Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

设置 Connector for AD

本节中的步骤是使用适用于 AD 的连接器的先决条件。它假设你已经创建了一个 Amazon 账户。完成本页上的步骤后，就可以开始为 AD 创建连接器了。

步骤 1：使用创建私有 CA Amazon Private CA

设置私有证书颁发机构 (CA)，用于向目录对象颁发证书。有关更多信息，请参阅 中的证书颁发机构 Amazon Private CA。

私有 CA 必须处于Active状态才能为 AD 创建连接器。私有 CA 的使用者名称必须包含公用名。如果您尝试使用不带公用名的私有 CA 创建连接器，则连接器创建将失败。

步骤 2：设置活动目录

除了私有 CA 之外，您还需要虚拟私有云 (VPC) 中的活动目录。Connector for AD 支持由 Amazon Directory Service提供的以下目录类型：

（仅限 Active Directory 连接器）步骤 3：将权限委托给服务帐户

使用 Directory Service AD Connector 时，您需要向服务账户委派其他权限。在服务账户上设置访问控制列表（ACL）以允许以下功能：

您可以使用此 PowerShell 脚本委派其他权限。它将创建 NTAuth证书证书颁发机构对象。将“myconnectoraccount”替换为服务账户名称。

$AccountName = 'myconnectoraccount'
# DO NOT modify anything below this comment.
# Getting Active Directory information.
Import-Module -Name 'ActiveDirectory'

$currentDomain= Get-ADDomain

$RootDSE = Get-ADRootDSE

# Check if the current domain is the root domain

if ($currentDomain.DistinguishedName -eq $RootDSE.rootDomainNamingContext) {

Write-Output "This is a root domain that supports PCA connector configuration."

} else {

Write-Warning "This is a child domain. You must set up the PCA connector with the root domain:" $RootDSE.rootDomainNamingContext

}

# Getting AD Connector service account information
$AccountProperties = Get-ADUser -Identity $AccountName
$AccountSid = New-Object -TypeName 'System.Security.Principal.SecurityIdentifier' $AccountProperties.SID.Value
[System.GUID]$ServicePrincipalNameGuid = (Get-ADObject -SearchBase $RootDse.SchemaNamingContext -Filter { lDAPDisplayName -eq 'servicePrincipalName' } -Properties 'schemaIDGUID').schemaIDGUID
$AccountAclPath = $AccountProperties.DistinguishedName

# Getting ACL settings for AD Connector service account.
$AccountAcl = Get-ACL -Path "AD:\$AccountAclPath"

# Setting ACL allowing the AD Connector service account the ability to add and remove a Service Principal Name (SPN) to itself
$AccountAccessRule = New-Object -TypeName 'System.DirectoryServices.ActiveDirectoryAccessRule' $AccountSid, 'WriteProperty', 'Allow', $ServicePrincipalNameGuid, 'None'
$AccountAcl.AddAccessRule($AccountAccessRule)
Set-ACL -AclObject $AccountAcl -Path "AD:\$AccountAclPath"

# Add ACLs allowing AD Connector service account the ability to create certification authorities
[System.GUID]$CertificationAuthorityGuid = (Get-ADObject -SearchBase $RootDse.SchemaNamingContext -Filter { lDAPDisplayName -eq 'certificationAuthority' } -Properties 'schemaIDGUID').schemaIDGUID
$CAAccessRule = New-Object -TypeName 'System.DirectoryServices.ActiveDirectoryAccessRule' $AccountSid, 'ReadProperty,WriteProperty,CreateChild,DeleteChild', 'Allow', $CertificationAuthorityGuid, 'All'
$PKSDN = "CN=Public Key Services,CN=Services,CN=Configuration,$($RootDSE.rootDomainNamingContext)"
$PKSACL = Get-ACL -Path "AD:\$PKSDN"
$PKSACL.AddAccessRule($CAAccessRule)
Set-ACL -AclObject $PKSACL -Path "AD:\$PKSDN"

$AIADN = "CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,$($RootDSE.rootDomainNamingContext)"
$AIAACL = Get-ACL -Path "AD:\$AIADN"
$AIAACL.AddAccessRule($CAAccessRule)
Set-ACL -AclObject $AIAACL -Path "AD:\$AIADN"

$CertificationAuthoritiesDN = "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,$($RootDSE.rootDomainNamingContext)"
$CertificationAuthoritiesACL = Get-ACL -Path "AD:\$CertificationAuthoritiesDN"
$CertificationAuthoritiesACL.AddAccessRule($CAAccessRule)
Set-ACL -AclObject $CertificationAuthoritiesACL -Path "AD:\$CertificationAuthoritiesDN"

$NTAuthCertificatesDN = "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,$($RootDSE.rootDomainNamingContext)"
If (-Not (Test-Path -Path "AD:\$NTAuthCertificatesDN")) {
New-ADObject -Name 'NTAuthCertificates' -Type 'certificationAuthority' -OtherAttributes @{certificateRevocationList=[byte[]]'00';authorityRevocationList=[byte[]]'00';cACertificate=[byte[]]'00'} -Path "CN=Public Key Services,CN=Services,CN=Configuration,$($RootDSE.rootDomainNamingContext)" }            

$NTAuthCertificatesACL = Get-ACL -Path "AD:\$NTAuthCertificatesDN"
$NullGuid = [System.GUID]'00000000-0000-0000-0000-000000000000'
$NTAuthAccessRule = New-Object -TypeName 'System.DirectoryServices.ActiveDirectoryAccessRule' $AccountSid, 'ReadProperty,WriteProperty', 'Allow', $NullGuid, 'None'
$NTAuthCertificatesACL.AddAccessRule($NTAuthAccessRule)
Set-ACL -AclObject $NTAuthCertificatesACL -Path "AD:\$NTAuthCertificatesDN"
				

步骤 4：创建 IAM 策略

要为 AD 创建连接器，您需要一个 IAM policy，该策略允许您创建连接器资源，与 Connector for AD 服务共享您的私有 CA，并使用您的目录中授权 Connector for AD 服务。

以下是用户托管策略的示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "pca-connector-ad:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "acm-pca:DescribeCertificateAuthority",
                "acm-pca:GetCertificate",
                "acm-pca:GetCertificateAuthorityCertificate",
                "acm-pca:ListCertificateAuthorities",
                "acm-pca:ListTags",
                "acm-pca:PutPolicy"                
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "acm-pca:IssueCertificate",
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "acm-pca:TemplateArn": "arn:aws:acm-pca:::template/BlankEndEntityCertificate_APIPassthrough/V*"
                },
                "ForAnyValue:StringEquals": {
                    "aws:CalledVia": "pca-connector-ad.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [ 
                "ds:AuthorizeApplication",
                "ds:DescribeDirectories",
                "ds:ListTagsForResource",
                "ds:UnauthorizeApplication",
                "ds:UpdateAuthorizedApplication"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVpcEndpoint",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs",
                "ec2:DeleteVpcEndpoints"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeTags",
                "ec2:DeleteTags",
                "ec2:CreateTags"
            ],
            "Resource": "arn:*:ec2:*:*:vpc-endpoint/*"
        }
    ]
}

AD 连接器需要额外的 Amazon RAM 权限，才能使用控制台和命令行。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ram:CreateResourceShare",
            "Resource": "*",
            "Condition": {
                "StringEqualsIfExists": {
                    "ram:Principal": "pca-connector-ad.amazonaws.com",
                    "ram:RequestedResourceType": "acm-pca:CertificateAuthority"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ram:GetResourcePolicies",
                "ram:GetResourceShareAssociations",
                "ram:GetResourceShares",
                "ram:ListPrincipals",
                "ram:ListResources",
                "ram:ListResourceSharePermissions",
                "ram:ListResourceTypes"
            ],
            "Resource": "*"
        }
    ]
}

第 5 步：与 Connector for AD 共享您的私有 CA

您需要使用 Amazon Resource Access Manager 服务主体共享与连接器服务共享您的私有 CA。

在 Amazon 控制台中创建连接器时，系统会自动为您创建资源共享。

使用创建资源共享时 Amazon CLI，将使用 Amazon RAM create-resource-share命令。

以下命令创建资源共享：

$  aws ram create-resource-share \
    --region us-east-1 \
    --name MyPcaConnectorAdResourceShare \
    --permission-arns arn:aws:ram::aws:permission/AWSRAMBlankEndEntityCertificateAPIPassthroughIssuanceCertificateAuthority \
    --resource-arns arn:aws:acm-pca:region:account:certificate-authority/CA_ID \
    --principals pca-connector-ad.amazonaws.com \
    --sources account
					

调用的服务主体在 PCA 上 CreateConnector 拥有证书颁发权限。要防止使用 Connector for AD 的服务主体拥有对您的 Amazon 私有 CA 资源的常规访问权限，请使用 CalledVia 限制其权限。

步骤 6：创建目录注册

您授权 Connector for AD 服务使用您的目录，以便连接器可以与您的目录通信。要授权 Connector for AD 服务，您需要创建目录注册。有关创建目录注册的更多信息，请参阅 管理目录注册

步骤 7：配置安全组

您的 VPC 与 AD 连接器之间的通信是通过的 Amazon PrivateLink，这需要一个或多个安全组，其入站规则可在您的 VPC 上打开 443 TCP 端口。当您创建连接器时，系统会要求您输入此安全组。您可以将源指定为自定义，然后选择 VPC 的 CIDR 块。您可以选择进一步限制此项（即 IP、CIDR 和安全组 ID）。

步骤 8：为目录对象配置网络访问权限

目录对象需要公共 Internet 访问权限才能验证来自以下域的在线证书状态协议 (OCSP) 和证书吊销列表 (CRLs)：

*.windowsupdate.com
*.amazontrust.com 

所需的最低访问规则：

如果设备无法访问公共互联网，则证书颁发将间歇性失败，并显示错误代码 WS_E_OPERATION_TIMED_OUT.