AWS Directory Service Features

AWS Managed Microsoft AD is actual Microsoft Active Directory (AD) running on AWS-managed infrastructure. This enables you to administer your users and devices in AWS Managed Microsoft AD by using the tools you already know, such as Active Directory Administrative Center and Active Directory Users and Computers.

Because directories are mission-critical infrastructure, AWS Managed Microsoft AD is deployed in high availability and across multiple Availability Zones. You can also scale out your AWS Managed Microsoft AD directory by deploying additional domain controllers to increase the resiliency of your managed directory for even higher availability.

AWS Managed Microsoft AD runs on AWS managed infrastructure with monitoring that automatically detects and replaces domain controllers that fail. In addition, data replication and automated daily snapshots are configured for you. You do not need to install software, and AWS handles all of the patching and software updates.

Multi-region replication enables you to deploy and use a single AWS Managed Microsoft AD directory across multiple AWS Regions. This makes it easier and more cost-effective for you to deploy and manage your Microsoft Windows and Linux workloads globally. With the automated multi-region replication capability, you get higher resiliency, while your applications use a local directory for optimal performance.

You can use AWS Managed Microsoft AD to build and run AD–aware cloud applications that are subject to the U.S. Health Insurance Portability and Accountability Act (HIPAA) or Payment Card Industry Data Security Standard (PCI DSS) compliance. AWS Managed Microsoft AD reduces the effort required to deploy compliant AD infrastructure for your cloud applications, as you manage your own HIPAA risk management programs or PCI DSS compliance certification.

You can easily integrate AWS Managed Microsoft AD with your existing AD by using AD trust relationships. Using trusts enables you to use your existing Active Directory to control which AD users can access your AWS resources.

AWS Managed Microsoft AD allows you to manage users and devices using native Active Directory Group Policy objects (GPOs). You can create GPOs with existing tools, such as the Group Policy Management Console (GPMC).

AWS Managed Microsoft AD uses the same Kerberos-based authentication as your existing on-premises AD. By integrating your AWS resources with AWS Managed Microsoft AD, your AD users will be able to sign in with SSO to AWS applications and resources using a single set of credentials.

AWS Managed Microsoft AD enables you to use seamless domain join for new and existing Amazon EC2 for Windows Server and Amazon EC2 for Linux instances. For new EC2 instances, you can choose which domain to join at launch time by using the AWS Management Console. You can use seamless domain join for existing EC2 instances by using the EC2Config service. Amazon EC2 instances can also join to a single shared directory from any AWS account and any Amazon VPC within a Region.

AWS Managed Microsoft AD enables you to use a single directory for your directory-aware workloads in AWS resources such as Amazon EC2 instances, Amazon RDS for SQL Server instances, and AWS End User Computing services, such as Amazon WorkSpaces. Sharing a directory allows your directory-aware workloads to easily manage Amazon EC2 instances across multiple AWS accounts and Amazon VPCs within a Region. It also helps avoid the complexity of replicating and synchronizing data across multiple directories.

You can grant your on-premises AD users access to sign in to the AWS Management Console and AWS CLI with their existing AD credentials with AWS Identity Center (successor to AWS SSO) by selecting AWS Managed Microsoft AD as the identity source. This enables your users to assume one of their assigned roles at sign-in, and to access and take action on the resources according to the permissions defined for the role. An alternative option is using AWS Managed Microsoft AD to enable your users to assume an AWS Identity and Access Management (IAM) role.

AWS Managed Microsoft AD provides built-in, daily, automated snapshots. You can also take additional snapshots before critical application updates to make sure you have the most recent data in case you need to roll back a change.