Hybrid directory prerequisites

To create an Amazon KMS key

1. In the Amazon KMS console, choose Create key.

2. For Key Type, choose Symmetric.

3. For Key Usage, choose Encrypt and decrypt.

4. For Advanced options:

   1. For Key material origin, choose KMS.

   2. For Regionality, choose Single-Region key and choose Next.

5. For Alias, provide a name for the KMS key.

6. (Optional) For Description, provide a description of the KMS key.

7. (Optional) For Tags, add tags for the KMS key and choose Next.

8. For Key administrators, select an IAM user.

9. For Key deletion, keep the default selection for Allow key administrators to delete this key and choose Next.

10. For Key users, select the same IAM user from the previous step and choose Next.

11. Review the configuration.

12. For Key policy, add the following statement to the policy:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "Enable IAM User Permissions",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::caller-account:role/role_used_to_create_directory"
          },
          "Action": "kms:*",
          "Resource": "*"
        },
        { 
           "Sid": "Allow use of the KMS key on behalf of Directory Service", 
           "Effect": "Allow", 
           "Principal": {
             "Service": "ds.amazonaws.com"
           }, 
           "Action": "kms:Decrypt", 
           "Resource": "*"
        }
      ]
    }

13. Choose Finish.

1. Add the username key

   1. For the first key, enter customerAdAdminDomainUsername.

   2. For the value of the first key, enter only the username (without the domain prefix) of the AD user. Do not include the domain name as this causes instance creation to fail.

2. Add the password key

   1. For the second key, enter customerAdAdminDomainPassword.

   2. For the value of the second key, enter the password that you created for the AD user on your domain.

1. For Encryption key, select the KMS key that you created in Create a KMS key and choose Next.

2. For Secret name, enter a description for the secret.

3. (Optional) For Description, enter a description for the secret.

4. Choose Next.

5. For Configure rotation settings, keep the default values and choose Next.

6. Review the settings for the secret and choose Store.

7. Choose the secret you created and copy the value for the Secret ARN. You will use this ARN in the next step to set up your self-managed Active Directory.