10월 웨비나 - AWS에서 Active Directory 구축 및 연동 옵션 살펴보기 (김용우 솔루션즈 아키텍트)

Editor's Notes

• #6: 2가지 옵션 AD on EC2가 필요한 경우를 보겠다. 더불어 Trust가 확장이 아닌가 궁금해 하시는데 이에 대해 말씀드리겠다.
• #7: Simple: Domain-join Linux and Microsoft Windows instances Define and apply Group Policy Objects Migrate directory-aware Windows applications such as Exchange, SharePoint, or custom .NET Cost: Trade capital expense for variable expense Benefit from massive economies of scale Pay only for what you use No long-term commitments Managed: 99.95% SLA Multi-Availability Zone replication Automated snapshots and backup Software updates and patching included Familiar : Microsoft Active Directory Works with directory-dependent applications No learning curve Use your existing management tools Singlesing on : Use existing, corporate credentials Map IAM roles to directory users and groups SSO for AWS Work applications, the AWS Management Console, domain joined EC2 instances, RDS SQL Server, and directory dependent Microsoft applications
• #8: Active Directory 호환 Samba 4 기반의 관리형 디렉토리 서비스 사용자 계정, 그룹 멤버십, Amazon EC2인스턴스들에 대한 도메인 조인 등의 기능 The AWS Directory service solves these two use cases. Let me take a second to tell you what this is NOT. This service makes it easier for customers to bridge between an on-premises environment and AWS and provides a single sign-on experience using existing Microsoft Active Directory identities to access AWS applications and services. AWS Directory Service is a fully managed enterprise directory service that lets customers seamlessly connect their corporate identities to the AWS Cloud. Amazon Galaxy provides a single sign-on experience using existing Microsoft Active Directory identities to access AWS applications and services. It also enables customers to easily deploy Active Directory-dependent applications on AWS by simplifying log-on, password, and group policy management for AWS applications and services. With Amazon Galaxy, enterprises are relieved of the pain of maintaining separate sets of corporate identities and no longer have to manage the setup, patching, and maintenance of directories. Provide single sign-on (SSO) across all your AWS applications like Amazon Workspaces, Amazon WorkDocs, Amazon WorkMail, and the AWS Management Console, as well as RDS SQL Server, and domain joined EC2 Linux and Windows instances The AWS Directory service solves these two use cases. Let me take a second to tell you what this is NOT. This service makes it easier for customers to bridge between an on-premises environment and AWS and provides a single sign-on experience using existing Microsoft Active Directory identities to access AWS applications and services. AWS Directory Service is a fully managed enterprise directory service that lets customers seamlessly connect their corporate identities to the AWS Cloud. Amazon Galaxy provides a single sign-on experience using existing Microsoft Active Directory identities to access AWS applications and services. It also enables customers to easily deploy Active Directory-dependent applications on AWS by simplifying log-on, password, and group policy management for AWS applications and services. With Amazon Galaxy, enterprises are relieved of the pain of maintaining separate sets of corporate identities and no longer have to manage the setup, patching, and maintenance of directories.
• #19: AD Connector is your best choice when you want to use your existing on-premises directory with AWS services. AD Connector forwards sign-in requests to your Active Directory domain controllers for authentication and provides the ability for applications to query the directory for data. After setup, your users can use their existing corporate credentials to log on to AWS applications, such as Amazon WorkSpaces, Amazon WorkDocs, or Amazon WorkMail. With the proper IAM permissions, they can also access the AWS Management Console and manage AWS resources such as Amazon EC2 instances or Amazon S3 buckets. You can also use AD Connector to enable multi-factor authentication by integrating with your existing RADIUS-based MFA infrastructure to provide an additional layer of security when users access AWS applications.
• #20: AD Connector is your best choice when you want to use your existing on-premises directory with AWS services. AD Connector forwards sign-in requests to your Active Directory domain controllers for authentication and provides the ability for applications to query the directory for data. After setup, your users can use their existing corporate credentials to log on to AWS applications, such as Amazon WorkSpaces, Amazon WorkDocs, or Amazon WorkMail. With the proper IAM permissions, they can also access the AWS Management Console and manage AWS resources such as Amazon EC2 instances or Amazon S3 buckets. You can also use AD Connector to enable multi-factor authentication by integrating with your existing RADIUS-based MFA infrastructure to provide an additional layer of security when users access AWS applications.
• #23: Password가 최소한 공개 되지 않는 부분에 주목
• #31: The first option might represent the least secure option of the three, because if the domain controller in the cloud is compromised, the entire production directory services infrastructure would be affected. The second and third options can be considered incrementally more secure, because there is only a one-way trust, but the overhead of maintaining trusts might not fit organizational requirements.   The last option might be considered be the most secure, but there is administrative overhead that you need to take into account, and not all deployment scenarios will support this kind of configuration. You need to consider these issues before deciding on a domain and forest model.