While the AWS Directory Service was intended to provide flexible support for Active Directory in AWS, it has several...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
limitations and caveats.
Microsoft AD, for example, is the enterprise-class version of AWS Directory Service and one of three options for running Active Directory in AWS. Microsoft AD currently handles up to 50,000 users or about 200,000 objects, which includes users, groups and computers. That's typically not an issue for most businesses, but that could constrain larger enterprises that have huge Active Directory user or object bases.
In addition, users cannot change the compute performance of Microsoft AD on AWS; there is no way to change storage, processor or memory resources for the AD instance. This can make it difficult to fix performance issues. There is also no current way to migrate the on-premises Active Directory database to the cloud.
Simple AD, another option for operating Active Directory in AWS, offers a subset of features found in Microsoft AD. Simple AD supports users, groups, single sign-on access and domain-joining Linux and Windows instances. But Simple AD does not support trust relationships with other domains nor does it manually add domain controllers to an instance. It also doesn't support tools like AD Administrative Center, AD Recycle Bin, PowerShell, detailed password policies, schema extensions and group-managed service accounts. Organizations that depend on these features need to deploy the full-featured Microsoft AD.
The third AWS Directory Service option, AD Connector, offers a gateway that handles directory requests as a proxy and does not cache information in the AWS public cloud. Users of this option can enforce current logon credentials to access AWS tools or manage AWS resources. But AD Connector is a limited-privilege service -- depending on a non-administrative account and password for read-only permissions. So admins can't make changes to Active Directory in AWS through the AD Connector.
As with any public cloud service, developers and infrastructure architects must stay up to date on the latest service offerings, such as changes to APIs, features and pricing. Architects must also consider the limitations of each platform, taking the time to test deployments and evaluate performance before making a production commitment.
AWS tagging enables better performance monitoring
Integrate Active Directory with AWS to manage a cloud directory
Use AWS push notifications to keep an eye on resources
Dig Deeper on AWS security
Related Q&A from Stephen J. Bigelow
Consider factors like security, platform compatibility, data usage requirements and management when transitioning from a private cloud to a hybrid ...continue reading
Several tools and commands can come in handy to storage admins looking to benchmark I/O performance on Linux systems. But not all benchmarking tools ...continue reading
If you consider security, performance, scalability, expertise, network visibility and service management when creating a private cloud, you avoid ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.