Company ABC has used on-premises AD administrative tools to manage resources. The company wants to enable all employees to use on-premises credentials to sign in to the AWS Management Console to access and manage its various AWS resources (e.g., AWS Workspaces etc..) To achieve this, they have successfully created an AWS Microsoft AD directory connected to their on-premises AD via a forest trust relationship. Which below items are still required? Select 3.

Answer options:

A.Configure AWS System Manager to provide access to AWS instances for on-premise users.
B.Ensure the NACL of the AWS Microsoft AD directory allows the outbound traffic to on-premise AD tools.
C.In AWS apps & services section for the AWS Microsoft AD directory, enable all services. This is used to activate the access for services include Amazon WorkSpaces, Amazon WorkMail, RDS SQL Server, and AWS Management Console.
D.Enable AWS Management Console access for the AWS Microsoft AD directory and get the URL that can be used to connect to the console. For example, the AWS Management Console URL is “https://example-corp.awsapps.com/console”.
E.Assign on-premises users and groups to IAM roles.

Correct Answer – C, D, E
Using AWS Managed Microsoft AD directory, you can easily enable access to multiple AWS applications and services such as the AWS Management Console, Amazon WorkSpaces, and Amazon RDS for SQL Server. More importantly, your users can access the application or service with their existing AD credentials. Refer to https://aws.amazon.com/blogs/security/how-to-access-the-aws-management-console-using-aws-microsoft-ad-and-your-on-premises-credentials/ on the details on how to setup AWS Managed Microsoft AD directory and manage administrative permissions to AWS resources.
 
Option A is INCORRECT because Systems Manager provides a unified user interface so you can view operational data from multiple AWS services and is not used to provide access to AWS instances for on-premise users.
Option B is incorrect: Because NACL ( Network Access Control List ) belongs to the scope of subnets. In this case, the security group of the AWS Microsoft AD directory should be taken care of.
Option C is CORRECT because we need to access all services like the AWS Workspaces, AWS WorkMail, AWS Console, and RDS. The access to the management console can be enabled as given below.
Option D is CORRECT: Because this enables AWS Management Console access and provides a URL that can be used to connect to the console. The URL is generated by appending “/console” to the end of the access URL generated in Option
C.Option E is CORRECT: Because this critical step is used to control which AWS resources on-premises users and groups can access from the AWS Management Console.