reference deployment

Active Directory Domain Services on AWS

Create or extend your AD DS environment, or use AD DS with AWS Directory Service

This Quick Start deploys Microsoft Active Directory Domain Services (AD DS) on the AWS Cloud. AD DS and Domain Name Server (DNS) are core Windows services that provide the foundation for many Microsoft-based solutions for the enterprise, including Microsoft SharePoint, Microsoft Exchange, and .NET Framework applications. The Quick Start supports three scenarios:

  • Deploying a new AWS Cloud-based AD DS environment that you manage yourself
  • Extending your existing on-premises AD DS to the AWS Cloud
  • Deploying AD DS with AWS Directory Service

For each scenario, you also have the option to create a new virtual private cloud (VPC) or use your existing VPC infrastructure.


This Quick Start was developed by
AWS solutions architects.

  •  What you'll build
  •  How to deploy
  •  Cost and licenses
  •  What you'll build
  • Use this Quick Start to automatically set up the following AD DS environment on AWS:

    • A virtual private cloud (VPC) configured with public and private subnets in two Availability Zones for high availability.*
    • Managed network address translation (NAT) gateways to allow outbound internet access for resources in the private subnets.*
    • Configuration for private and public routes.*
    • Remote Desktop Gateway instances in an Auto Scaling group in public subnets for secure remote access to instances in private subnets.*
    • Ingress traffic into the VPC for administrative access to Remote Desktop Gateway.*
    • Windows Server forest and domain functional level.
    • Security groups and rules for traffic between instances.

    For new AD DS installations, the Quick Start also deploys AD DS and AD-integrated DNS, and sets up Active Directory Sites and Subnets.

    If you choose to deploy AD DS with the AWS Active Directory Service, the Quick Start sets up AWS Directory Service to provision and manage AD DS in the private subnets.

    *  The template that deploys the Quick Start into an existing VPC skips the tasks marked by asterisks and prompts you for your existing VPC configuration.

  •  How to deploy
  • To build your AD DS environment on AWS, follow the instructions in the deployment guide. The deployment process includes these steps:

    1. If you don't already have an AWS account, sign up at
    2. Launch the Quick Start. Each deployment takes about one hour. You can choose from the following options:
    3. If you're extending your on-premises AD DS to the cloud, complete a few connection and configuration tasks to ensure that your hybrid environment works properly.

    Customization options include CIDR block sizes, Remote Desktop Gateway and domain controller instance types and IP addresses, and Active Directory configuration.

  •  Cost and licenses
  • You are responsible for the cost of the AWS services used while running this Quick Start reference deployment. There is no additional cost for using the Quick Start.

    The AWS CloudFormation template for this Quick Start includes configuration parameters that you can customize. Some of these settings, such as instance type, will affect the cost of deployment. For cost estimates, see the pricing pages for each AWS service you will be using. Prices are subject to change.

    This Quick Start launches the Amazon Machine Image (AMI) for Microsoft Windows Server 2016 and includes the license for the Windows Server operating system. The AMI is updated on a regular basis with the latest service pack for the operating system, so you don’t have to install any updates. The Windows Server AMI doesn’t require Client Access Licenses (CALs) and includes two Microsoft Remote Desktop Services licenses. For details, see Microsoft Licensing on AWS.