AWS Certified Security – SpecialtyDomain 4: Identity and Access ManagementMedium
A financial institution is migrating its on-premises applications to AWS. These applications rely heavily on Kerberos authentication and LDAP for user and group management. The institution requires a fully managed directory service that can seamlessly integrate with their existing on-premises Active Directory while providing high availability and disaster recovery within AWS. They also need to ensure that AWS services can directly authenticate against this directory. Which AWS directory service best meets these requirements?
- AAWS Directory Service for Simple AD
- BAWS Directory Service for AD Connector
- CAmazon Cognito User Pools
- DAWS Directory Service for Microsoft Active Directory (Enterprise Edition)
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Directory Service for Microsoft Active Directory (Enterprise Edition)
AWS Directory Service for Microsoft Active Directory (Enterprise Edition) is a fully managed, highly available directory that provides true Microsoft Active Directory functionality. It supports Kerberos, LDAP, and seamless integration with existing on-premises AD, making it ideal for the requirements of a financial institution.
Why the other options are wrong
- A. Simple AD is a standalone directory powered by Samba 4, not a true Microsoft AD, and lacks the advanced features and seamless integration required.
- B. AD Connector is a directory gateway that redirects directory requests to your on-premises AD; it does not provide a managed directory service within AWS itself.
- C. Amazon Cognito User Pools are identity providers for web and mobile apps, not a managed directory service for enterprise applications relying on Kerberos/LDAP.
AWS Directory Service for Microsoft AD (Enterprise)
A fully managed, highly available Microsoft Active Directory hosted in AWS, offering full AD functionality, Kerberos, LDAP, and trust relationships with on-premises AD.
- True Microsoft Active Directory functionality.
- Supports Kerberos and LDAP for enterprise applications.
- Enables trust relationships with on-premises AD for hybrid environments.
- Provides high availability and disaster recovery within AWS.
Memory trick: ADDS, Simple, Connect, Cognito - choose wisely for your domain's needs!