SlideShare a Scribd company logo
1 of 34
Best Practices for Active Directory
with AWS Workloads
Ron Cully, Senior Product Manager
AWS Directory Service
What to Expect from the Session
Models – how AD is used (why is AD relevant in the cloud)
Options – AD deployment for Windows workloads in cloud
How to choose – considerations for selection
Models – how AD is used
Models of AD Use
Domain Join/Machine Authn/GPO/LDAP
Aunthn – Authentication
GPO – Group Policy Object
LDAP – Lightweight Directory Access Protocol
Models of AD Use
User Authn/Group Membership/Login Sripts
Domain Join/Machine Authn/GPO/LDAP
Aunthn – Authentication
GPO – Group Policy Object
LDAP – Lightweight Directory Access Protocol
Models of AD Use
User Authn/Group Mbrshp/Login Sripts
Domain Join/Machine Authn/GPO/LDAP
Models of AD Use
App
DB
App
User Authn/Group Mbrshp/Login Sripts
Federated Authn
(SAML) Kerb
Authn
Domain Join/Machine Authn/GPO/LDAP
Amazon EC2
Amazon
DynamoDB
Amazon
WorkSpaces
Amazon EC2
Models of AD Use
App
User Authn/Group Mbrshp/Login Sripts
Federated Authn
(SAML) Kerb
Authn
Domain Join/Machine Authn/GPO/LDAP
?RDS
SQL Server
Options – AD deployment for Windows
workloads in cloud
AD Options – On-premises
• Create VPN or Amazon Direct
Connect link to your VPC
• Manually domain join EC2 instances
to on-premises
• Use VPC as an extension of your
network
– Security considerations
• Latency considerations?
On-premises
Windows Server DC
AD
You Manage
1
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC
Generally accepted as a bad idea
AD Options – EC2 Self-managed
• Your responsibilities
– Availability deployment strategy
– EC2 DC configuration
• DNS configuration
• Sites & Services configuration
– Monitoring
– DC recovery
– Backup
– Restore
– Security group configuration
– Manual EC2 domain joining
– Patch Tuesday management
Microsoft AD w/trust to your AD required to support WorkSpaces, QuickSight, or Chime
On-premises
Windows Server DC
AD
You Manage
1
VPC
EC2 Windows
Server DC
AD
You Manage
2
AD Options – Where to run AD
On-premises
Windows Server DC
AD
You Manage
1
VPC
EC2 Windows
Server DC
AD
You Manage
2
VPC Endpoint
EC2 Windows
Server DC
AWS Manages
3
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. “Microsoft AD”
DC – Active Directory Domain Controller
VPC – Amazon Virtual Private Cloud
Endpoint – Accessed via IP address in your VPC
AD Options – “Microsoft AD”
• Windows 2012 R2 domain controllers (DC)
– ~3-click set-up
– 2 DCs each in a different Availability Zone (AZ)
• Stand-alone or connected to your AD w/trusts
• AWS apps and services integration
– EC2 seamless domain join
– RDS SQL Server authentication, authorization
– WorkSpaces, QuickSight Enterprise, Chime Plus/Pro
provisioning & authentication
• Some constraints
– AWS is domain admin
– You get an OU and delegated admin over the OU
– AWS apps/services/EC21 must be in same VPC
– Conservative delegated permissions2 to you
• Application enablement limits some apps
• Some admin functions unavailable
VPC Endpoint
EC2 Windows
Server DC
AWS Directory Service
for Microsoft Active Directory
(Enterprise Edition)
a.k.a. “Microsoft AD”
1EC2 can domain join manually in peered VPC configurations
2Delegations are being expanded over time
• Amazon responsibilities - Operate
– Patch, monitor, DC recovery, snap-
shot, restore
• Your responsibilities - Administer
– Administration via Active Directory
Users and Computers (ADUC) and
other standard AD tools
– Administer users, groups, GPOs,
other AD content
AD Options – Connecting AD in cloud to on-pemises AD
1
Replication
Your DCs only
On-premises
Windows Server DC
AD
VPC
EC2 Windows
Server DC
AD
On-premises
Windows Server DC
AD
VPC
EC2 Windows
Server DC
AD2
1-way Trust
2-way Trust
Your DCs or
Microsoft AD
On-premises
Windows Server DC
AD
VPC
EC2 Windows
Server DC
AD3
Sync Users Depends
(3rd party sync)
Application
Availability Zone
Private Subnet
10.0.2.0/24
SQL
Server
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
SQL
Server
App
Server
IIS
Server
Remote
Users / Admins
Domain
Controllers
corporate data center
DBAPPWEB
DBAPPWEB
Auth/
LDAP
Auth/
LDAP
VPN
Direct
Connect
Example:
On-premises AD
AD
Availability Zone
Private Subnet
10.0.2.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Remote
Users / Admins
Domain
Controllers
corporate data center
Example: AD on
EC2 with replication
or AD trust
Domain
Controller
Domain
Controller
Trust or Replication
Auth/
LDAP
Auth/
LDAP
Application
Auth/
LDAP
VPN
Direct
Connect
AD
EC2
AD
EC2
AD
Auth/
LDAP
Auth/
LDAP
DB
RDS
SQL Server
Availability Zone
Private Subnet
10.0.2.0/24
APPWEB
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
APPWEB
App
Server
IIS
Server
Remote
Users / Admins
Domain
Controllers
corporate data center
Example: AWS
Microsoft AD with
AD trust to on-prem
DB
RDS
SQL Server
AWS Managed Services
AWS Managed Services
Domain
Controller
DC
Domain
Controller
Trust
Application
Auth/
LDAP
VPN
Direct
Connect
AD
AD
AD
Availability Zone
Private Subnet
10.0.2.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Availability Zone
Private Subnet
10.0.3.0/24
DBAPPWEB
SQL
Server
App
Server
IIS
Server
Remote
Users / Admins
Domain
Controllers
corporate data center
Example: AD on
EC2 with sync
Domain
Controller
Domain
Controller
Sync
Auth/
LDAP
Auth/
LDAP
Application
Auth/
LDAP
3rd party sync tool
Users loose single sign-on to cloud
(same sign-on)
VPN
Direct
Connect
AD
EC2
AD
EC2
AD
Sync
Tool
Password
Changes
Considerations for AWS apps and services when many VPCs
• AWS apps and services can’t integrate directly with your self-managed AD
– Microsoft AD with trust required to use a self-managed AD for credentials
(some regions AD Connector may be option)
• WorkSpaces/RDS SQL must be in same VPC as Microsoft AD
– Option 1 – Least cost, fewest trusts
• Deploy Microsoft AD in one VPC
– Use trust to your AD if integrating for use with “on-premises” users*
• Deploy all RDS SQL/WorkSpaces instances in same VPC with tagging for internal billing
– Option 2 – Least VPC peering, easiest billing
• Deploy Microsoft AD in each VPC
– Use trust from each VPC to your AD for use with “on-premises” users*
• Deploy RDS SQL/WorkSpaces instance(s) in each VPC
• QuickSight Enterprise must be in same account as Microsoft AD
*1-way trust for RDS SQL Server, 2-way trust for others
How to choose – considerations for
selection
Deployment Differences
AWS Microsoft AD EC2 AD Instance On-Premises AD
Operation
Management
+AWS managed
in the cloud
-Customer managed
in the cloud
-Customer managed
own hardware
Availability
+Built-in redundancy and
replication
-Customer must design for
high availability
-Customer must design for
high availability
Networking
Trust1 ports from cloud to
on-premises
(least exposed)
Trust1 or replication2 ports
from cloud to
on-premises AD
-Open ports to support
cloud to on-premises AD3
(most exposed)
Admin Control
Designated OU control;
-some apps unsupported
+Full control +Full control
1
2
3
Hint
How to select an Active Directory option
AWS Microsoft AD EC2 AD Instances On-Premises AD
• Minimize cost, effort to run AD
• RDS SQL Server1
• AWS Enterprise Applications1
• Windows workloads on EC22
• Require a replicated, multi-region
AD solution
• Need NetBIOS name resolution
support
• You require permissions not yet
delegated by AWS Microsoft AD3
• E.g. Exchange, Sharepoint, SQL
Server AlwaysOn Availability
Groups
• Minimal EC2 instances require
access to AD
• Latency to AD over on-premises
link is acceptable
• Comfortable with connectivity
availability to on-premises AD
1RDS SQL, WorkSpaces, QuickSight, and Chime require trusts only if users are on-premises via trust
2Subject to delegation constraints (e.g. managed service account creation)
3AWS adding more delegations and application enablement over time
Deployment Differences – which connection model?
AWS Microsoft
AD w/Sync
AWS Microsoft
AD w/Trust
EC2 AD
w/Sync
EC2 AD
w/Trust
EC2 AD
Replicated
On-premises
App Access
SSO to cloud No Yes No Yes Yes Yes
Complexity/Effort
EC2 Seamless domain join Yes Yes No No No No
DC configuration Medium Low Highest High High None
Incremental Maintenance High Low Highest Low Medium None
Incremental system Medium Low Highest High High None
Incremental Entitlement High Low High Low None None
Sites & Services No No No No Yes None
Untested Recommended If necessary
Trusts vs. Sync
Why sync (instead of trust) comes up
• Trusts seem scary
– Unfamiliar with the model
– Unfamiliar with how to secure
– Belief that a trust gives all cloud resources access to on-premises
– Belief that trusts give cloud admins control over on-premises directory
– Trusts are hard to set up and maintain
• Security team review, firewall ports
– “Breaks principle” of communication initiation only from on-premises to the cloud
• Vast majority of users don’t need authentication into cloud resources
– Only deploying SAML applications in cloud but on Windows infrastructure
Consideration for Sync from on-premises to the cloud
• Do your on-premises users need access to cloud resources
that use AD group-based authorization?
– If yes, will users revolt having to log out of on-premises and log back in to the cloud?
• Same sign-on, not single sign-on
• Requires 3rd party sync tool
– Requires special configuration for what gets sync’d
– Must map from on-premises directory to directory structure in the cloud
• With Microsoft AD, the tool must not require domain admin
– User creates with your delegated OU admin
• Sync adds configuration complexity and latency for managing users
– Incremental entitlements for sync
– What about security groups? How does sync map them to the cloud?
Have good reasons, know what you’re getting into
Amazon EC2
Amazon
DynamoDB
Amazon EC2
Appropriate for sync – admins’ usernames for RDP
App
Federated Authn
(SAML) Kerb
Authn
Domain Join/Machine Authn/GPO/LDAP
AD
On-premises
or Internet
Cloud
Cloud
Amazon EC2
Amazon
DynamoDB
Amazon EC2
Complex for sync – many users to many cloud services
App
Federated Authn
(SAML) Kerb
Authn
Domain Join/Machine Authn/GPO/LDAP
AD
On-premises
or Internet
Cloud
Cloud SQL Server AlwaysOn
Sharepoint
Exchange
.NET
Forest Trusts
• Time tested, secure model
• Trusting forest has no admin control
of trusted forest
• Trusted users have cloud resource
access only if entitled by trusting
admins (you control both sides)
• Resources in cloud have no access
to on-premises resources without
entitlement and trust from on-
premises to the cloud
AD AD
On-premises
Network
VPC
Trust
AWS Microsoft
AD DC
Windows
AD DC
Access
Security Group
(access entitlements here)
Security Group
Trusting Trusted
Cloud On-premises
No trust vs. 1-way vs. 2-way Trusts
• Do you need users from one forest to access resources in another forest?
– If no, use no trust
• Can you use only a 1-way trust?
– If yes, only use 1-way
– RDS SQL Server w/on-premises users requires at least 1-way
• Is a 2-way trust required?
– If yes, use 2-way trust
– WorkSpaces, QuickSight Enterprise Edition, and Chime use 2-way trusts
Always Secure Your Trust
Securing Trusts
• Leave SID filtering on when setting up on-premises side of trust
• Turn on selective authentication on the on-premises side
– https://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx#w2k3tr_trust_security_zyzk
• Only permit AD trust ports to the DCs in the cloud
– https://technet.microsoft.com/en-us/library/cc756944(v=ws.10).aspx
• For cloud-client-to-AD, only permit AD authentication ports to on-premises AD;
minimize all other ports from cloud to on-premises
(e.g. WorkSpaces login using on-premises credentials)
– https://support.microsoft.com/en-us/help/179442/how-to-configure-a-firewall-for-domains-and-trusts
• Don’t grant groups in the cloud access to on-premises resources
References
• Documentation
– AWS Directory Service – aws.amazon.com/directoryservice
– Microsoft AD - aws.amazon.com/documentation/directory-service/
– RDS SQL Server - aws.amazon.com/documentation/rds/
• Quick Starts - aws.amazon.com/quickstart/
– Active Directory DS (Microsoft AD)
– Exchange Server 2013
– SharePoint 2016 Enterprise
– Lync Server 2013
– SQL Server 2014 AlwaysOn
– PowerShell DSC
Questions
?
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS

More Related Content

What's hot

Best Practices for Database Migration to the Cloud: Improve Application Perfo...
Best Practices for Database Migration to the Cloud: Improve Application Perfo...Best Practices for Database Migration to the Cloud: Improve Application Perfo...
Best Practices for Database Migration to the Cloud: Improve Application Perfo...Amazon Web Services
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Amazon Web Services
 
AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인
AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인
AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인Amazon Web Services Korea
 
Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech TalksLaunch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech TalksAmazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceAmazon Web Services
 
Landing Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsLanding Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsAmazon Web Services
 
Best Practices for Active Directory with AWS Workloads
Best Practices for Active Directory with AWS WorkloadsBest Practices for Active Directory with AWS Workloads
Best Practices for Active Directory with AWS WorkloadsAmazon Web Services
 
AWS Initiate Day Dublin 2019 – Cost Optimization on AWS
AWS Initiate Day Dublin 2019 – Cost Optimization on AWSAWS Initiate Day Dublin 2019 – Cost Optimization on AWS
AWS Initiate Day Dublin 2019 – Cost Optimization on AWSAmazon Web Services
 
Introduction to Amazon Relational Database Service (Amazon RDS)
Introduction to Amazon Relational Database Service (Amazon RDS)Introduction to Amazon Relational Database Service (Amazon RDS)
Introduction to Amazon Relational Database Service (Amazon RDS)Amazon Web Services
 
Amazon Relational Database Service (Amazon RDS)
Amazon Relational Database Service (Amazon RDS)Amazon Relational Database Service (Amazon RDS)
Amazon Relational Database Service (Amazon RDS)Amazon Web Services
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerAmazon Web Services
 
Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016
Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016
Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016Amazon Web Services
 

What's hot (20)

AWS Business Essentials
AWS Business EssentialsAWS Business Essentials
AWS Business Essentials
 
Best Practices for Database Migration to the Cloud: Improve Application Perfo...
Best Practices for Database Migration to the Cloud: Improve Application Perfo...Best Practices for Database Migration to the Cloud: Improve Application Perfo...
Best Practices for Database Migration to the Cloud: Improve Application Perfo...
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
 
AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인
AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인
AWS Control Tower를 통한 클라우드 보안 및 거버넌스 설계 - 김학민 :: AWS 클라우드 마이그레이션 온라인
 
Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech TalksLaunch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
Launch AWS Faster using Automated Landing Zones - AWS Online Tech Talks
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 
Landing Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS MigrationsLanding Zones - Creating a Foundation for Your AWS Migrations
Landing Zones - Creating a Foundation for Your AWS Migrations
 
AWS RDS
AWS RDSAWS RDS
AWS RDS
 
Best Practices for Active Directory with AWS Workloads
Best Practices for Active Directory with AWS WorkloadsBest Practices for Active Directory with AWS Workloads
Best Practices for Active Directory with AWS Workloads
 
Introduction to Amazon EC2
Introduction to Amazon EC2Introduction to Amazon EC2
Introduction to Amazon EC2
 
AWS Initiate Day Dublin 2019 – Cost Optimization on AWS
AWS Initiate Day Dublin 2019 – Cost Optimization on AWSAWS Initiate Day Dublin 2019 – Cost Optimization on AWS
AWS Initiate Day Dublin 2019 – Cost Optimization on AWS
 
Cost Optimisation on AWS
Cost Optimisation on AWSCost Optimisation on AWS
Cost Optimisation on AWS
 
Introduction to Amazon Relational Database Service (Amazon RDS)
Introduction to Amazon Relational Database Service (Amazon RDS)Introduction to Amazon Relational Database Service (Amazon RDS)
Introduction to Amazon Relational Database Service (Amazon RDS)
 
Amazon Relational Database Service (Amazon RDS)
Amazon Relational Database Service (Amazon RDS)Amazon Relational Database Service (Amazon RDS)
Amazon Relational Database Service (Amazon RDS)
 
Deploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control TowerDeploy and Govern at Scale with AWS Control Tower
Deploy and Govern at Scale with AWS Control Tower
 
Cloud Economics
Cloud EconomicsCloud Economics
Cloud Economics
 
Cost Optimization on AWS
Cost Optimization on AWSCost Optimization on AWS
Cost Optimization on AWS
 
AWS for Backup and Recovery
AWS for Backup and RecoveryAWS for Backup and Recovery
AWS for Backup and Recovery
 
Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016
Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016
Introduction to AWS Cloud Computing | AWS Public Sector Summit 2016
 
AWS Cloud Security Fundamentals
AWS Cloud Security FundamentalsAWS Cloud Security Fundamentals
AWS Cloud Security Fundamentals
 

Similar to Best Practices for Integrating Active Directory with AWS Workloads

SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...Amazon Web Services
 
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...Amazon Web Services
 
Best practices to Support Active Directory Aware Workloads on AWS
Best practices to Support Active Directory Aware Workloads on AWSBest practices to Support Active Directory Aware Workloads on AWS
Best practices to Support Active Directory Aware Workloads on AWSAmazon Web Services
 
Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...
Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...
Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...Amazon Web Services
 
AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...
AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...
AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...Amazon Web Services
 
Using Active Directory in AWS
Using Active Directory in AWSUsing Active Directory in AWS
Using Active Directory in AWSAllice Shandler
 
Using Active Directory in AWS
Using Active Directory in AWSUsing Active Directory in AWS
Using Active Directory in AWSTriNimbus
 
Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud Amazon Web Services
 
ENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS ServicesENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS ServicesAmazon Web Services
 
Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...
Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...
Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...AWS Germany
 
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud Amazon Web Services
 
Migrating Microsoft Applications to AWS like an Expert
Migrating Microsoft Applications to AWS like an ExpertMigrating Microsoft Applications to AWS like an Expert
Migrating Microsoft Applications to AWS like an ExpertAmazon Web Services
 
Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...
Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...
Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...Amazon Web Services
 
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the CloudAmazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the CloudAmazon Web Services
 
Using Microsoft Active Directory across On-premises and Cloud Workloads
Using Microsoft Active Directory across On-premises and Cloud WorkloadsUsing Microsoft Active Directory across On-premises and Cloud Workloads
Using Microsoft Active Directory across On-premises and Cloud WorkloadsAmazon Web Services
 
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud Amazon Web Services
 
AWS Summit Auckland - Running your Enterprise Windows Workload on AWS
AWS Summit Auckland  - Running your Enterprise Windows Workload on AWSAWS Summit Auckland  - Running your Enterprise Windows Workload on AWS
AWS Summit Auckland - Running your Enterprise Windows Workload on AWSAmazon Web Services
 
AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...
AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...
AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...Amazon Web Services
 

Similar to Best Practices for Integrating Active Directory with AWS Workloads (20)

SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
 
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
SEC306 Using Microsoft Active Directory Across On-Premises and AWS Cloud Wind...
 
Best practices to Support Active Directory Aware Workloads on AWS
Best practices to Support Active Directory Aware Workloads on AWSBest practices to Support Active Directory Aware Workloads on AWS
Best practices to Support Active Directory Aware Workloads on AWS
 
Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...
Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...
Best Practices for Active Directory with AWS Workloads | AWS Public Sector Su...
 
AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...
AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...
AWS re:Invent 2016: Best Practices for Integrating Active Directory with AWS ...
 
Microsoft Workloads on AWS
Microsoft Workloads on AWSMicrosoft Workloads on AWS
Microsoft Workloads on AWS
 
Using Active Directory in AWS
Using Active Directory in AWSUsing Active Directory in AWS
Using Active Directory in AWS
 
Using Active Directory in AWS
Using Active Directory in AWSUsing Active Directory in AWS
Using Active Directory in AWS
 
Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud Running Active Directory in the AWS Cloud
Running Active Directory in the AWS Cloud
 
ENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS ServicesENT201 Simplifying Microsoft Architectures with AWS Services
ENT201 Simplifying Microsoft Architectures with AWS Services
 
Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...
Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...
Hybride Cloud Infrastrukturen durch Integration mit Active Directory - AWS Cl...
 
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
 
Migrating Microsoft Applications to AWS like an Expert
Migrating Microsoft Applications to AWS like an ExpertMigrating Microsoft Applications to AWS like an Expert
Migrating Microsoft Applications to AWS like an Expert
 
Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...
Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...
Transitioning to the Next Generation Hybrid Cloud Operating Model- AWS Summit...
 
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the CloudAmazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
 
Using Microsoft Active Directory across On-premises and Cloud Workloads
Using Microsoft Active Directory across On-premises and Cloud WorkloadsUsing Microsoft Active Directory across On-premises and Cloud Workloads
Using Microsoft Active Directory across On-premises and Cloud Workloads
 
AWS Migration Day - Windows Workloads
AWS Migration Day - Windows WorkloadsAWS Migration Day - Windows Workloads
AWS Migration Day - Windows Workloads
 
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud Amazon WorkSpaces - Fully Managed Desktops in the Cloud
Amazon WorkSpaces - Fully Managed Desktops in the Cloud
 
AWS Summit Auckland - Running your Enterprise Windows Workload on AWS
AWS Summit Auckland  - Running your Enterprise Windows Workload on AWSAWS Summit Auckland  - Running your Enterprise Windows Workload on AWS
AWS Summit Auckland - Running your Enterprise Windows Workload on AWS
 
AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...
AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...
AWS re:Invent 2016: Managing and Supporting the Windows Platform on AWS (GPSS...
 

More from Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateAmazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSAmazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsAmazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareAmazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSAmazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAmazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareAmazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWSAmazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckAmazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without serversAmazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSAmazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Come costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWSCome costruire un'architettura Serverless nel Cloud AWS
Come costruire un'architettura Serverless nel Cloud AWS
 

Recently uploaded

Machine learning workshop, CZU Prague 2024
Machine learning workshop, CZU Prague 2024Machine learning workshop, CZU Prague 2024
Machine learning workshop, CZU Prague 2024Gokulks007
 
Dynamics of Professional Presentationpdf
Dynamics of Professional PresentationpdfDynamics of Professional Presentationpdf
Dynamics of Professional Presentationpdfravleel42
 
The Real Story Of Project Manager/Scrum Master From Where It Came?!
The Real Story Of Project Manager/Scrum Master From Where It Came?!The Real Story Of Project Manager/Scrum Master From Where It Came?!
The Real Story Of Project Manager/Scrum Master From Where It Came?!Loay Mohamed Ibrahim Aly
 
Communication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptxCommunication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptxkb31670
 
Juan Pablo Sugiura - eCommerce Day Bolivia 2024
Juan Pablo Sugiura - eCommerce Day Bolivia 2024Juan Pablo Sugiura - eCommerce Day Bolivia 2024
Juan Pablo Sugiura - eCommerce Day Bolivia 2024eCommerce Institute
 
ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8
ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8
ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8Access Innovations, Inc.
 
Communication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptxCommunication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptxkb31670
 
Burning Issue presentation of Zhazgul N. , Cycle 54
Burning Issue presentation of Zhazgul N. , Cycle 54Burning Issue presentation of Zhazgul N. , Cycle 54
Burning Issue presentation of Zhazgul N. , Cycle 54ZhazgulNurdinova
 

Recently uploaded (8)

Machine learning workshop, CZU Prague 2024
Machine learning workshop, CZU Prague 2024Machine learning workshop, CZU Prague 2024
Machine learning workshop, CZU Prague 2024
 
Dynamics of Professional Presentationpdf
Dynamics of Professional PresentationpdfDynamics of Professional Presentationpdf
Dynamics of Professional Presentationpdf
 
The Real Story Of Project Manager/Scrum Master From Where It Came?!
The Real Story Of Project Manager/Scrum Master From Where It Came?!The Real Story Of Project Manager/Scrum Master From Where It Came?!
The Real Story Of Project Manager/Scrum Master From Where It Came?!
 
Communication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptxCommunication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptx
 
Juan Pablo Sugiura - eCommerce Day Bolivia 2024
Juan Pablo Sugiura - eCommerce Day Bolivia 2024Juan Pablo Sugiura - eCommerce Day Bolivia 2024
Juan Pablo Sugiura - eCommerce Day Bolivia 2024
 
ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8
ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8
ISO 25964-1Working Group ISO/TC 46/SC 9/WG 8
 
Communication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptxCommunication Accommodation Theory Kaylyn Benton.pptx
Communication Accommodation Theory Kaylyn Benton.pptx
 
Burning Issue presentation of Zhazgul N. , Cycle 54
Burning Issue presentation of Zhazgul N. , Cycle 54Burning Issue presentation of Zhazgul N. , Cycle 54
Burning Issue presentation of Zhazgul N. , Cycle 54
 

Best Practices for Integrating Active Directory with AWS Workloads

  • 1. Best Practices for Active Directory with AWS Workloads Ron Cully, Senior Product Manager AWS Directory Service
  • 2. What to Expect from the Session Models – how AD is used (why is AD relevant in the cloud) Options – AD deployment for Windows workloads in cloud How to choose – considerations for selection
  • 3. Models – how AD is used
  • 4. Models of AD Use Domain Join/Machine Authn/GPO/LDAP Aunthn – Authentication GPO – Group Policy Object LDAP – Lightweight Directory Access Protocol
  • 5. Models of AD Use User Authn/Group Membership/Login Sripts Domain Join/Machine Authn/GPO/LDAP Aunthn – Authentication GPO – Group Policy Object LDAP – Lightweight Directory Access Protocol
  • 6. Models of AD Use User Authn/Group Mbrshp/Login Sripts Domain Join/Machine Authn/GPO/LDAP
  • 7. Models of AD Use App DB App User Authn/Group Mbrshp/Login Sripts Federated Authn (SAML) Kerb Authn Domain Join/Machine Authn/GPO/LDAP
  • 8. Amazon EC2 Amazon DynamoDB Amazon WorkSpaces Amazon EC2 Models of AD Use App User Authn/Group Mbrshp/Login Sripts Federated Authn (SAML) Kerb Authn Domain Join/Machine Authn/GPO/LDAP ?RDS SQL Server
  • 9. Options – AD deployment for Windows workloads in cloud
  • 10. AD Options – On-premises • Create VPN or Amazon Direct Connect link to your VPC • Manually domain join EC2 instances to on-premises • Use VPC as an extension of your network – Security considerations • Latency considerations? On-premises Windows Server DC AD You Manage 1 DC – Active Directory Domain Controller VPC – Amazon Virtual Private Cloud Endpoint – Accessed via IP address in your VPC Generally accepted as a bad idea
  • 11. AD Options – EC2 Self-managed • Your responsibilities – Availability deployment strategy – EC2 DC configuration • DNS configuration • Sites & Services configuration – Monitoring – DC recovery – Backup – Restore – Security group configuration – Manual EC2 domain joining – Patch Tuesday management Microsoft AD w/trust to your AD required to support WorkSpaces, QuickSight, or Chime On-premises Windows Server DC AD You Manage 1 VPC EC2 Windows Server DC AD You Manage 2
  • 12. AD Options – Where to run AD On-premises Windows Server DC AD You Manage 1 VPC EC2 Windows Server DC AD You Manage 2 VPC Endpoint EC2 Windows Server DC AWS Manages 3 AWS Directory Service for Microsoft Active Directory (Enterprise Edition) a.k.a. “Microsoft AD” DC – Active Directory Domain Controller VPC – Amazon Virtual Private Cloud Endpoint – Accessed via IP address in your VPC
  • 13. AD Options – “Microsoft AD” • Windows 2012 R2 domain controllers (DC) – ~3-click set-up – 2 DCs each in a different Availability Zone (AZ) • Stand-alone or connected to your AD w/trusts • AWS apps and services integration – EC2 seamless domain join – RDS SQL Server authentication, authorization – WorkSpaces, QuickSight Enterprise, Chime Plus/Pro provisioning & authentication • Some constraints – AWS is domain admin – You get an OU and delegated admin over the OU – AWS apps/services/EC21 must be in same VPC – Conservative delegated permissions2 to you • Application enablement limits some apps • Some admin functions unavailable VPC Endpoint EC2 Windows Server DC AWS Directory Service for Microsoft Active Directory (Enterprise Edition) a.k.a. “Microsoft AD” 1EC2 can domain join manually in peered VPC configurations 2Delegations are being expanded over time • Amazon responsibilities - Operate – Patch, monitor, DC recovery, snap- shot, restore • Your responsibilities - Administer – Administration via Active Directory Users and Computers (ADUC) and other standard AD tools – Administer users, groups, GPOs, other AD content
  • 14. AD Options – Connecting AD in cloud to on-pemises AD 1 Replication Your DCs only On-premises Windows Server DC AD VPC EC2 Windows Server DC AD On-premises Windows Server DC AD VPC EC2 Windows Server DC AD2 1-way Trust 2-way Trust Your DCs or Microsoft AD On-premises Windows Server DC AD VPC EC2 Windows Server DC AD3 Sync Users Depends (3rd party sync)
  • 15. Application Availability Zone Private Subnet 10.0.2.0/24 SQL Server App Server IIS Server Availability Zone Private Subnet 10.0.3.0/24 SQL Server App Server IIS Server Remote Users / Admins Domain Controllers corporate data center DBAPPWEB DBAPPWEB Auth/ LDAP Auth/ LDAP VPN Direct Connect Example: On-premises AD AD
  • 16. Availability Zone Private Subnet 10.0.2.0/24 DBAPPWEB SQL Server App Server IIS Server Availability Zone Private Subnet 10.0.3.0/24 DBAPPWEB SQL Server App Server IIS Server Remote Users / Admins Domain Controllers corporate data center Example: AD on EC2 with replication or AD trust Domain Controller Domain Controller Trust or Replication Auth/ LDAP Auth/ LDAP Application Auth/ LDAP VPN Direct Connect AD EC2 AD EC2 AD
  • 17. Auth/ LDAP Auth/ LDAP DB RDS SQL Server Availability Zone Private Subnet 10.0.2.0/24 APPWEB App Server IIS Server Availability Zone Private Subnet 10.0.3.0/24 APPWEB App Server IIS Server Remote Users / Admins Domain Controllers corporate data center Example: AWS Microsoft AD with AD trust to on-prem DB RDS SQL Server AWS Managed Services AWS Managed Services Domain Controller DC Domain Controller Trust Application Auth/ LDAP VPN Direct Connect AD AD AD
  • 18. Availability Zone Private Subnet 10.0.2.0/24 DBAPPWEB SQL Server App Server IIS Server Availability Zone Private Subnet 10.0.3.0/24 DBAPPWEB SQL Server App Server IIS Server Remote Users / Admins Domain Controllers corporate data center Example: AD on EC2 with sync Domain Controller Domain Controller Sync Auth/ LDAP Auth/ LDAP Application Auth/ LDAP 3rd party sync tool Users loose single sign-on to cloud (same sign-on) VPN Direct Connect AD EC2 AD EC2 AD Sync Tool Password Changes
  • 19. Considerations for AWS apps and services when many VPCs • AWS apps and services can’t integrate directly with your self-managed AD – Microsoft AD with trust required to use a self-managed AD for credentials (some regions AD Connector may be option) • WorkSpaces/RDS SQL must be in same VPC as Microsoft AD – Option 1 – Least cost, fewest trusts • Deploy Microsoft AD in one VPC – Use trust to your AD if integrating for use with “on-premises” users* • Deploy all RDS SQL/WorkSpaces instances in same VPC with tagging for internal billing – Option 2 – Least VPC peering, easiest billing • Deploy Microsoft AD in each VPC – Use trust from each VPC to your AD for use with “on-premises” users* • Deploy RDS SQL/WorkSpaces instance(s) in each VPC • QuickSight Enterprise must be in same account as Microsoft AD *1-way trust for RDS SQL Server, 2-way trust for others
  • 20. How to choose – considerations for selection
  • 21. Deployment Differences AWS Microsoft AD EC2 AD Instance On-Premises AD Operation Management +AWS managed in the cloud -Customer managed in the cloud -Customer managed own hardware Availability +Built-in redundancy and replication -Customer must design for high availability -Customer must design for high availability Networking Trust1 ports from cloud to on-premises (least exposed) Trust1 or replication2 ports from cloud to on-premises AD -Open ports to support cloud to on-premises AD3 (most exposed) Admin Control Designated OU control; -some apps unsupported +Full control +Full control 1 2 3 Hint
  • 22. How to select an Active Directory option AWS Microsoft AD EC2 AD Instances On-Premises AD • Minimize cost, effort to run AD • RDS SQL Server1 • AWS Enterprise Applications1 • Windows workloads on EC22 • Require a replicated, multi-region AD solution • Need NetBIOS name resolution support • You require permissions not yet delegated by AWS Microsoft AD3 • E.g. Exchange, Sharepoint, SQL Server AlwaysOn Availability Groups • Minimal EC2 instances require access to AD • Latency to AD over on-premises link is acceptable • Comfortable with connectivity availability to on-premises AD 1RDS SQL, WorkSpaces, QuickSight, and Chime require trusts only if users are on-premises via trust 2Subject to delegation constraints (e.g. managed service account creation) 3AWS adding more delegations and application enablement over time
  • 23. Deployment Differences – which connection model? AWS Microsoft AD w/Sync AWS Microsoft AD w/Trust EC2 AD w/Sync EC2 AD w/Trust EC2 AD Replicated On-premises App Access SSO to cloud No Yes No Yes Yes Yes Complexity/Effort EC2 Seamless domain join Yes Yes No No No No DC configuration Medium Low Highest High High None Incremental Maintenance High Low Highest Low Medium None Incremental system Medium Low Highest High High None Incremental Entitlement High Low High Low None None Sites & Services No No No No Yes None Untested Recommended If necessary
  • 25. Why sync (instead of trust) comes up • Trusts seem scary – Unfamiliar with the model – Unfamiliar with how to secure – Belief that a trust gives all cloud resources access to on-premises – Belief that trusts give cloud admins control over on-premises directory – Trusts are hard to set up and maintain • Security team review, firewall ports – “Breaks principle” of communication initiation only from on-premises to the cloud • Vast majority of users don’t need authentication into cloud resources – Only deploying SAML applications in cloud but on Windows infrastructure
  • 26. Consideration for Sync from on-premises to the cloud • Do your on-premises users need access to cloud resources that use AD group-based authorization? – If yes, will users revolt having to log out of on-premises and log back in to the cloud? • Same sign-on, not single sign-on • Requires 3rd party sync tool – Requires special configuration for what gets sync’d – Must map from on-premises directory to directory structure in the cloud • With Microsoft AD, the tool must not require domain admin – User creates with your delegated OU admin • Sync adds configuration complexity and latency for managing users – Incremental entitlements for sync – What about security groups? How does sync map them to the cloud? Have good reasons, know what you’re getting into
  • 27. Amazon EC2 Amazon DynamoDB Amazon EC2 Appropriate for sync – admins’ usernames for RDP App Federated Authn (SAML) Kerb Authn Domain Join/Machine Authn/GPO/LDAP AD On-premises or Internet Cloud Cloud
  • 28. Amazon EC2 Amazon DynamoDB Amazon EC2 Complex for sync – many users to many cloud services App Federated Authn (SAML) Kerb Authn Domain Join/Machine Authn/GPO/LDAP AD On-premises or Internet Cloud Cloud SQL Server AlwaysOn Sharepoint Exchange .NET
  • 29. Forest Trusts • Time tested, secure model • Trusting forest has no admin control of trusted forest • Trusted users have cloud resource access only if entitled by trusting admins (you control both sides) • Resources in cloud have no access to on-premises resources without entitlement and trust from on- premises to the cloud AD AD On-premises Network VPC Trust AWS Microsoft AD DC Windows AD DC Access Security Group (access entitlements here) Security Group Trusting Trusted Cloud On-premises
  • 30. No trust vs. 1-way vs. 2-way Trusts • Do you need users from one forest to access resources in another forest? – If no, use no trust • Can you use only a 1-way trust? – If yes, only use 1-way – RDS SQL Server w/on-premises users requires at least 1-way • Is a 2-way trust required? – If yes, use 2-way trust – WorkSpaces, QuickSight Enterprise Edition, and Chime use 2-way trusts Always Secure Your Trust
  • 31. Securing Trusts • Leave SID filtering on when setting up on-premises side of trust • Turn on selective authentication on the on-premises side – https://technet.microsoft.com/en-us/library/cc755321(v=ws.10).aspx#w2k3tr_trust_security_zyzk • Only permit AD trust ports to the DCs in the cloud – https://technet.microsoft.com/en-us/library/cc756944(v=ws.10).aspx • For cloud-client-to-AD, only permit AD authentication ports to on-premises AD; minimize all other ports from cloud to on-premises (e.g. WorkSpaces login using on-premises credentials) – https://support.microsoft.com/en-us/help/179442/how-to-configure-a-firewall-for-domains-and-trusts • Don’t grant groups in the cloud access to on-premises resources
  • 32. References • Documentation – AWS Directory Service – aws.amazon.com/directoryservice – Microsoft AD - aws.amazon.com/documentation/directory-service/ – RDS SQL Server - aws.amazon.com/documentation/rds/ • Quick Starts - aws.amazon.com/quickstart/ – Active Directory DS (Microsoft AD) – Exchange Server 2013 – SharePoint 2016 Enterprise – Lync Server 2013 – SQL Server 2014 AlwaysOn – PowerShell DSC
  • 34. aws.amazon.com/activate Everything and Anything Startups Need to Get Started on AWS