AWS Directory Service for Microsoft Active Directory, also known as AWS Microsoft AD, is an AWS-managed directory service built on actual Microsoft Active Directory and powered by Windows Server 2012 R2. With AWS Microsoft AD, you can easily integrate your Active Directory–dependent AWS workloads, such as Amazon EC2 for Microsoft Windows Server or Amazon RDS for SQL Server, custom .NET applications, and AWS Enterprise IT applications such Amazon WorkSpaces, with actual Microsoft Active Directory.

Get Started with AWS Directory Service for Free

Try AWS Directory Service

AWS Microsoft AD is actual Microsoft Active Directory running on AWS-managed infrastructure. This enables you to administer your users and devices in AWS Microsoft AD by using the tools you already know, such as Active Directory Administrative Center and Active Directory Users and Computers.


Because directories are mission-critical infrastructure, AWS Microsoft AD is deployed in HA and across multiple Availability Zones. You can also scale out your AWS Microsoft AD directory by deploying additional domain controllers to increase the resiliency of your managed directory for even higher availability.


AWS Microsoft AD runs on AWS managed infrastructure with monitoring that automatically detects and replaces domain controllers that fail. In addition, data replication and automated daily snapshots are configured for you. You do not need to install software, and AWS handles all of the patching and software updates.


You can use AWS Microsoft AD to build and run Active Directory (AD)–aware applications in the AWS Cloud that are subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA) or Payment Card Industry Data Security Standard (PCI DSS) compliance. AWS Microsoft AD reduces the effort required of you to deploy compliant AD infrastructure for your cloud-based applications, as you manage your own HIPAA risk management programs or PCI DSS compliance certification.


You can integrate AWS Microsoft AD easily with your existing Active Directory by using Active Directory trust relationships. Using trusts, you can configure AWS Microsoft AD as a resource domain and control which Active Directory users can access your AWS resources from your existing Active Directory.


Because AWS Microsoft AD is running on actual Microsoft Active Directory, you can manage users and devices by using native Active Directory Group Policy objects (GPOs). You can create GPOs with existing tools, such as the Group Policy Management Console (GPMC).


AWS Microsoft AD uses the same Kerberos-based authentication as Active Directory to deliver SSO. By integrating your AWS resources with AWS Microsoft AD, your users will be able to sign in with SSO to AWS applications and resources with a single set of credentials.


AWS Microsoft AD enables you to use seamless domain join for new and existing Amazon EC2 for Windows Server instances. For new EC2 for Windows Server instances, you can choose which domain to join at launch time by using the AWS Management Console. You can use seamless domain join for existing EC2 for Windows Server instances by using the EC2Config service.


Rather than using separate directories for your cloud workloads, AWS Microsoft AD enables you to use a single directory for your cloud resources. By using a single directory, you do not have to manage the overhead of synchronizing data and policies across multiple Active Directory, Lightweight Directory Access Protocol (LDAP), and custom directories.


AWS Microsoft AD makes it easy to federate access for users and groups to the AWS Management Console. Using federation helps improve the security of your AWS environment by eliminating individual user passwords and allowing you to manage access based on a single identity from Active Directory.


AWS Microsoft AD provides built-in, daily, automated snapshots. You can also take additional snapshots before critical application updates to make sure you have the most recent data in case you need to roll back a change.