Building AWS Managed Microsoft Active Directory: Step-by-step
Tags: beginners, aws, community
Published: 2023-03-11 11:02:54

This is the solution I created for account I supporting.  Using AWS managed Microsoft Active Directory (AD) less headache for administrator and team because no need to manage license and it is pay as you go model. Also it is Highly Available (HA) configuration and managed service so no need to patching or easy to add more AD nodes.  
Major benefit of using AWS managed AD is on-board and off-board user easily and handle outside of AWS console. Also can use AD connector to connect Corp AD.  

Here are step by step building AWS Management Active Directory service and integrate with AWS IAM.  

- Login to your AWS Console with Administrator permission

- Under Security, Identity & Compliance service select Directory Service. 

- Click Set up Directory

- Select AWS Managed Microsoft AD and click Next
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8h3x8wkwailjup7rbspz.png)

- Select Standard unless require to setup larger business

- Give any name at Directory DNS name (Not Public DNS, inside your VPC) See example from below screenshot

- Enter Directory NetBIOS name (See example from below screenshot)

- Enter Admin password and make sure write down somewhere safe because it will require. Click next
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h5nlox3d7guz8auwzo3x.png)

- Choose VPC you want and select at least two different Subnets.  Click Next
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nugu40un1xv1q7fmtech.png)

- Review and Create Directory (~ 86 dollars per month and 30 days free trial) This step will take around 45 minutes. 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v81ffer0jsk8dbncn3g3.png)

- Creating
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nrxfsyw4deufeq1yepc3.png)

**Let's setup IAM Role and policy **

- Under Security, Identity & Compliance service select IAM

- Click "Role" from left under Access Management and click 'Create Role'
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9wxs9ffdkj0av8cv58i6.png)

- At next page select AWS Service and EC2 then click Next
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jvj6coepdmqb3v1zjhgb.png)

- At next page search AmazonSSM and select **_AmazonSSMDirectoryServiceAccesss_** & **_AmazonSSMManagedInstanceCore_** then click Next
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7503qas6mw5ssd2vupyh.png)

- At Role detail page give meaningful Role name and description. Then click Create Role. 

- Create another role for this blog/demo purpose only. In reality you will need to create multiple roles. 

- Click "Role" from left under Access Management and click 'Create Role'

- At next page select AWS Service and EC2 then click Next

- At next page search ViewOnlyAccess and select ViewOnlyAccess policy
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/itr0c1qy7va9ytz6q3xi.png)

- Click Next and give meaningful name and create role. 

Back to Directory Service page 

- Verify AD service 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d8b31im9ylt73dr163vi.png)

- It is HA at two subnets (Same Region)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hg4i5me9m89ihc8ey6a.png)

- Under Add a trust relationship you can add external / Corporate AD 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p49h4lty3qudiqfwojg8.png)

**Provision Windows base for add/join Domain and manage users
**

- At EC2 console launch Windows 2019 base (Not **Core Base**) t2.micro with IAM role "EC2DomainJoin" earlier created.  Also select AD you created.  See below screenshot as example
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a4zfg30d011hjorb2iad.png)

- Login (Remote Desktop) with Domain Users & Domain Admin password created above.  (Hint: Domain\User)

- You can verify with Open Terminal windows and run "whoami" & "set" commands
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8qgyhci1q9kpej6209i0.png)

- Go to Windows "Server Manager" Dashboard and click "Add roles and features" link click Next until 'Features" is selected. 

- Expand "Remote Server Administration Tools" and select 'AD DS and AD LDS Tools'
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bwo686sz7vur5ty5xkol.png)

- Click Next and Install.  (It will take 2 to 3 minutes)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s8r76ywpmg9urjpf6eg4.png)

- Click Close 

- Go to Windows Administrative Tools and Open "Active Directory Users and Computer and select Users
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5lvnc0m9twbq1bglkddc.png)

- Create new user(s) 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e35fupo2cyawrd9pykgd.png)

Give permission to users

- Go back to AWS AD service and select Directory Service you created and select again "Application and Management" 

- Go to AWS Management Console session and under action select enable. 

- Go to next session "Delegate console access" click AD-ViewOnlyUser (or whichever permission you created earlier)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x70pid3yu3zmv90fjfau.png)

- Click the group you want to add user(s)and add
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4onjn91u9juuk3iamp8l.png)

- Copy the Console url from AWS Apps and Services session and go to different browser or private browser and login
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pze4qme9x1m521fgdr5b.png)

- That way users can login with permission you give at AD Service.  No need to add at AWS IAM page.  

- Now you are successfully created AWS Managed AD and integrated with AWS Console login.