AWS Organizations

 

• It offers policy-based management for multiple AWS accounts.

Features

• With Organizations, you can create groups of accounts and then apply policies to those groups.
• Organizations provides you a policy framework for multiple AWS accounts. You can apply policies to a group of accounts or all the accounts in your organization.
• AWS Organizations enables you to set up a single payment method for all the AWS accounts in your organization through consolidated billing. With consolidated billing, you can see a combined view of charges incurred by all your accounts, as well as take advantage of pricing benefits from aggregated usage, such as volume discounts for EC2 and S3.
• AWS Organizations, like many other AWS services, is eventually consistent. It achieves high availability by replicating data across multiple servers in AWS data centers within its region.

Administrative Actions in Organizations

• Create an AWS account and add it to your organization, or add an existing AWS account to your organization.
• Organize your AWS accounts into groups called organizational units (OUs).
• Organize your OUs into a hierarchy that reflects your company’s structure.
• Centrally manage and attach policies to the entire organization, OUs, or individual AWS accounts.

Concepts

• An organization is a collection of AWS accounts that you can organize into a hierarchy and manage centrally.
• A management account is the AWS account you use to create your organization. You cannot change which account in your organization is the management account.
  • From the management account, you can create other accounts in your organization, invite and manage invitations for other accounts to join your organization, and remove accounts from your organization.
  • You can also attach policies to entities such as administrative roots, organizational units (OUs), or accounts within your organization.
  • The management account has the role of a payer account and is responsible for paying all charges accrued by the accounts in its organization.
• A member account is an AWS account, other than the management account, that is part of an organization. A member account can belong to only one organization at a time. The management account has the responsibilities of a payer account and is responsible for paying all charges that are accrued by the member accounts.
• An administrative root is the starting point for organizing your AWS accounts. The administrative root is the top-most container in your organization’s hierarchy. Under this root, you can create OUs to logically group your accounts and organize these OUs into a hierarchy that best matches your business needs.
• An organizational unit (OU) is a group of AWS accounts within an organization. An OU can also contain other OUs enabling you to create a hierarchy.
• A policy is a “document” with one or more statements that define the controls that you want to apply to a group of AWS accounts.
  • Service control policy (SCP) is a policy that specifies the services and actions that users and roles can use in the accounts that the SCP affects. SCPs are similar to IAM permission policies except that they don’t grant any permissions. Instead, SCPs are filters that allow only the specified services and actions to be used in affected accounts.

• AWS Organizations has two available feature sets:
  • All organizations support consolidated billing, which provides basic management tools that you can use to centrally manage the accounts in your organization.
  • If you enable all features, you continue to get all the consolidated billing features plus a set of advanced features such as service control policies.

• You can remove an AWS account from an organization and make it into a standalone account.
• Organization Hierarchy
  • Including root and AWS accounts created in the lowest OUs, your hierarchy can be five levels deep.
  • Policies inherited through hierarchical connections in an organization.
  • Policies can be assigned at different points in the hierarchy.
• You can attach tags, or user-defined attributes, to Organizational Units, the organization’s root, and policies. These tags let you implement attribute-based access control (ABAC). ABAC is an authorization strategy that defines permissions based on tags attached to users and AWS resources.

Pricing

• This service is free.

AWS Key Management Service (AWS KMS)

 

• A managed service that enables you to easily encrypt your data. KMS provides a highly available key storage, management, and auditing solution for you to encrypt data within your own applications and control the encryption of stored data across AWS services.

Features

• KMS is integrated with CloudTrail, which provides you the ability to audit who used which keys, on which resources, and when.
• Customer master keys (CMKs) are used to control access to data encryption keys that encrypt and decrypt your data.
• You can choose to have KMS automatically rotate master keys created within KMS once per year without the need to re-encrypt data that has already been encrypted with your master key.
• To help ensure that your keys and your data is highly available, KMS stores multiple copies of encrypted versions of your keys in systems that are designed for 99.999999999% durability.
• You can connect directly to AWS KMS through a private endpoint in your VPC instead of connecting over the Internet. When you use a VPC endpoint, communication between your VPC and AWS KMS is conducted entirely within the AWS network.
• You can define VPC Endpoint policies, enabling you to increase the granularity of your security controls by specifying which principals can access your endpoint, which API calls they can make, and which resources they can access.

Concepts

• Customer Master Keys (CMKs) – You can use a CMK to encrypt and decrypt up to 4 KB of data. Typically, you use CMKs to generate, encrypt, and decrypt the data keys that you use outside of KMS to encrypt your data. Master keys are 256-bits in length.
• There are three types of CMKs:

Type of CMK	Can view	Can manage	Used only for my AWS account
Customer managed CMK	Yes	Yes	Yes
AWS managed CMK	Yes	No	Yes
AWS owned CMK	No	No	No

 

• • Customer managed CMKs are CMKs that you create, own, and manage. You have full control over these CMKs, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, rotating their cryptographic material, adding tags, creating aliases that refer to the CMK, and scheduling the CMKs for deletion.
  • AWS managed CMKs are CMKs in your account that are created, managed, and used on your behalf by an AWS service that integrates with KMS. You can view the AWS managed CMKs in your account, view their key policies, and audit their use in CloudTrail logs. However, you cannot manage these CMKs or change their permissions. And, you cannot use AWS managed CMKs in cryptographic operations directly; the service that creates them uses them on your behalf.
  • AWS owned CMKs are not in your AWS account. They are part of a collection of CMKs that AWS owns and manages for use in multiple AWS accounts. AWS services can use AWS owned CMKs to protect your data. You cannot view, manage, or use AWS owned CMKs, or audit their use.
• Data keys – Encryption keys that you can use to encrypt data, including large amounts of data and other data encryption keys.
  • You can use CMKs to generate, encrypt, and decrypt data keys. However, KMS does not store, manage, or track your data keys, or perform cryptographic operations with data keys.
  • Data keys can be generated at 128-bit or 256-bit lengths and encrypted under a master key you define.
• Envelope encryption -The practice of encrypting plaintext data with a data key, and then encrypting the data key under another key. The top-level plaintext key encryption key is known as the master key.
• Encryption Context – All KMS cryptographic operations accept an encryption context, an optional set of key–value pairs that can contain additional contextual information about the data.
• Key Policies – When you create a CMK, permissions that determine who can use and manage that CMK are contained in a document called the key policy.
• Grants – A grant is an alternative to the key policy. You can use grants to give long-term access that allows AWS principals to use your customer managed CMKs.
• Grant Tokens – When you create a grant, the permissions specified in the grant might not take effect immediately due to eventual consistency. If you need to mitigate the potential delay, use a grant token instead.
• When you enable automatic key rotation for a customer managed CMK, KMS generates new cryptographic material for the CMK every year. KMS also saves the CMK’s older cryptographic material so it can be used to decrypt data that it encrypted.
• An alias is an optional display name for a CMK. Each CMK can have multiple aliases, but each alias points to only one CMK. The alias name must be unique in the AWS account and region.

Importing Keys

• A CMK contains the key material used to encrypt and decrypt data. When you create a CMK, by default AWS KMS generates the key material for that CMK. But you can create a CMK without key material and then import your own key material into that CMK.
• When you import key material, you can specify an expiration date. When the key material expires, KMS deletes the key material and the CMK becomes unusable. You can also delete key material on demand.

Deleting Keys

• Deleting a CMK deletes the key material and all metadata associated with the CMK and is irreversible. You can no longer decrypt the data that was encrypted under that CMK, which means that data becomes unrecoverable.
• You can create a CloudWatch alarm that sends you a notification when a user attempts to use the CMK while it is pending deletion.
• You can temporarily disable keys so they cannot be used by anyone.
• KMS supports custom key stores backed by AWS CloudHSM clusters. A key store is a secure location for storing cryptographic keys.
• You can connect directly to AWS KMS through a private endpoint in your VPC instead of connecting over the internet. When you use a VPC endpoint, communication between your VPC and AWS KMS is conducted entirely within the AWS network.

Pricing

• Each customer master key that you create in KMS, regardless of whether you use it with KMS-generated key material or key material imported by you, costs you until you delete it.
• For a CMK with key material generated by KMS, if you opt-in to have the CMK automatically rotated each year, each newly rotated version will raise the cost of the CMK per month.

AWS Identity and Access Management ( IAM )

 Control who is authenticated (signed in) and authorized (has permissions) to use resources.

• AWS account root user is a single sign-in identity that has complete access to all AWS services and resources in the account.

Features

• You can grant other people permission to administer and use resources in your AWS account without having to share your password or access key.
• You can grant different permissions to different people for different resources.
• You can use IAM features to securely provide credentials for applications that run on EC2 instances which provide permissions for your applications to access other AWS resources.
• You can add two-factor authentication to your account and to individual users for extra security.
• You can allow users to use identity federation to get temporary access to your AWS account.
• You receive AWS CloudTrail log records that include information about IAM identities who made requests for resources in your account.
• You use an access key (an access key ID and secret access key) to make programmatic requests to AWS. An Access Key ID and Secret Access Key can only be uniquely generated once and must be regenerated if lost.
• IAM has been validated as being compliant with Payment Card Industry (PCI) Data Security Standard (DSS).
• IAM is eventually consistent. IAM achieves high availability by replicating data across multiple servers within Amazon’s data centers around the world.
• IAM and AWS Security Token Service (STS) are offered at no additional charge.
• Your unique account sign-in page URL:
  https://My_AWS_Account_ID.signin.aws.amazon.com/console/
• You can use IAM tags to add custom attributes to an IAM user or role using a tag key–value pair.
• You can generate and download a credential report that lists all users on your AWS account. The report also shows the status of passwords, access keys, and MFA devices.

Infrastructure Elements

• Principal

  • An entity that can make a request for an action or operation on an AWS resource. Users, roles, federated users, and applications are all AWS principals.
  • Your AWS account root user is your first principal.

• Request

  • When a principal tries to use the AWS Management Console, the AWS API, or the AWS CLI, that principal sends a request to AWS.
  • Requests includes the following information:
    • Actions or operations – the actions or operations that the principal wants to perform.
    • Resources – the AWS resource object upon which the actions or operations are performed.
    • Principal – the user, role, federated user, or application that sent the request. Information about the principal includes the policies that are associated with that principal.
    • Environment data – information about the IP address, user agent, SSL enabled status, or the time of day.
    • Resource data – data related to the resource that is being requested.

• Authentication

  • To authenticate from the console as a user, you must sign in with your user name and password.
  • To authenticate from the API or AWS CLI, you must provide your access key and secret key.

• Authorization

  • AWS uses values from the request context to check for policies that apply to the request. It then uses the policies to determine whether to allow or deny the request.
  • Policies types can be categorized as permissions policies or permissions boundaries.
    • Permissions policies define the permissions for the object to which they’re attached. These include identity-based policies, resource-based policies, and ACLs.
    • Permissions boundary is an advanced feature that allows you to use policies to limit the maximum permissions that a principal can have.
  • To provide your users with permissions to access the AWS resources in their own account, you need identity-based policies.
  • Resource-based policies are for granting cross-account access.
  • Evaluation logic rules for policies:
    • By default, all requests are denied.
    • An explicit allow in a permissions policy overrides this default.
    • A permissions boundary overrides the allow. If there is a permissions boundary that applies, that boundary must allow the request. Otherwise, it is implicitly denied.
    • An explicit deny in any policy overrides any allows.

• Actions or Operations

  • Operations are defined by a service, and include things that you can do to a resource, such as viewing, creating, editing, and deleting that resource.

• Resource

  • An object that exists within a service. The service defines a set of actions that can be performed on each resource.

Users

• IAM Users

  • Instead of sharing your root user credentials with others, you can create individual IAM users within your account that correspond to users in your organization. IAM users are not separate accounts; they are users within your account.
  • Each user can have its own password for access to the AWS Management Console. You can also create an individual access key for each user so that the user can make programmatic requests to work with resources in your account.
  • By default, a brand new IAM user has NO permissions to do anything.
  • Users are global entities.

• Federated Users

  • If the users in your organization already have a way to be authenticated, you can federate those user identities into AWS.

• IAM Groups

  • An IAM group is a collection of IAM users.
  • You can organize IAM users into IAM groups and attach access control policies to a group.
  • A user can belong to multiple groups.
  • Groups cannot belong to other groups.
  • Groups do not have security credentials, and cannot access web services directly.

• IAM Role

  • A role does not have any credentials associated with it.
  • An IAM user can assume a role to temporarily take on different permissions for a specific task. A role can be assigned to a federated user who signs in by using an external identity provider instead of IAM.
  • AWS service role is a role that a service assumes to perform actions in your account on your behalf. This service role must include all the permissions required for the service to access the AWS resources that it needs.
    • AWS service role for an EC2 instance is a special type of service role that a service assumes to launch an EC2 instance that runs your application. This role is assigned to the EC2 instance when it is launched.
    • AWS service-linked role is a unique type of service role that is linked directly to an AWS service. Service-linked roles are predefined by the service and include all the permissions that the service requires to call other AWS services on your behalf.
  • An instance profile is a container for an IAM role that you can use to pass role information to an EC2 instance when the instance starts.
• Users or groups can have multiple policies attached to them that grant different permissions.

When to Create IAM User	When to Create an IAM Role
You created an AWS account and you’re the only person who works in your account.	You’re creating an application that runs on an Amazon EC2 instance and that application makes requests to AWS.
Other people in your group need to work in your AWS account, and your group is using no other identity mechanism.	You’re creating an app that runs on a mobile phone and that makes requests to AWS.
You want to use the command-line interface to work with AWS.	Users in your company are authenticated in your corporate network and want to be able to use AWS without having no sign in again (federate into AWS)

Policies

• Most permission policies are JSON policy documents.
• The IAM console includes policy summary tables that describe the access level, resources, and conditions that are allowed or denied for each service in a policy.
• The policy summary table includes a list of services. Choose a service there to see the service summary.
• This summary table includes a list of the actions and associated permissions for the chosen service. You can choose an action from that table to view the action summary.
• To assign permissions to federated users, you can create an entity referred to as a role and define permissions for the role.
• Identity-Based Policies

• • Permissions policies that you attach to a principal or identity.
  • Managed policies are standalone policies that you can attach to multiple users, groups, and roles in your AWS account.
  • Inline policies are policies that you create and manage and that are embedded directly into a single user, group, or role.
• Resource-based Policies
  • Permissions policies that you attach to a resource such as an Amazon S3 bucket.
  • Resource-based policies are only inline policies.
  • Trust policies – resource-based policies that are attached to a role and define which principals can assume the role.

AWS Security Token Service (STS)

• Create and provide trusted users with temporary security credentials that can control access to your AWS resources.
• Temporary security credentials are short-term and are not stored with the user but are generated dynamically and provided to the user when requested.
• By default, AWS STS is a global service with a single endpoint at https://sts.amazonaws.com.

Assume Role Options

• AssumeRole – Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to. These temporary credentials consist of an access key ID, a secret access key, and a security token. Typically, you use AssumeRole within your account or for cross-account access. 
  • You can include multi-factor authentication (MFA) information when you call AssumeRole. This is useful for cross-account scenarios to ensure that the user that assumes the role has been authenticated with an AWS MFA device.
• AssumeRoleWithSAML – Returns a set of temporary security credentials for users who have been authenticated via a SAML authentication response. This allows you to link your enterprise identity store or directory to role-based AWS access without user-specific credentials or configuration.
• AssumeRoleWithWebIdentity – Returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider. Example providers include Amazon Cognito, Login with Amazon, Facebook, Google, or any OpenID Connect-compatible identity provider.

STS Get Tokens

• GetFederationToken – Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user. You must call the GetFederationToken operation using the long-term security credentials of an IAM user. A typical use is in a proxy application that gets temporary security credentials on behalf of distributed applications inside a corporate network.
• GetSessionToken – Returns a set of temporary credentials for an AWS account or IAM user. The credentials consist of an access key ID, a secret access key, and a security token. You must call the GetSessionToken operation using the long-term security credentials of an IAM user. Typically, you use GetSessionToken if you want to use MFA to protect programmatic calls to specific AWS API operations.

IAM Access Analyzer

• Provides policy checks that help you proactively validate policies when creating them. These checks analyze your policy and report errors, warnings, and suggestions with actionable recommendations that help you set secure and functional permissions.
• IAM Access Analyzer continuously monitors for new or updated resource policies and permissions granted for S3 buckets, KMS keys, SQS queues, IAM roles, Lambda functions, and Secrets Manager secrets.

Best Practices

• Lock Away Your AWS Account Root User Access Keys
• Create Individual IAM Users
• Use Groups to Assign Permissions to IAM Users
• Use AWS Defined Policies to Assign Permissions Whenever Possible
• Grant Least Privilege
• Use Access Levels to Review IAM Permissions
• Configure a Strong Password Policy for Your Users
• Enable MFA for Privileged Users
• Use Roles for Applications That Run on Amazon EC2 Instances
• Use Roles to Delegate Permissions
• Do Not Share Access Keys
• Rotate Credentials Regularly
• Remove Unnecessary Credentials
• Use Policy Conditions for Extra Security
• Monitor Activity in Your AWS Account

AWS Firewall Manager

• Simplifies your AWS WAF administration and maintenance tasks across multiple accounts and resources. You set up your firewall rules just once, and the service automatically applies your rules across your accounts and resources.

Features

• Firewall Manager allows you to apply WAF rules, as well as Managed Rules for AWS WAF, on a group of resources.
• Firewall Manager is integrated with AWS Organizations, so you can apply protections to resources across accounts.
• Firewall Manager allows you can apply protection policies in a hierarchical manner, so you can delegate the creation of application-specific rules while retaining the ability to enforce certain rules centrally.
• It also lets you use your own custom rules, or purchase managed rules from AWS Marketplace.
• A rule group is a set of rules that you add to a web ACL or an AWS Firewall Manager policy. You can create your own rule group, or you can purchase a managed rule group from AWS Marketplace.
• An AWS Firewall Manager policy contains the rule group that you want to apply to your resources. If you add a new account to your organization, Firewall Manager automatically applies the policy to the specified resources in that account. Firewall Manager protection policies are region-specific.
  • You can configure logging on your WAF web ACLs centrally using a Firewall Manager policy.
• You can configure and audit your security groups on Application Load Balancers and Classic Load Balancers across multiple accounts in your organization. This is in addition to being able to manage security groups associated with EC2 instances and ENIs.
• AWS Firewall Manager has pre-configured rules to help you audit your VPC security groups and get detailed reports of non-compliance.

Pricing

• For Shield Advanced customers, Firewall Manager is included at no additional charge. Shield Advanced customers will be charged for the AWS Config rules created to monitor any changes in resource configurations.
• For WAF and Shield Standard customers, Firewall Manager has these main pricing components:
  • Firewall Manager protection policy – Monthly fee per Region.
  • WAF WebACLs or Rules – Those created by Firewall Manager will be charged based on current pricing.
  • AWS Config Rules – Those created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing.

 

AWS Directory Service

 

For Microsoft Active Directory

• Also known as AWS Managed Microsoft AD, the service enables your directory-aware workloads and AWS resources to use managed Active Directory in the AWS Cloud.
• The service is built on actual Microsoft Active Directory and powered by Windows Server 2012 R2.
• AWS Managed Microsoft AD is your best choice if you need actual Active Directory features to support AWS applications or Windows workloads, including Amazon RDS for Microsoft SQL Server. It’s also best if you want a standalone AD in the Cloud that supports Office 365 or you need an LDAP directory to support your Linux applications.

Concepts

• • AWS Managed Microsoft AD provides multiple directory choices for customers who want to use existing Microsoft AD or Lightweight Directory Access Protocol (LDAP)–aware applications in the cloud.
  • When you create a directory, AWS Directory Service creates two domain controllers and adds the DNS service on your behalf. The domain controllers are created in different subnets in a VPC
  • When creating a directory, you need to provide some basic information such as a fully qualified domain name (FQDN) for your directory, Administrator account name and password, and the VPC you want the directory to be attached to.
  • AWS does not provide Windows PowerShell access to directory instances, and it restricts access to directory objects, roles, and groups that require elevated privileges.
  • AWS Managed Microsoft AD does not allow direct host access to domain controllers via Telnet, Secure Shell (SSH), or Windows Remote Desktop Connection.
  • When you create an AWS Managed Microsoft AD directory, you are assigned an organizational unit (OU) and an administrative account with delegated administrative rights for the OU.
  • AWS Managed Microsoft AD directories are deployed across two Availability Zones in a region by default and connected to your Amazon VPC.
  • You cannot configure the storage, CPU, or memory parameters of your AWS Managed Microsoft AD directory.

Active Directory Schema

• • A schema is the definition of attributes and classes that are part of a distributed directory and is similar to fields and tables in a database. Schemas include a set of rules which determine the type and format of data that can be added or included in the database.
  • Attributes, classes and objects are the basic elements that are used to build object definitions in the schema.
    • Each schema attribute, which is similar to a field in a database, has several properties that define the characteristics of the attribute.
    • The classes are analogous to tables in a database and also have several properties to be defined.
    • Each class and attribute must have an Object ID that is unique for all of your objects. Software vendors must obtain their own Object ID to ensure uniqueness.
    • Some attributes are linked between two classes with forward and back links, such as groups. A group shows you the members of the group; while a member shows what groups it belongs to.

Features

• • AWS Managed Microsoft AD is deployed in HA and across multiple Availability Zones. You can also scale out your directory by deploying additional domain controllers.
  • AWS Managed Microsoft AD runs on AWS managed infrastructure with monitoring that automatically detects and replaces domain controllers that fail.
  • Data replication and automated daily snapshots are configured for you.
  • You can integrate AWS Managed Microsoft AD easily with your existing Active Directory by using Active Directory trust relationships.
  • Allows seamless domain join for new and existing Amazon EC2 for Windows Server instances.
  • AWS Managed Microsoft AD can also provide a single directory for all kinds of workloads (EC2, RDS, WorkSpaces, etc).
  • The service supports schema extensions that you submit to the service in the form of a LDAP Data Interchange Format (LDIF) file.
  • You can configure Amazon SNS to receive email and text messages when the status of your AWS Directory Service changes.
  • You can configure SAML 2.0–based authentication with cloud applications using AWS Directory Service.
  • You can use AWS Managed Microsoft AD as a resource forest that contains primarily computers and groups with trust relationships to your on-premises directory. This enables your users to access AWS applications and resources with their on-premises AD credentials.
• Microsoft AD Prerequisites
  • A VPC with at least two subnets. Each of the subnets must be in a different Availability Zone.
  • The necessary ports for the domain controllers that AWS Directory Service creates for you should be open to allow them to communicate with each other.
  • The VPC must have default hardware tenancy.
  • AWS Directory Service does not support using NAT with Active Directory.
• Two Editions of AWS Managed Microsoft AD
  • Both Standard Edition and Enterprise Edition can be used as your organization’s primary directory to manage users, devices, and computers.
  • You also can use both editions to create resource forests and extend your on-premises AD to the AWS Cloud. Resource forests use a trust relationship with your on-premises AD to enable you to access AWS applications and resources with your on-premises AD credentials.
  • Both editions also support the creation of additional domain controllers to improve the redundancy and performance of your managed directory.
  • Unique to Standard Edition
    • Optimized to be a primary directory for small and midsize businesses with up to 5,000 employees.
    • Provides you enough storage capacity to support up to approximately 30,000 directory objects, such as users, groups, and computers.
  • Unique to Enterprise Edition
    • Designed to support enterprise organizations with up to approximately 500,000 directory objects.
• Seamless Domain Joins
  • Seamless domain join is a feature that allows you to join your Amazon EC2 for Windows Server instances seamlessly to a domain, at the time of launch and from the AWS Management Console. You can join instances to AWS Managed Microsoft AD that you launch in the AWS Cloud.
  • You cannot use the seamless domain join feature from the AWS Management Console for existing EC2 for Windows Server instances, but you can join existing instances to a domain using the EC2 API or by using PowerShell on the instance.

Security and Monitoring

• • AWS Managed Microsoft AD is both HIPAA and PCI DSS compliant.
  • Manage users and devices by using native Active Directory Group Policy objects (GPOs).
  • AWS Managed Microsoft AD uses the same Kerberos-based authentication as Active Directory to deliver Single Sign-On (SSO).
  • AWS Managed Microsoft AD supports federation access for users and groups to the AWS Management Console.
  • Amazon EBS volumes used in the directory service are encrypted.

Pricing

• • You pay only for the type and size of the managed directory that you use.
  • AWS Managed Microsoft AD allows you to use a directory in one account and share it with multiple accounts and VPCs. There is an hourly sharing charge for each additional account to which you share a directory.

 

Active Directory Connector

• A proxy service that provides an easy way to connect compatible AWS applications, such as Amazon WorkSpaces, Amazon QuickSight, and Amazon EC2 for Windows Server instances, to your existing on-premises Microsoft Active Directory.
• AD Connector is your best choice when you want to use your existing on-premises directory with compatible AWS services.
• Features
  • When users log in to the AWS applications, AD Connector forwards sign-in requests to your on-premises Active Directory domain controllers for authentication.
  • You can also join your EC2 Windows instances to your on-premises Active Directory domain through AD Connector using seamless domain join.
  • AD Connector is NOT compatible with RDS SQL Server.
  • AD Connector comes in two sizes, small and large.
  • You can spread application loads across multiple AD Connectors to scale to your performance needs. There are no enforced user or connection limits.
• AD Connector Prerequisites
  • You need to have a VPC with at least two subnets. Each of the subnets must be in a different Availability Zone.
  • The VPC must be connected to your existing network through a virtual private network (VPN) connection or AWS Direct Connect.
  • The VPC must have default hardware tenancy.
  • Your user accounts must have Kerberos pre-authentication enabled.

 

Simple AD

• A standalone Microsoft Active Directory–compatible directory from AWS Directory Service that is powered by Samba 4.
• You can use Simple AD as a standalone directory in the cloud to support Windows workloads that need basic AD features, compatible AWS applications, or to support Linux workloads that need LDAP service.
• Features
  • Simple AD supports basic Active Directory features such as user accounts, group memberships, joining a Linux domain or Windows based EC2 instances, Kerberos-based SSO, and group policies.
  • AWS provides monitoring, daily snapshots, and recovery as part of the service.
  • Simple AD is compatible with the following AWS applications: Amazon WorkSpaces, Amazon WorkDocs, Amazon QuickSight, and Amazon WorkMail.
  • You can also sign in to the AWS Management Console with Simple AD user accounts.
  • Simple AD does NOT support multi-factor authentication, trust relationships, DNS dynamic update, schema extensions, communication over LDAPS, PowerShell AD cmdlets, or FSMO role transfer.
  • Simple AD is NOT compatible with RDS SQL Server.
  • Simple AD is available in two sizes:
    • Small – Supports up to 500 users
    • Large – Supports up to 5,000 users
• Simple AD Prerequisites
  • Your VPC should have at least two subnets. For Simple AD to install correctly, you must install your two domain controllers in separate subnets that must be in a different Availability Zone. In addition, the subnets must be in the same Classless Inter-Domain Routing (CIDR) range.
  • The necessary ports for the domain controllers that AWS Directory Service creates for you should be open to allow them to communicate with each other.
  • The VPC must have default hardware tenancy.
• When you create a directory with Simple AD, AWS Directory Service performs the following tasks on your behalf:
  • Sets up a Samba-based directory within the VPC.
  • Creates a directory administrator account with the user name ‘Administrator’ and the specified password. You use this account to manage your directory.
  • Creates a security group for the directory controllers.
  • Creates an account that has domain admin privileges.
• Simple AD forwards DNS requests to the IP address of the Amazon-provided DNS servers for your VPC. These DNS servers will resolve names configured in your Route 53 private hosted zones

 

Amazon Cloud Directory

• A cloud-native directory that can store hundreds of millions of application-specific objects with multiple relationships and schemas. Use Amazon Cloud Directory if you need a highly scalable directory store for your application’s hierarchical data.
• You can organize directory objects into multiple hierarchies to support many organizational pivots and relationships across directory information.
• Concepts
  • A schema is a collection of facets that define what objects can be created in a directory and how they are organized.
  • A schema also enforces data integrity and interoperability.
  • A single schema can be applied to more than one directory at a time.
  • Amazon Cloud Directory supports uploading of a compliant JSON file for schema creation.
  • A directory is a schema-based data store that contains specific types of objects organized in a multi-hierarchical structure.
  • Before you can create a directory in Amazon Cloud Directory, AWS Directory Service requires that you first apply a schema to it. A directory cannot be created without a schema and typically has one schema applied to it.