AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅中国的 AWS 服务入门。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

Step 1: Set up your AWS environment for AWS Managed Microsoft AD

您必须先设置 AWS Managed Microsoft AD 密钥对来对所有登录数据进行加密，然后才能在 AWS 测试实验室中创建 Amazon EC2

创建密钥对

如果您已有已密钥对，可跳过本步骤。有关 Amazon EC2 密钥对的更多信息，请参阅 http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html.

Create, configure, and peer two VPCs

As shown in the following illustration, by the time you finish this multi-step process you will have created and configured two public VPCs, two public subnets per VPC, one Internet Gateway per VPC, and one VPC Peering connection between the VPCs. We chose to use public VPCs and subnets for the purpose of simplicity and cost. For production workloads, we recommend that you use private VPCs. For more information about improving VPC Security, see Security in Amazon Virtual Private Cloud.

All of the AWS CLI and PowerShell examples use the VPC information from below and are built in us-west-2. You may choose any supported Region to build you environment in. 有关一般信息，请参阅 Amazon VPC 是什么？.

Step 1: Create two VPCs

In this step, you need to create two VPCs in the same account using the specified parameters in the following table. AWS Managed Microsoft AD supports the use of separate accounts with the 共享您的目录 feature. 第一个 VPC 将用于 AWS Managed Microsoft AD。第二个 VPC 将用于以后可能在 中使用的资源。教程：创建从 AWS Managed Microsoft AD 到 上自行管理的 Active Directory 安装的信任 Amazon EC2.

有关详细说明，请参阅创建 VPC.

步骤 2：每个 VPC 创建两个子网

After you have created the VPCs you will need to create two subnets per VPC using the specified parameters in the following table. 对于本测试实验室，每个子网将是 /24。这将允许每个子网最多发出 256 个地址。每个子网必须位于单独的可用区中。将每个子网单独放在可用区中是 之一。AWS Managed Microsoft AD先决条件.

有关详细说明，请参阅在 VPC 中创建子网.

Step 3: Create and attach an Internet Gateway to your VPCs

Since we are using public VPCs you will need to create and attach an Internet gateway to your VPCs using the specified parameters in the following table. 这将允许您连接和管理您的 EC2 实例。

有关详细说明，请参阅 Internet 网关.

步骤 4：在 AWS-DS-VPC01 和 AWS-OnPrem-VPC01 之间配置 VPC 对等连接

Since you already created two VPCs earlier, you will need to network them together using VPC peering using the specified parameters in the following table. While there are many ways to connect your VPCs, this tutorial will use VPC Peering. AWS Managed Microsoft AD supports many solutions to connect your VPCs, some of these include VPC peering, Transit Gateway, and VPN.

有关如何在您账户中的两个 VPC 之间创建 VPC 对等连接的说明，请参阅在您账户中的两个 VPC 之间创建 VPC 对等连接.

步骤 5：向每个 VPC 的主路由表添加两条路由

In order for the Internet Gateways and VPC Peering Connection created in the previous steps to be functional you will need to update the main route table of both VPCs using the specified parameters in the following table. 您将添加两条路由：0.0.0.0/0（它将路由到路由表未明确知道的所有目的地）和 10.0.0.0/16 或 10.100.0.0/16（它将通过上面建立的 VPC 对等连接路由到每个 VPC）。

您可以通过筛选 VPC 名称标签（AWS-DS-VPC01 或 AWS-OnPrem-VPC01），轻松找到每个 VPC 的正确路由表。

有关如何向 VPC 路由表添加路由的说明，请参阅从路由表添加和删除路由.

Create security groups for EC2 instances

默认情况下，AWS Managed Microsoft AD 创建安全组来管理其域控制器之间的流量。在本节中，您需要创建 2 个安全组（每个 VPC 一个），它们用于使用下表中的指定参数管理 EC2 实例的 VPC 内流量。您还需要添加规则，允许从任意位置的 RDP (3389) 入站，以及来自本地 VPC 的所有流量类型入站。For more information, see Amazon EC2 security groups for Windows instances.

AWS-DS-VPC01 的安全组入站规则

AWS-DS-VPC01 的安全组出站规则

AWS-OnPrem-VPC01 的安全组入站规则

AWS-OnPrem-VPC01 的安全组出站规则

有关如何创建规则并将规则添加到安全组的详细说明，请参阅使用安全组.