Adding IP routes when using public IP addresses

You can use Amazon Directory Service for Microsoft Active Directory to take advantage of many powerful Active Directory features, including establishing trusts with other directories. However, if the DNS servers for the networks of the other directories use public (non-RFC 1918) IP addresses, you must specify those IP addresses as part of configuring the trust. Instructions for doing this can be found in Creating a trust relationship.

Similarly, you must also enter the IP address information when routing traffic from your Amazon Managed Microsoft AD on Amazon to a peer Amazon VPC, if the VPC uses public IP ranges.

When you add the IP addresses as described in Creating a trust relationship, you have the option of selecting Add routes to the security group for this directory's VPC. This option should be selected unless you have previously customized your security group to allow the necessary traffic as shown below. For more information, see Understand your directory’s Amazon security group configuration and use.