🧩 AWS Managed Microsoft AD – Simplifying Active Directory in the Cloud

If your applications depend on Microsoft Active Directory (AD) but you're moving to the cloud, AWS Managed Microsoft AD offers the perfect bridge.

---

🚀 What is AWS Managed Microsoft AD?

AWS Managed Microsoft AD is a fully managed Microsoft Active Directory hosted on AWS. Built on Windows Server 2019, it runs as a highly available pair of domain controllers across multiple Availability Zones in your selected region.

Think of it as "Active Directory without the hassle" — AWS handles everything from setup, patching, monitoring, replication, and backups to failover.

---

🎯 Why Use AWS Managed AD?

• No infrastructure to manage – AWS hosts and maintains everything.

• Highly available by default – Domain controllers run in two separate AZs.

• Built-in integration – Works seamlessly with AWS services like EC2, RDS for SQL Server, and IAM Identity Center.

• Secure access – Supports RADIUS-based Multi-Factor Authentication (MFA).

• Extend existing AD – Easily set up trust with your on-premises Active Directory.

---

🔐 Common Use Cases

• Run AD-aware apps like SharePoint or .NET apps in AWS.

• Join EC2 Windows/Linux instances to a domain.

• Implement group policy and SSO for users.

• Extend on-premises identity to cloud workloads securely.

---

🧱 Prerequisites to Get Started

Before you launch your directory:

• ✅ VPC with 2 subnets in different AZs.

• ✅ Default tenancy VPC (not dedicated hosts).

• 🚫 Avoid CIDR block 198.18.0.0/15 — it's reserved by AWS for management.

• ✅ If connecting to on-prem AD, the forest/domain functional level must be 2003 or higher.

---

⚙️ How AWS Manages It Behind the Scenes

• AWS provisions EC2 instances outside your account to host domain controllers.

• These instances have:

  • eth0 → for management, IP range: 198.18.0.0/15

  • eth1 → connected to your VPC, to communicate with your resources

You don’t manage these EC2 instances — AWS takes care of updates, recovery, and availability.

---

🛠️ Step-by-Step: Creating an AWS Managed Microsoft AD

1. Go to the AWS Directory Service Console

2. Choose "Set up directory"

3. Select "AWS Managed Microsoft AD"

4. Fill in the directory details:

   • Choose Standard or Enterprise Edition

   • Specify DNS name (e.g., corp.example.com)

   • Provide a NetBIOS name (e.g., CORP)

   • Set a secure admin password

5. Select your VPC and 2 subnets (must be in different AZs)

6. Review your settings and click Create directory

🕐 It typically takes 20–40 minutes to fully provision.

---

🔄 After Deployment – What You Can Do

• Join EC2 instances to the domain

• Use the Admin account to create users/groups

• Set up trust relationships with your on-prem AD

• Enable SSO and MFA with IAM Identity Center

• Apply GPOs (Group Policy Objects) for Windows instances

---

💰 Licensing Note

AWS handles all the Windows licensing and CALs. You get 2 remote desktop connections by default for admin tasks. For more RDP users, you may need to bring your own RDS CALs.

---

🧪 Want to Try It Hands-On?

AWS provides a test lab tutorial that walks you through everything.

---

✅ Final Thoughts

AWS Managed Microsoft AD takes the complexity out of running Active Directory in the cloud. Whether you’re moving legacy apps, setting up a hybrid identity model, or securing cloud resources, this service gives you enterprise-grade AD features — without the infrastructure burden.