CreateTrust - Amazon Directory Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


Amazon Directory Service for Microsoft Active Directory allows you to configure trust relationships. For example, you can establish a trust between your Amazon Managed Microsoft AD directory, and your existing self-managed Microsoft Active Directory. This would allow you to provide users and groups access to resources in either domain, with a single set of credentials.

This action initiates the creation of the Amazon side of a trust relationship between an Amazon Managed Microsoft AD directory and an external domain. You can create either a forest trust or an external trust.

Request Syntax

{ "ConditionalForwarderIpAddrs": [ "string" ], "DirectoryId": "string", "RemoteDomainName": "string", "SelectiveAuth": "string", "TrustDirection": "string", "TrustPassword": "string", "TrustType": "string" }

Request Parameters

The request accepts the following data in JSON format.


The IP addresses of the remote DNS server associated with RemoteDomainName.

Type: Array of strings

Pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$

Required: No


The Directory ID of the Amazon Managed Microsoft AD directory for which to establish the trust relationship.

Type: String

Pattern: ^d-[0-9a-f]{10}$

Required: Yes


The Fully Qualified Domain Name (FQDN) of the external domain for which to create the trust relationship.

Type: String

Length Constraints: Maximum length of 1024.

Pattern: ^([a-zA-Z0-9]+[\\.-])+([a-zA-Z0-9])+[.]?$

Required: Yes


Optional parameter to enable selective authentication for the trust.

Type: String

Valid Values: Enabled | Disabled

Required: No


The direction of the trust relationship.

Type: String

Valid Values: One-Way: Outgoing | One-Way: Incoming | Two-Way

Required: Yes


The trust password. The must be the same password that was used when creating the trust relationship on the external domain.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: ^(\p{LD}|\p{Punct}| )+$

Required: Yes


The trust relationship type. Forest is the default.

Type: String

Valid Values: Forest | External

Required: No

Response Syntax

{ "TrustId": "string" }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.


A unique identifier for the trust relationship that was created.

Type: String

Pattern: ^t-[0-9a-f]{10}$


For information about the errors that are common to all actions, see Common Errors.


A client exception has occurred.

HTTP Status Code: 400


The specified entity already exists.

HTTP Status Code: 400


The specified entity could not be found.

HTTP Status Code: 400


One or more parameters are not valid.

HTTP Status Code: 400


An exception has occurred in Amazon Directory Service.

HTTP Status Code: 500


The operation is not supported.

HTTP Status Code: 400


The following examples are formatted for legibility.

Example Request

This example illustrates one usage of CreateTrust.

POST / HTTP/1.1 Host: Accept-Encoding: identity Content-Length: 222 X-Amz-Target: DirectoryService_20150416.CreateTrust X-Amz-Date: 20161213T235223Z User-Agent: aws-cli/1.11.24 Python/2.7.9 Windows/7 botocore/1.4.81 Content-Type: application/x-amz-json-1.1 Authorization: AWS4-HMAC-SHA256 Credential=AKIAI7E3BYXS3example/20161213/us-west-2/ds/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-target, Signature=1f0cff7825d20bab2a0dab1e0b8bedbed72f0c22175c7d9ed0e63598ae99cae5 { "TrustPassword":"Str0ngP@ssw0rd", "DirectoryId":"d-926example", "RemoteDomainName":"", "ConditionalForwarderIpAddrs":[ "" ], "TrustType":"Forest", "TrustDirection":"One-Way: Outgoing" }

Example Response

This example illustrates one usage of CreateTrust.

HTTP/1.1 200 OK x-amzn-RequestId: 3343bc79-c18f-11e6-ba7f-e33ae22bc363 Content-Type: application/x-amz-json-1.1 Content-Length: 26 Date: Tue, 13 Dec 2016 23:52:26 GMT { "TrustId":"t-9267353743" }

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: