Question 358 - CLF-C01 discussion

Explanation:

How to Connect Your On-Premises Active Directory to AWS Using AD Connector Assign users to roles Now that AD Connector is configured and youíve created a role, your next job is to assign users or groups to those IAM roles. Role mapping is what governs what resources a user has access to within AWS. To do this youíll need to: Open the Directory Service console, and click the link to Manage Access.

Click Create New Role.

Click Use Existing Role. Note: If you’ve already assigned Active Directory users or groups to a role, you will be able to modify their membership by clicking the link for the role in the Directory Service console.

Select a role from the list, and then click Next Step.

Type the name of an Active Directory user or group in the search field.

Click Next Step.

Click Create Role Assignments.

When youíre finished you should see the name of the user or group along with the corresponding Id for that object, as shown in the previous image.

The next time the user signs in to the AWS Management Console from the custom sign-in page, they will be signed in under the EC2ReadOnly security role.

Seamlessly join an instance to an Active Directory domain

Another advantage to using AD Connector is the ability to seamlessly join Windows (EC2) instances to your Active Directory domain. You may have read about this feature in the AWS Blog earlier this year. Itís what allows you to join a Windows Server to the domain while the instance is being provisioned instead of using a script or doing it manually. This section of this blog post will explain the steps necessary to enable this feature in your environment and how the service works.

Step 1: Create a role

Until recently you had to manually create an IAM policy to allow an EC2 instance to access the SSM, an AWS service that allows you to configure Windows instances while theyíre running and on first launch. Now, thereís a managed policy called AmazonEC2RoleforSSM that you can use instead. The role you are about to create will be assigned to an EC2 instance when itís provisioned, which will grant it permission to access the SSM service.

To create the role:

Open the IAM console.

Click Roles in the navigation pane.

Click Create Role.

Type a name for your role in the Role Name field.

Under AWS Service Roles, select Amazon EC2 and then click Select.

On the Attach Policy page, select AmazonEC2RoleforSSM and then click Next Step. On the Review page, click Create Role.