ACKF logoACKF
Security, Identity, and Compliance

AWS Directory Service

View on GitHub

AWS Directory Service

A managed AWS service that provides directory capabilities for Windows and LDAP-based authentication in AWS. It offers multiple deployment models (for example, AWS Managed Microsoft AD and AD Connector) to enable domain join, authentication, and directory-aware applications in VPCs and hybrid environments. It normally sits between compute resources (such as Amazon EC2 and Amazon RDS) and identity providers or on-premises Active Directory in a typical AWS architecture.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "VPC domain join + Windows authentication + hybrid AD proxy = AWS Directory Service"

📖 Ownership

Classification: Shared Responsibility Service

AWS responsibilities: Depending on the deployment model, AWS operates and maintains the Directory Service control plane, the service endpoints, the VPC placement for managed directories, and the underlying physical infrastructure and hypervisor. For AWS Managed Microsoft AD, AWS manages and patches the managed domain controller instances and the managed directory platform. AWS also provides the networking endpoints and service availability features for Directory Service.

Customer responsibilities: The customer configures directory objects, user and group management, group policy objects, access control, schema changes, and directory-wide configuration; configures VPC networking, security groups, and IAM permissions that control access to directory resources; monitors directory health and access logs; and manages and patches any on-premises Active Directory servers and any application software that uses the directory. When using AD Connector, the customer is responsible for the on-premises directory infrastructure, its security, and its patching.

Patching responsibilities: AWS patches the physical infrastructure and the hypervisor and patches the managed directory controller instances and managed directory platform for AWS Managed Microsoft AD. Customers patch guest operating systems, application runtimes, libraries, dependencies, and applications they deploy. For AD Connector and other proxy models, customers remain responsible for patching their on-premises directory servers; for managed directories, customers do not patch the managed domain controllers but retain responsibility for directory configuration, policies, and application-level updates.

🏗 Typical Architecture

💡 Top 5 Features

  • Provides AWS Managed Microsoft AD that supplies a managed Active Directory domain controller platform within a VPC.
  • Offers AD Connector as a proxy to authenticate and forward requests to existing on-premises Active Directory without storing credentials in AWS.
  • Supports LDAP, Kerberos, and Windows Integrated Authentication for domain-joined resources in a VPC.
  • Enables domain join for Amazon EC2 instances and integration with directory-aware AWS services for authentication.
  • Supports establishing trust relationships with on-premises Active Directory or other directories depending on deployment model.

✅ Top 5 Use Cases

  • Domain-join Windows Amazon EC2 instances and apply Group Policy to centralize Windows configuration and authentication.
  • Provide Active Directory authentication for Amazon RDS for SQL Server to enable integrated Windows authentication from applications.
  • Bridge AWS workloads to an existing on-premises Active Directory using AD Connector for hybrid authentication without replicating directory data.
  • Provide LDAP or Kerberos identity services for enterprise applications running in AWS that require directory-based authentication.
  • Enable AWS IAM Identity Center or other SSO solutions to integrate with an enterprise directory for centralized user management.

🏗 Architecture Placement

AWS Directory Service is typically deployed within one or more Amazon VPCs in a particular AWS Region and is account-scoped; it serves as a VPC-based directory endpoint that compute and database resources contact for authentication and directory lookups. Depending on the deployment model, it either hosts managed domain controllers inside the VPC (AWS Managed Microsoft AD) or proxies requests to an on-premises directory (AD Connector) over VPN or Direct Connect. Resources such as Amazon EC2 and Amazon RDS normally send authentication and directory requests to the Directory Service endpoints.

🎯 Commonly Used With

- Amazon EC2
- Amazon VPC
- AWS Identity and Access Management
- AWS IAM Identity Center
- Amazon RDS

🌍 5 Real-World Examples

  • A financial services environment uses AWS Managed Microsoft AD to domain-join Windows application servers in a VPC, enabling centralized user authentication and Group Policy management for secure operations.
  • A healthcare provider uses AD Connector to allow cloud-hosted applications to authenticate against the hospital’s on-premises Active Directory over a VPN without synchronizing credentials to AWS.
  • A retail company domain-joins POS backend Windows servers on Amazon EC2 to a managed directory to enforce consistent access controls and group policies across locations.
  • An education institution integrates campus Active Directory with AWS Directory Service so cloud-hosted learning management systems authenticate students against the institutional directory.
  • A technology organisation configures AWS Managed Microsoft AD to provide LDAP and Kerberos authentication for legacy enterprise applications migrated into AWS, reducing changes to application authentication logic.

🎓 AWS Exam Clues

  • Choose AWS Directory Service when you need managed Active Directory features (domain join, GPO, Kerberos) inside a VPC.
  • Use AD Connector when you must authenticate to an existing on-premises Active Directory without synchronizing or hosting directory data in AWS.
  • Consider network connectivity (VPN/Direct Connect) and latency when relying on AD Connector for frequent authentication calls.
  • When Windows-integrated authentication for Amazon RDS or domain-joined EC2 is required, a managed directory or connector is typically involved.
  • Directory administrative tasks (users, groups, GPOs) remain a customer responsibility even when using AWS Managed Microsoft AD.

📝 Quick Revision

AWS Directory Service supplies managed directory capabilities (for example AWS Managed Microsoft AD and AD Connector) to support domain join, LDAP, and Kerberos in VPCs. Use it for Windows authentication, Group Policy, and hybrid AD integration; plan for network connectivity, directory administration, and how trusts or AD schema changes are managed.

🏷 Keywords

Managed Microsoft AD • AD Connector • Domain join • LDAP • Kerberos • Windows authentication • Group Policy • VPC-based directory • Trust relationship • Directory endpoints • Hybrid AD • Schema and OU