
• Security considerations
Latency considerations?
On-premises
Windows Server
DC
AD
You Manage
1
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC

13. AD options – Where to run AD
On-premises
Windows Server
DC
AD
You Manage
1
VPC
EC2 for Windows
Server DC
AD
You Manage
2
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC

14. AD options – EC2 self-managed
Your responsibilities
• Availability deployment strategy
• EC2 DC configuration
• DNS configuration
• Sites and Services configuration
• Monitoring
• DC recovery
• Backup
• Restore
• Security group configuration
• Manual EC2 domain joining
• Patch Tuesday management
AWS Directory Service required for AWS enterprise applications and services
to authenticate to your self-managed AD
On-premises
Windows Server
DC
AD
You Manage
1
VPC
EC2 for Windows
Server DC
AD
You Manage
2

15. AD
AD options – Where to run AD
On-premises
Windows Server
DC
AD
You Manage
1
VPC
EC2 for Windows
Server DC
AD
You Manage
2
VPC Endpoint
AWS Microsoft AD
AWS Manages
3
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC

16. AD
AD options – AWS Microsoft AD
Windows 2012 R2 domain controllers (DC)
• ~3-click setup
• 2 DCs each in a different Availability Zone (AZ)
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD
AD
Resource Directory
TrustAD
Primary Directory
Deployment models

17. AD
AD options – AWS Microsoft AD
AWS apps and services integration
• AWS Management Console access
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD
myname
myname

18. AD
AD options – AWS Microsoft AD
AWS apps and services integration
• AWS Management Console access
• EC2 seamless domain join
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD

19. AD
AD options – AWS Microsoft AD
AWS apps and services integration
• AWS Management Console access
• EC2 seamless domain join
• RDS for SQL Server
(Windows authentication, authorization)
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD

20. AD
AD options – AWS Microsoft AD
AWS apps and services integration
• AWS Management Console access
• EC2 seamless domain join
• RDS for SQL Server
(Windows authentication, authorization)
• WorkSpaces, WorkDocs, WorkMail, QuickSight
Enterprise, Connect, Chime Plus/Pro (provisioning
and authentication)
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD

21. AD
AD options – AWS Microsoft AD
Example AD-aware application compatibility
• SharePoint
• SQL Server Always On Availability Groups
• Local Administrator Password Solution (LAPS)
• Active Directory Federation Service (AD FS)
• Azure AD Connect
• .NET applications
• group Managed Service Accounts (gMSA)
• Kerberos Constrained Delegation
Compliance
• Payment Card Industry (PCI)
• Health Insurance Portability and Accountability Act (HIPAA)
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD

22. AD options – AWS Microsoft AD
Some constraints
• AWS is domain admin
• You get an OU and delegated
admin over the OU
• AWS apps/services/EC21 must
be in same account and/or VPC
• Conservative delegated permissions2 to your
OU admin account
• Application enablement blocks some apps
• Some admin functions unavailable
AD
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD
1EC2 can domain join in peered VPC configurations
2Delegations are being expanded over time

23. Your responsibilities - Administer
• Configure password policies
• Configure trusts (resource forest deployment)
• Configure Certificate Authorities (for LDAPS)
• Configure federation
• Administer users, groups, GPOs, other AD content
• Administration via Active Directory Users and
Computers (ADUC) and other standard AD tools
• Add domain controllers as needed
AD options – AWS Microsoft AD
Amazon responsibilities - Operate
• Multi-AZ deploy, patch, monitor,
DC recovery, snapshot, restore AD
VPC Endpoint
AWS Microsoft AD
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. AWS Microsoft AD

24. AD options – Connecting to on-premises AD
1
Replication
Your DCs only
On-premises
Windows Server
DC
AD
VPC
EC2 for Windows
Server DC
AD
On-premises
Windows Server
DC
AD
VPC
EC2 for Windows
Server DC
AD2
1-way Trust
2-way Trust
Your DCs or
AWS Managed
Microsoft AD
On-premises
Windows Server
DC
AD
VPC
EC2 for Windows
Server DC
AD3
Sync Users Depends
(third-party sync)

25. Application
Availability Zone
Private Subnet
10.0.2.0/24
SQL
Server
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
SQL
Server
App
Server
IIS
Server
Remote
Users/Admins
Domain
Controllers
Corporate data center
DBAPPWEB
DBAPPWEB
Auth/
LDAP
Auth/
LDAP
VPN
Direct
Connect
Example:
On-premises AD
AD

26. Availability Zone
Private Subnet
10.0.2.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Remote
Users/Admins
Domain
Controllers
Corporate data center
Example:
AD on EC2 with
replication or AD trust
Domain
Controller
Domain
Controller
Trust or Replication
Auth/
LDAP
Auth/
LDAP
Application
Auth/
LDAP
VPN
Direct
Connect
AD
EC2
AD
EC2
AD

27. Auth/
LDAP
Auth/
LDAP
DB
RDS for
SQL Server
Availability Zone
Private Subnet
10.0.2.0/24
APPWEB
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
APPWEB
App
Server
IIS
Server
Remote
Users/Admins
Domain
Controllers
Corporate data center
Example:
AWS Microsoft AD trust
to on-premises
DB
RDS
SQL Server
AWS Managed Services
AWS Managed Services
AWS Managed
Microsoft AD
DC
AWS Managed
Microsoft AD
Trust
Application
Auth/
LDAP
VPN
Direct
Connect
AD
DC
DC

28. Availability Zone
Private Subnet
10.0.2.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Remote
Users / Admins
Domain
Controllers
Corporate data center
Example:
AD on EC2 with sync
Domain
Controller
Domain
Controller
Sync
Auth/
LDAP
Auth/
LDAP
Application
Auth/
LDAP
Third-party sync tool
Users lose single sign-on to cloud
(same sign-on)
VPN
Direct
Connect
AD
EC2
AD
EC2
AD
Sync
Tool
Password
Changes

29. Considerations for AWS apps/services and many VPCs
AWS Microsoft AD requires a trust when used with on-premises AD*
WorkSpaces and RDS for SQL must be in same VPC as AWS
Microsoft AD, QuickSight in the same account
• Option 1 – Least cost, fewest trusts
• Deploy AWS Microsoft AD in one VPC
• Deploy all RDS for SQL and WorkSpaces instances in same VPC
• Use tagging for internal billing
• Option 2 – Easiest billing, complex trust configuration, high cost
• Deploy AWS Microsoft AD in each VPC
• Deploy RDS for SQL and WorkSpaces instance(s) in each VPC
*1-way trust for RDS for SQL Server, 2-way trust to provision Amazon WorkSpaces, Amazon QuickSight etc.

30. How to choose – Considerations for selection

31. Deployment differences – Operations effort
AWS Microsoft AD EC2 AD instances On-premises AD
Operation
management
+AWS managed
in the cloud
-Customer managed
in the cloud
-Customer managed
own hardware
Availability
+Built-in redundancy
and replication
-Customer must design
for high availability
-Customer must design
for high availability
Networking
Trust1 ports from cloud
to on-premises
(least exposed)
Trust1 or replication2
ports from cloud to
on-premises AD
-Open ports to support
cloud to on-premises
AD3
(most exposed)
Admin control
Designated OU control;
some apps unsupported
+Full control +Full control
1 If trust to on-premises is used, open ports from DCs to on-premises DCs are needed
2 AD replication requires more open ports than forest trusts, but limited to DC-to-DC communications
3 Ports for domain joining, AD interactions, LDAP etc., plus other firewall decisions for cloud to on-premises access

32. Deployment differences – Connection model effort
AWS Microsoft
AD with Sync
AWS
Microsoft AD
with Trust
EC2 AD
with Sync
EC2 AD
with Trust
EC2 AD
Replicated
On-
premises
App Access
SSO to cloud No Yes No Yes Yes Yes
Complexity/Effort
EC2 seamless domain
join
Yes Yes No No No No
DC configuration Medium Low Highest High High None
Incremental
maintenance
High Low Highest Low Medium None
Incremental system Medium Low Highest High High None
Incremental
entitlement
High Low High Low None None
Sites and Services No No No No Yes None
Untested Recommended If necessary

33. Deployment differences – Appropriate use cases
AWS Microsoft AD EC2 AD instances On-premises AD
• Minimize cost, effort to run AD
• RDS for SQL Server1
• AWS Enterprise Applications1
• Windows workloads on EC22
E.g. SharePoint, SQL Server
AlwaysOn Availability Groups,
.NET applications
• Federation to Office 365 and AD
FS compatible SaaS apps3
• Require a replicated, multi-
region AD solution
• Need NetBIOS name resolution
support
• Require permissions not yet
delegated by AWS Microsoft
AD4
E.g. Exchange
• Minimal EC2 instances require
access to AD
• Latency to AD over on-premises
link is acceptable
• Comfortable with connectivity
availability to on-premises AD
1RDS for SQL, WorkSpaces, QuickSight, and Chime require trusts only if users are on-premises via trust
2Subject to delegation constraints (e.g. password sync, special AD containers)
3Blog post coming on how to use Azure AD Connect and Active Directory Federation Service
4AWS adding more delegations and application enablement over time

34. Trusts vs. Sync – Alternatives to replication

35. Customer Feedback: Why sync vs. trusts
Trusts seem scary
• Many admins are unfamiliar with the model and how to secure
• Perception that a trust gives all cloud resources access to on-premises
• Perception that trusts give cloud admins control over on-premises directory
• Trusts require setup coordination (security review, firewall ports, trust setup)
• “Breaks principle” of communication initiation only from on-premises to the cloud
“We are isolating our on-premises from the cloud and need a few users sync’d”
• Only deploying SaaS applications in cloud (built on Windows)
• Only need subset of Windows users with “same sign-on”
to manage AWS resources via AD

36. Considerations for syncing identities to the cloud
Do your on-premises users need access to cloud resources
that use AD group-based authorization?
• If yes, will users object to having to log out of on-premises
and log in to the cloud? (Same sign-on, not single sign-on)
Requires third-party sync tool
• Special configuration for what gets synced
• Must map from on-premises directory to AD structure in the cloud
With AWS Microsoft AD, the tool must not require domain admin
• User creations must be in your OU
Sync adds configuration complexity and latency for managing users
• Incremental entitlements for sync
• What about security groups? How does sync map them to the cloud?

37. Amazon EC2
Amazon
DynamoDB
Amazon EC2
Appropriate for sync – Admins’ user names for RDP
App
Federated AuthN
(SAML) Kerb
AuthN
Domain Join/Machine AuthN/GPO/LDAP
AD
On-premises
or Internet
Cloud
User AuthN/Group
Membership/Login Scripts
AWS Resource
Admin
Sync only
admin users

38. Amazon EC2
Amazon
DynamoDB
Amazon EC2
Complex for sync – Many users to many cloud services
App
Federated AuthN
(SAML) Kerberos
AuthZ
Domain Join/Machine AuthN/GPO/LDAP
AD
On-premises
or Internet
Cloud SQL Server AlwaysOn
SharePoint
Exchange
.NET

39. Forest trusts
Time tested, secure model
The trusting forest has no admin control
over the trusted forest
Trusted users have cloud resource
access, only if entitled by trusting
admins (you control both sides)
Resources in the cloud have no access
to on-premises resources unless on-
premises trusts the cloud AND on-
premises admins grant permissions to
user identities in the cloud
AD AD
On-premises
network
VPC
Trust
AWS Managed
Microsoft AD DC
Windows
AD DC
Access
Security group
(access entitlements here)
Security group
Trusting Trusted
Cloud On-premises

40. No trust vs. 1-way vs. 2-way trusts
Do you need users from one forest to access resources in another forest?
• If no, use no trust
Can you use only a 1-way trust?
• If yes, only use 1-way
• RDS for SQL Server with on-premises users requires at least 1-way
Is a 2-way trust required?
• If yes, use 2-way trust
• WorkSpaces, QuickSight Enterprise Edition, and Chime use 2-way trusts
• On-premises to AWS Microsoft AD trust used only to read users/groups to provision
them into the application
Always Secure Your Trust

41. Securing trusts
Leave SID filtering on when setting up the on-premises side of a trust
Turn on selective authentication on the on-premises side of a trust
• https://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx#w2k3tr_trust_security_zyzk
Only permit AD trust ports to the DCs in the cloud
• https://technet.microsoft.com/en-us/library/cc756944(v=ws.10).aspx
For cloud-client-to-AD, only permit AD authentication ports to on-premises AD;
minimize all other ports from cloud to on-premises
(e.g., WorkSpaces login using on-premises credentials)
• https://support.microsoft.com/en-us/help/179442/how-to-configure-a-firewall-for-domains-and-trusts
Don’t grant groups in the cloud access to on-premises resources

42. Recap
AD is used in many ways and is often required in the cloud
• Where AD-dependent systems exist affect where you place AD
AD on EC2 and AWS Microsoft AD have advantages
over using on-premises AD domain controllers
AD on EC2 is appropriate when you require full domain admin
permissions or a replicated AD in the cloud
AWS Microsoft AD is
• Appropriate to support resources in the cloud
• Required to support AWS applications and services with on-premises users
Trusts are secure and appropriate when you need SSO from on-premises to
AD-dependent workloads in the cloud
Synchronization may be appropriate for isolation with a small set of users
• Sync requires a compatible 3rd party solution and has many considerations

43. References
Documentation
• AWS Directory Service – aws.amazon.com/directoryservice
• AWS Microsoft AD – aws.amazon.com/documentation/directory-service/
• RDS for SQL Server – aws.amazon.com/documentation/rds/
AWS Quick Starts – aws.amazon.com/quickstart/
• Active Directory Domain Services
• Exchange Server 2013
• SharePoint Server 2016 Enterprise
• Lync Server 2013
• SQL Server 2014 AlwaysOn
• Windows PowerShell DSC

44. Pop-up Loft
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS