AWS Directory Service
AWS Directory Service (also known as AWS Managed Microsoft AD) is a managed service that allows you to run Microsoft Active Directory (AD) directly in the AWS Cloud.
Instead of manually deploying Windows Server virtual machines, installing the Active Directory Domain Services (AD DS) role, configuring DNS replication, and managing security patching on your own, AWS handles the underlying infrastructure deployment and operational maintenance.
1. Core Architectural Options
AWS Directory Service provides three primary integration patterns depending on whether you want to build a completely fresh directory in the cloud, map to an existing legacy directory, or link hybrid corporate environments together.
AWS Managed Microsoft AD
This is actual Microsoft Active Directory running on native Windows Server infrastructure, fully managed by AWS.
Infrastructure Layout: When deployed, AWS automatically provisions a highly available pair of Domain Controllers distributed across two separate Availability Zones within your Amazon Virtual Private Cloud (VPC).
Automated Operations: AWS configures synchronous data replication between the controllers, monitors for host failures (automatically replacing broken nodes), performs daily snapshots, and handles all underlying software patching.
Editions: Available in Standard Edition (optimized for small to midsize workloads with up to 30,000 objects) and Enterprise Edition (built for massive organizations supporting up to 500,000 objects and enabling multi-region replication).
AD Connector
AD Connector is a lightweight directory gateway or proxy server. It does not store or cache any user credentials or directory records in the cloud.
How it Works: When an application or user inside AWS requests authentication, AD Connector acts as a pass-through layer, forwarding the LDAP protocol requests directly back to your physical, on-premises Active Directory Domain Controllers.
Use Case: This is the preferred choice when you want your existing corporate personnel to log into cloud systems or virtual workspaces using their exact current office passwords without replicating or syncing active directory databases to AWS.
Simple AD
Simple AD is a low-cost, basic directory service powered by a Samba 4-compatible server engine.
How it Works: It provides basic Active Directory compatibility (supporting standard LDAP, user accounts, group memberships, and Group Policy Objects), but it does not use actual Windows Server code under the hood.
Constraints: Because it is a basic implementation, it does not support advanced Windows features such as establishing trust relationships with other external domains, schema extensions, or integrating with managed relational database services.
2. Key Operational Features
Resource Trust Relationships
Using AWS Managed Microsoft AD (Enterprise or Hybrid), you can establish secure Forest Trusts (either one-way or two-way) between your cloud directory and your on-premises directory infrastructure. This allows corporate users to authenticate seamlessly against Windows workloads running on EC2 instances or cloud file shares without needing their identities fully migrated out of the home data center.
Seamless Domain Join
When launching virtual machines (both Windows and Linux EC2 instances) inside your VPC, you can configure them to join your managed domain automatically during the initial boot phase. This completely eliminates the need for administrators to log into individual servers manually to run configuration scripts or distribute localized private key (.pem) files.
Directory Sharing
To prevent you from having to deploy separate directory systems for every isolated team, AWS allows you to share a single central AWS Managed Microsoft AD directory across multiple separate AWS accounts and VPC networks. This simplifies identity architecture, centralizes directory administration, and cuts infrastructure costs significantly.