AWS Directory Service
AWS Directory Service is a family of managed directory options. Which one applies depends on whether a directory already exists, whether Windows workloads need to join a domain, and whether the requirement is a full Active Directory or only a place to authenticate users.
Options at a glance
Section titled “Options at a glance”| Option | What it is | Best for |
|---|---|---|
| AWS Managed Microsoft AD | A fully managed Active Directory in AWS, powered by Windows Server 2019, in Standard or Enterprise Edition | Directory-aware workloads, AWS applications, and Linux applications needing LDAP |
| AWS Managed Microsoft AD (Hybrid Edition) | Connects a self-managed Active Directory to AWS Directory Service without synchronising identities | Extending an existing directory to AWS |
| AD Connector | A proxy to an existing on-premises Active Directory | Single sign-on for existing employees, and joining EC2 instances to an existing domain |
| Simple AD | A small, standalone Active Directory-compatible directory built on Samba | Basic user directories and simple LDAP compatibility |
| Amazon Cognito | A user directory and identity provider for application end users | Consumer-facing applications and SaaS products |
AWS Managed Microsoft AD
Section titled “AWS Managed Microsoft AD”- Runs actual Microsoft Active Directory as a managed service, powered by Windows Server 2019
- Creates a highly available pair of domain controllers across Availability Zones, with AWS handling monitoring, recovery, replication, snapshots and patching
- Standard and Enterprise Editions, differing in scale
- Establishes trust relationships with existing AD domains, on premises or elsewhere, so user identities can stay where they are while the AWS resource forest is managed separately
- Supports directory-aware workloads such as SharePoint and .NET or SQL Server applications
- Provides LDAP for Linux applications that need it
Hybrid Edition is the variant for extending a self-managed directory to AWS: it connects the two environments and establishes trust without synchronising user identities.
AD Connector
Section titled “AD Connector”AD Connector is a directory gateway, not a directory. It redirects requests to an existing on-premises Active Directory without caching or copying anything.
- Requires an existing Active Directory and network connectivity to it
- Enables single sign-on for existing AD users to AWS applications and the console
- Allows EC2 instances to join the existing domain
- Existing AD users can be mapped to IAM roles
- Supports MFA through existing RADIUS-based infrastructure
- Can serve as the identity source for IAM Identity Center
Simple AD
Section titled “Simple AD”A standalone, Active Directory-compatible directory built on Samba, sized for small deployments.
- Supports user accounts, groups, group policies and domains
- Kerberos-based single sign-on
- Low cost, low scale
Limitations, which are the reason it is rarely the right answer beyond a small deployment:
- No multi-factor authentication support
- No trust relationships, so it cannot integrate with an existing Active Directory
- Not a full Active Directory — some directory-aware applications will not run against it
AD Connector versus Simple AD
Section titled “AD Connector versus Simple AD”| AD Connector | Simple AD | |
|---|---|---|
| Existing AD required | Yes | No |
| MFA | Yes, via RADIUS | No |
| Trust relationships | Uses the existing directory’s | None |
| Kerberos SSO | Yes, through the existing directory | Yes |
| IAM role mapping for AD users | Yes | Limited |
| Directory data | Stays on premises | Held in AWS |
Amazon Cognito
Section titled “Amazon Cognito”Cognito is a directory for the users of an application rather than for employees or domain-joined machines: sign-up and sign-in that scales to large user populations, federation with social and enterprise identity providers, and token issuance. See Amazon Cognito.
Amazon Cloud Directory
Section titled “Amazon Cloud Directory”Amazon Cloud Directory, a cloud-native store for hierarchical data with complex relationships, is closed to new customers as of 7 November 2025 and reaches end of support on 24 July 2027. Existing customers can continue to use it, including creating new directories, until then.
For new work, the AWS alternatives are Amazon DynamoDB for key-value and document data at scale, and Amazon Neptune for interconnected data and graph traversal. Migration requires moving the data and rewriting against different APIs and query patterns.