Q: What is AD Connector?

AD Connector is a directory gateway designed to support AWS Enterprise IT application authentication, and to join Amazon EC2 instances to domains and to your self-managed Active Directory. AD Connector allows you to proxy directory requests from AWS Enterprise IT applications to your on-premises Microsoft Active Directory, without caching any information in the cloud. AD Connector also enables you to seamlessly domain join Amazon EC2 instances to your self-managed Active Directory. Once set up, your end users and IT staff can use their existing corporate credentials to sign on to AWS applications such as Amazon WorkSpaces, Amazon WorkDocs, Amazon WorkMail, and the AWS Management Console. You can also use Group Policies in your self-managed directory to manage AWS resources such as Amazon EC2 instances.

Q: How do I create an AD Connector to connect to my on-premises directory?

You can use the AWS Management Console to create an AD Connector to connect your existing, self-managed Microsoft Active Directory to AWS. You must configure an Amazon Virtual Private Cloud (VPC) with a hardware virtual private network (VPN) connection to your on-premises environment, or provision a dedicated connection with AWS Direct Connect. After you’ve set up this integration, you must provide some basic information such as the name of your on-premises Microsoft Active Directory, DNS servers to discover Microsoft Active Directory, and an account name and password that you’ve created in your Microsoft Active Directory. This is a limited-privilege account used by AD Connector to authenticate and connect to one of the domain controllers, and proxy various authentication, join computers to the domain, and look up requests.

Q: What kind of user account does AD Connector use with my on-premises directory?

AWS Directory Service requires a non-administrative account and password for AD Connector. This account must have read-only permissions to look up users, groups, and computers as well as the ability to join computers to the domain. This user name and password are used when Amazon WorkSpaces automatically joins your existing domain and for user and group lookups for Amazon WorkDocs, or when integrating with AWS Identity and Access Management (IAM).

Q: Can I use multi-factor authentication (MFA) with AD Connector?

Yes. You can also enable MFA using your existing RADIUS-based infrastructure to provide an additional layer of security when users access AWS applications.