AWS Directory Service
AWS Directory Service is an Amazon Web Services service that enables multiple ways to use Microsoft Active Directory (AD) with other AWS services, offering several managed directory options. It makes it easy to migrate AD-dependent applications and Windows workloads to AWS.
Key points
- A trust relationship can be created between AWS Managed Microsoft AD and an existing on-premises Microsoft Active Directory using single sign-on (SSO).
- Provides three directory types to choose from:
- AWS Managed Microsoft AD — an actual Microsoft AD, managed by AWS, running on Windows Server; supports trust relationships with on-premises AD and is required for use cases like Windows authentication. Available in Standard Edition (up to 30,000 directory objects), Enterprise Edition (up to 500,000 directory objects), and a newer Hybrid Edition that extends an existing self-managed AD into AWS without synchronizing identities.
- Simple AD — an inexpensive Active Directory-compatible service driven by SAMBA 4, offered in a Small size (up to 500 users) and a Large size (up to 5,000 users); does not support Multi-Factor Authentication (MFA), trust relationships, or RDS for SQL Server. As of July 30, 2026, Simple AD is closed to new customers — existing directories keep working, but AWS now directs new customers to AWS Managed Microsoft AD or AD Connector instead.
- AD Connector — acts like a gateway that redirects directory requests to an on-premises Active Directory; requires an existing AD and a VPC connected to the on-premises network via VPN or AWS Direct Connect; supports Multi-Factor Authentication (MFA) via existing RADIUS-based MFA infrastructure.
- Distinct from Amazon Cognito (sign-up/sign-in for an organization’s own application end users) and AWS IAM Identity Center (Single Sign-On) (SSO across AWS accounts and cloud apps) — Cognito is not one of its directory types.
- AWS patches and maintains the underlying AWS Managed Microsoft AD infrastructure under the shared responsibility model; contrast with Amazon WorkSpaces, where the customer is responsible for patching the guest OS.
- Commonly used to enable Windows Authentication for Amazon RDS for SQL Server and to domain-join EC2 instances and Amazon WorkSpaces.