Seamlessly joining an Amazon EC2 Linux instance to a shared AWS Managed Microsoft AD

Open the IAM console at https://console.aws.amazon.com/iam/.

In the left navigation pane, under Access Management, choose Roles.

On the Roles page, choose Create role.

Under Select type of trusted entity, choose AWS service.

Under Use case, choose EC2, and then choose Next

For Filter policies, do the following:

1. Enter AmazonSSMManagedInstanceCore. Then select the checkbox for that item in the list.

2. Enter AmazonSSMDirectoryServiceAccess. Then select the checkbox for that item in the list.

3. After adding these policies, select Create role.

   Note

   AmazonSSMDirectoryServiceAccess provides the permissions to join instances to an Active Directory managed by AWS Directory Service. AmazonSSMManagedInstanceCore provides the minimum permissions necessary to use AWS Systems Manager. For more information about creating a role with these permissions, and for information about other permissions and policies you can assign to your IAM role, see Configure instance permissions required for Systems Manager in the AWS Systems Manager User Guide.

Enter a name for your new role, such as LinuxEC2DomainJoin or another name that you prefer in the Role name field.

(Optional) For Role description, enter a description.

(Optional) Choose Add new tag under Step 3: Add tags to add tags. Tag key-value pairs are used to organize, track, or control access for this role.

Choose Create role.

Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

From the list of secrets, choose your Secret you created during the Prerequisites.

On the Secret's details page under the Overview tab, scroll down to Resource permissions.

Select Edit permissions.

1. In the policy field, enter the following policy. The following policy allows LinuxEC2DomainJoin in Account 2 to access the secret in Account 1. Replace the ARN value with the ARN value for your Account 2, LinuxEC2DomainJoin role you created in Step 1. To use this policy, see Attach a permissions policy to an AWS Secrets Manager secret.

   {
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::Account2:role/LinuxEC2DomainJoin"
         },
         "Action": "secretsmanager:GetSecretValue",
         "Resource": "*"
       }
     ]
   }
   

Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

In the left navigation pane, select Customer managed keys.

On the Customer managed keys page, select the key you created.

On the Key Details page, navigate to Key policy, and select Edit.

The following key policy statement allows ApplicationRole in Account 2 to use the KMS key in Account 1 to decrypt the secret in Account 1. To use this statement, add it to the key policy for your KMS key. For more information, see Changing a key policy.

{
{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::Account2:role/ApplicationRole"
  },
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

Open the IAM console at https://console.aws.amazon.com/iam/.

In the left navigation pane, under Access management, select Policies.

Select Create Policy. Choose JSON in the Policy editor.

The following policy allows ApplicationRole in Account 2 to access the secret in Account 1 and decrypt the secret value by using the encryption key which is also in Account 1. You can find the ARN for your secret in the Secrets Manager console on the Secret Details page under Secret ARN. Alternatively, you can call describe-secret to identify the secret’s ARN. Replace the Resource ARN with the Resource ARN for the secret ARN and Account 1. To use this policy, see Attach a permissions policy to an AWS Secrets Manager secret.

{
{
  "Version" : "2012-10-17",
  "Statement" : [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "SecretARN"
    },
    {
      "Effect": "Allow",
      "Action": [
"kms:Decrypt",
"kms:Describekey"     
],
      "Resource": "arn:aws:kms:Region:Account1:key/Your_Encryption_Key"
    }
  ]
}

Select Next and then select Save changes.

Find and select the Role you created in Account 2 in Attach a resource policy to the secret in Account 1.

Under Add permissions, select Attach policies.

In the search bar, find the policy you created in Add a statement to the key policy for the KMS key in Account 1 and select the box to add the policy to the role. Then select Add permissions.

Sign in to the AWS Management Console and open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

From the Region selector in the navigation bar, choose the same AWS Region as the existing directory.

On the EC2 Dashboard, in the Launch instance section, choose Launch instance.

On the Launch an instance page, under the Name and Tags section, enter the name you would like to use for your Linux EC2 instance.

(Optional) Choose Add additional tags to add one or more tag key-value pairs to organize, track, or control access for this EC2 instance.

In the Application and OS Image (Amazon Machine Image) section, choose a Linux AMI you wish to launch.

In the Instance type section, choose the instance type you would like to use from Instance type dropdown list.

In the Key pair (login) section, you can either choose to create a new key pair or choose from an existing key pair. To create a new key pair, choose Create new key pair. Enter a name for the key pair and select an option for the Key pair type and Private key file format. To save the private key in a format that can be used with OpenSSH, choose .pem. To save the private key in a format that can be used with PuTTY, choose .ppk. Choose create key pair. The private key file is automatically downloaded by your browser. Save the private key file in a safe place.

On the Launch an instance page, under Network settings section, choose Edit. Choose the VPC that your directory was created in from the VPC - required dropdown list.

Choose one of the public subnets in your VPC from the Subnet dropdown list. The subnet you choose must have all external traffic routed to an internet gateway. If this is not the case, you won't be able to connect to the instance remotely.

For more information on how to connect to a internet gateway, see Connect to the internet using an internet gateway in the Amazon VPC User Guide.

Under Auto-assign public IP, choose Enable.

For more information about public and private IP addressing, see Amazon EC2 instance IP addressing in the Amazon EC2 User Guide.

For Firewall (security groups) settings, you can use the default settings or make changes to meet your needs.

For Configure storage settings, you can use the default settings or make changes to meet your needs.

Select Advanced details section, choose your domain from the Domain join directory dropdown list.

Note

After choosing the Domain join directory, you may see:

This error occurs if the EC2 launch wizard identifies an existing SSM document with unexpected properties. You can do one of the following:

• If you previously edited the SSM document and the properties are expected, choose close and proceed to launch the EC2 instance with no changes.

• Select the delete the existing SSM document here link to delete the SSM document. This will allow for the creation of an SSM document with the correct properties. The SSM document will automatically be created when you launch the EC2 instance.

For IAM instance profile, choose the IAM role that you previously created in the prerequisites section Step 2: Create the LinuxEC2DomainJoin role.

Choose Launch instance.