13

I am moving my local AD domain to AWS and I am not sure the best way to do it.

Scenario: I have 2 on-prem domains (.local and .net). I am retiring one of them and moving to the other. Both are considered production as they are both actively used. Before I start moving everything from one to the other, I want to have AD extended into AWS. In addition, we eventually want to be out of the data center.

Option 1: Spin up 2 EC2 instances and configure them as DCs. This seems like the simplest option however the most expensive (something like $0.99/hr for 2 m4.xlarge machines).

Option 2: Use AWS Directory Service (looks pretty new). The problem with this is they don't allow you to extend your current domain to it. They only allow you to create a brand new domain. The advantages are that its cheaper ($0.40/hr I believe) and that they configure everything for you. I suppose if I went this way I'd need to set up a trust with my current domains.

Does anyone have experience with the AWS directory service? I just can't seem to find anything on the Internet about comparing these 2 options.

If anyone has a better option than the 2 listed above I'd love to hear about it too.

Reference links:

Extending on-prem domain to AWS: http://docs.aws.amazon.com/quickstart/latest/active-directory-ds/scenario-2.html

AWS Directory Service: http://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html

Thanks for the help!

Vinny
  • 407
  • 2
  • 5

1 Answers1

11

Is this what you are looking for?

https://aws.amazon.com/blogs/security/how-to-connect-your-on-premises-active-directory-to-aws-using-ad-connector/

Anthony Fornito
  • 9,526
  • 1
  • 33
  • 122
  • I've seen that before. I'm honestly just looking for the best way to do it. Is it better to use the AWS directory Service or just spin up EC2 instances and manage them yourself? – Vinny Dec 12 '16 at 16:27
  • I have not done this with AWS however my company does this with Azure and we tried the ADFS and managing it ourselves, however Azure already had a good working model. We finally gave up and let Azure do its job, and it has actually worked out much better. Less hair pulling out and when something breaks we call Azure. Depending on how much money you spend with them is how fast they help you. Not sure about AWS. We have had 1 outage in the past 2 years which lasted about 30 seconds with Azure. – Anthony Fornito Dec 12 '16 at 16:30
  • Thanks for that but a lot of our dev resources are out in AWS so we're looking to stick with one cloud for now. – Vinny Dec 12 '16 at 17:48