Security pillar
The security pillar focuses on protecting information and systems. The following recommendations can help you meet the security design principles and architectural best practices for AWS Managed Microsoft AD.
Key focus areas
Data integrity and confidentiality
Managing user permissions
Establishing controls to detect security events
Implement a strong identity foundation
Grant the least AWS Identity and Access Management (IAM) privileges needed to AWS resources that must integrate with AWS Managed Microsoft AD.
Grant the least Microsoft Active Directory security permissions needed for the users and groups that you create within Microsoft Active Directory.
Use group Managed Service Accounts (gMSAs) together with Kerberos constrained delegation to manage service accounts. Make sure that you specify and enforce application trust boundaries by limiting when application services can act on a user's behalf.
Activate traceability
Activate log forwarding on the directory level to forward domain controller security event logs to Amazon CloudWatch Logs. For more information, see Enable log forwarding in the AWS Directory Service documentation.
Activate AWS CloudTrail to log AWS Directory Service API calls. For more information, see the Set up central AWS CloudTrail
section of the AWS Multi-Account Security Governance Workshop. Track failed logins. For more information, see How to monitor and track failed logins for your AWS Managed Microsoft AD
on the AWS Blog.
Apply security to all layers
Change the directory security group rules that accept traffic from 0.0.0.0/0 to a more restrictive list of IP addresses or security groups.
Use SMB 2.x clients when accessing the SYSVOL and NETLOGON shares.
Track SMBv1 remote connections and gradually deactivate it. For more information, see Safely disabling SMB v1 from your production environment
on the Microsoft Secure Infrastructure Blog. Configure password policies that meet your security standards. For more information, see Manage password policies for AWS Managed Microsoft AD in the AWS Directory Service documentation.
Activate multi-factor authentication (MFA). For more information, see Enable multi-factor authentication for AWS Managed Microsoft AD in the AWS Directory Service documentation.
Automate security best practices and prepare for security events
Automate incident responses to specific security events, including the following:
Group policy changes
Sensitive privilege use
Security state changes
To automate event notifications and responses you can use any of the following AWS services:
Protect data in transit and at rest
Activate server-side and client-side secure Lightweight Directory Access Protocol (LDAP). For more information, see Enable secure LDAP (LDAPS) in the AWS Directory Service documentation.
