Seamlessly joining an Amazon EC2 Linux instance to your AWS Managed Microsoft AD Active Directory

To create secrets and store the domain service account information

1. Sign in to the AWS Management Console and open the AWS Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

2. Choose Store a new secret.

3. On the Store a new secret page, do the following:

   1. Under Secret type, choose Other type of secrets.

   2. Under Key/value pairs, do the following:

      1. In the first box, enter awsSeamlessDomainUsername. On the same row, in the next box, enter the username for your service account. For example, if you used the PowerShell command previously, the service account name would be awsSeamlessDomain.

         Note

         You must enter awsSeamlessDomainUsername exactly as it is. Make sure there are not any leading or ending spaces. Otherwise the domain join will fail.

         

      2. Choose Add row.

      3. On the new row, in the first box, enter awsSeamlessDomainPassword. On the same row, in the next box, enter the password for your service account.

         Note

         You must enter awsSeamlessDomainPassword exactly as it is. Make sure there are not any leading or ending spaces. Otherwise the domain join will fail.

      4. Under Encryption key, leave the default value aws/secretsmanager. AWS Secrets Manager always encrypts the secret when you choose this option. You also may choose a key you created.

         Note

         There are fees associated with AWS Secrets Manager, depending on which secret you use. For the current complete pricing list, see AWS Secrets Manager Pricing.

         You can use the AWS managed key aws/secretsmanager that Secrets Manager creates to encrypt your secrets for free. If you create your own KMS keys to encrypt your secrets, AWS charges you at the current AWS KMS rate. For more information, see AWS Key Management Service Pricing.

      5. Choose Next.

4. Under Secret name, enter a secret name that includes your directory ID using the following format, replacing d-xxxxxxxxx with your directory ID:

   aws/directory-services/d-xxxxxxxxx/seamless-domain-join

   This will be used to retrieve secrets in the application.

   Note

   You must enter aws/directory-services/d-xxxxxxxxx/seamless-domain-join exactly as it is but replace d-xxxxxxxxxx with your directory ID. Make sure that there are no leading or ending spaces. Otherwise the domain join will fail.

   

5. Leave everything else set to defaults, and then choose Next.

6. Under Configure automatic rotation, choose Disable automatic rotation, and then choose Next.

   You can turn on rotation for this secret after you store it.

7. Review the settings, and then choose Store to save your changes. The Secrets Manager console returns you to the list of secrets in your account with your new secret now included in the list.

8. Choose your newly created secret name from the list, and take note of the Secret ARN value. You will need it in the next section.

To turn on rotation for the domain service account secret

• Follow the instructions in Set up automatic rotation for AWS Secrets Manager secrets in the AWS Secrets Manager User Guide.

  For Step 5, use the rotation template Microsoft Active Directory credentials in the AWS Secrets Manager User Guide.

  For help, see Troubleshoot AWS Secrets Manager rotation in the AWS Secrets Manager User Guide.

To create the Secrets Manager IAM read policy

1. Sign in to the AWS Management Console as a user that has permission to create IAM policies. Then open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, Access Management, choose Policies.

3. Choose Create policy.

4. Choose the JSON tab and copy the text from the following JSON policy document. Then paste it into the JSON text box.

   Note

   Make sure you replace the Region and Resource ARN with the actual Region and ARN of the secret that you created earlier.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "secretsmanager:GetSecretValue",
                   "secretsmanager:DescribeSecret"
               ],
               "Resource": [
                   "arn:aws:secretsmanager:us-east-1:xxxxxxxxx:secret:aws/directory-services/d-xxxxxxxxx/seamless-domain-join"
               ]
           }
       ]
   }

5. When you are finished, choose Next. The policy validator reports any syntax errors. For more information, see Validating IAM policies.

6. On the Review policy page, enter a policy name, such as SM-Secret-Linux-DJ-d-xxxxxxxxxx-Read. Review the Summary section to see the permissions that your policy grants. Then choose Create policy to save your changes. The new policy appears in the list of managed policies and is now ready to attach to an identity.

To create the LinuxEC2DomainJoin role

1. Sign in to the AWS Management Console as a user that has permission to create IAM policies. Then open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, under Access Management, choose Roles.

3. In the content pane, choose Create role.

4. Under Select type of trusted entity, choose AWS service.

5. Under Use case, choose EC2, and then choose Next.

   

6. For Filter policies, do the following:

   1. Enter AmazonSSMManagedInstanceCore. Then select the check box for that item in the list.

   2. Enter AmazonSSMDirectoryServiceAccess. Then select the check box for that item in the list.

   3. Enter SM-Secret-Linux-DJ-d-xxxxxxxxxx-Read (or the name of the policy that you created in the previous procedure). Then select the check box for that item in the list.

   4. After adding the three policies listed above, select Create role.

   Note

   AmazonSSMDirectoryServiceAccess provides the permissions to join instances to an Active Directory managed by AWS Directory Service. AmazonSSMManagedInstanceCore provides the minimum permissions necessary to use the AWS Systems Manager service. For more information about creating a role with these permissions, and for information about other permissions and policies you can assign to your IAM role, see Create an IAM instance profile for Systems Manager in the AWS Systems Manager User Guide.

7. Enter a name for your new role, such as LinuxEC2DomainJoin or another name that you prefer in the Role name field.

8. (Optional) For Role description, enter a description.

9. (Optional) Choose Add new tag under Step 3: Add tags to add tags. Tag key-value pairs are used to organize, track, or control access for this role.

10. Choose Create role.

To seamlessly join your Linux instance

1. Sign in to the AWS Management Console and open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. From the Region selector in the navigation bar, choose the same AWS Region as the existing directory.

3. On the EC2 Dashboard, in the Launch instance section, choose Launch instance.

4. On the Launch an instance page, under the Name and Tags section, enter the name you would like to use for your Linux EC2 instance.

5. (Optional) Choose Add additional tags to add one or more tag key-value pairs to organize, track, or control access for this EC2 instance.

6. In the Application and OS Image (Amazon Machine Image) section, choose a Linux AMI you wish to launch.

   Note

   The AMI used must have AWS Systems Manager (SSM Agent) version 2.3.1644.0 or higher. To check the installed SSM Agent version in your AMI by launching an instance from that AMI, see Getting the currently installed SSM Agent version. If you need to upgrade the SSM Agent, see Installing and configuring SSM Agent on EC2 instances for Linux.

   SSM uses the aws:domainJoin plugin when joining a Linux instance to a Active Directory domain. The plugin changes the hostname for the Linux instances to the format EC2AMAZ-XXXXXXX. For more information about aws:domainJoin, see AWS Systems Manager command document plugin reference in the AWS Systems Manager User Guide.

7. In the Instance type section, choose the instance type you would like to use from Instance type dropdown list.

8. In the Key pair (login) section, you can either choose to create a new key pair or choose from an existing key pair. To create a new key pair, choose Create new key pair. Enter a name for the key pair and select an option for the Key pair type and Private key file format. To save the private key in a format that can be used with OpenSSH, choose .pem. To save the private key in a format that can be used with PuTTY, choose .ppk. Choose create key pair. The private key file is automatically downloaded by your browser. Save the private key file in a safe place.

   Important

   This is the only chance for you to save the private key file.

9. On the Launch an instance page, under Network settings section, choose Edit. Choose the VPC that your directory was created in from the VPC - required dropdown list.

10. Choose one of the public subnets in your VPC from the Subnet dropdown list. The subnet you choose must have all external traffic routed to an internet gateway. If this is not the case, you won't be able to connect to the instance remotely.

    For more information on how to connect to a internet gateway, see Connect to the internet using an internet gateway in the Amazon VPC User Guide.

11. Under Auto-assign public IP, choose Enable.

    For more information about public and private IP addressing, see Amazon EC2 instance IP addressing in the Amazon EC2 User Guide.

12. For Firewall (security groups) settings, you can use the default settings or make changes to meet your needs.

13. For Configure storage settings, you can use the default settings or make changes to meet your needs.

14. Select Advanced details section, choose your domain from the Domain join directory dropdown list.

    Note

    After choosing the Domain join directory, you may see:

    

    This error occurs if the EC2 launch wizard identifies an existing SSM document with unexpected properties. You can do one of the following:

    • If you previously edited the SSM document and the properties are expected, choose close and proceed to launch the EC2 instance with no changes.

    • Select the delete the existing SSM document here link to delete the SSM document. This will allow for the creation of an SSM document with the correct properties. The SSM document will automatically be created when you launch the EC2 instance.

15. For IAM instance profile, choose the IAM role that you previously created in the prerequisites section Step 2: Create the LinuxEC2DomainJoin role.

16. Choose Launch instance.