Setting up self-managed Active Directory

Connect to your AD domain as a domain administrator.

Open Active Directory Users and Computers and select the domain where you want to create your OU.

Open the context menu for the domain, choose New, and then choose Organizational Unit.

Enter a name for the OU.

Keep the box selected for Protect container from accidental deletion.

Choose OK. Your new OU appears under your domain.

Open Active Directory Users and Computers and select the domain and OU where you want to create your user.

Open the context menu for Users, choose New, and then choose User.

Enter a first name, last name, and logon name for the user. Choose Next.

Enter a password for the user. Don't select User must change password at next login. Don't select Account is disabled. Choose Next.

Choose OK. Your new user appears under your domain.

Open the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in and select the domain where you want to create your user.

Open the context menu for the OU that you created earlier, and choose Delegate Control.

On the Delegation of Control Wizard, choose Next.

On the Users or Groups section, choose Add.

On the Select Users, Computers, or Groups section, enter the AD domain service account you created and choose Check Names. If your AD domain service account check is successful, choose OK.

On the Users or Groups section, confirm your AD domain service account was added and choose Next.

On the Tasks to Delegate section, choose Create a custom task to delegate and choose Next.

On the Active Directory Object Type section:

1. Choose Only the following objects in the folder.

2. Select User Objects.

3. Select Create selected objects in this folder.

4. Select Delete selected objects in this folder and choose Next.

On the Permissions section:

1. Keep General selected.

2. Select Property-specific.

3. Select Creation/deletion of specific child objects.

4. Select Reset Password.

5. Select Read msDS-SupportedEncryptionTypes.

6. Select Write msDS-SupportedEncryptionTypes.

For Completing the Delegation of Control Wizard, review and confirm your settings and choose Finish.

Open the AWS KMS console at https://console.aws.amazon.com/kms/. Choose Create key.

For Key Type, choose Symmetric.

For Key Usage, choose Encrypt and decrypt.

For Advanced options:

1. For Key material origin, choose KMS.

2. For Regionality, choose Single-Region key and choose Next.

For Alias, provide a name for the KMS key.

(Optional) For Description, provide a description of the KMS key.

(Optional) For Tags, provide a tag for the KMS key and choose Next.

For Key administrators, provide the name of an IAM user and select it.

For Key deletion, keep the box selected for Allow key administrators to delete this key and choose Next.

For Key users, provide the same IAM user from the previous step and select it. Choose Next.

Review the configuration.

For Key policy, include the following to the policy Statement:

{
    "Sid": "Allow use of the KMS key on behalf of RDS",
    "Effect": "Allow",
    "Principal": {
        "Service": [
            "rds.amazonaws.com"
        ]
    },
    "Action": "kms:Decrypt",
    "Resource": "*"
}

Choose Finish.

Open the AWS Secrets Manager console at https://console.aws.amazon.com/secretsmanager/. Choose Store a new secret.

For Secret type, choose Other type of secret.

For Key/value pairs, add your two keys:

1. For the first key, enter SELF_MANAGED_ACTIVE_DIRECTORY_USERNAME.

2. For the value of the first key, enter only the username (without the domain prefix) of the AD user. Do not include the domain name as this causes instance creation to fail.

3. For the second key, enter SELF_MANAGED_ACTIVE_DIRECTORY_PASSWORD.

4. For the value of the second key, enter the password that you created for the AD user on your domain.

For Encryption key, enter the KMS key that you created in a previous step and choose Next.

For Secret name, enter a descriptive name that helps you find your secret later.

(Optional) For Description, enter a description for the secret name.

For Resource permission, choose Edit.

Add the following policy to the permission policy:

{
    "Version":"2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Principal":
            {
                "Service": "rds.amazonaws.com"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*",
            "Condition":
            {
                "StringEquals":
                {
                    "aws:sourceAccount": "123456789012"
                },
                "ArnLike":
                {
                    "aws:sourceArn": "arn:aws:rds:us-west-2:123456789012:db:*"
                }
            }
        }
    ]
}

Choose Save then choose Next.

For Configure rotation settings, keep the default values and choose Next.

Review the settings for the secret and choose Store.

Choose the secret you created and copy the value for the Secret ARN. Use this value in the next step to set up self-managed Active Directory.