Self-Managed Active Directory with Amazon RDS for SQL Server- AWS Database in 15

Key Takeaways

foreign [Music] my name is Camille Leon I'm a principal Solutions architect with AWS my focus is RDS SQL Server today in this session we're going to be talking about self-managed active directory with Amazon RDS for SQL Server for the agenda the first thing you want to address is the problem statement why we actually built this feature where does it come from then we're going to jump to the user experience we're going to discuss this in more detail what's uh what needs to be done to actually Implement and use this feature then we're going to move to a specific example of how to run these commands then I want to go through key uh very frequently asked questions and and their answers of course before we jump into the demo in which we're going to actually going to be showing you live how to actually domain join directly at RDS SQL Server instance with your customer managed active directory now this is a problem statement um you know the first thing to call out is that Microsoft directory is a very popular directory service I think essentially every request of my work with it uses this uh Microsoft service to some capacity so now we actually historically we did support uh Windows indication but we had to be required to have an AWS manage active directory in between between your active directory domain in in the RDS ones and then what we have to do is set up a one-way trust between this manage ad and the customer manage after director of now are supporting directly joining a self-managed ID now in terms of the user experience there's actually two ways to actually get uh to make to join directly uh yourself manager near your personal manage idea so one is AWS manage active directory self-managed ID and that's how it works but then now you have a second option which is this self-managed Microsoft directory so if you do select that option the form is going to open up these five Fields so we have first a fully qualified domain name which is the name for the name of your directory in this case is this kind of the problem it is going to be another example the second field is that domain organizational unit that refers to is like which OU which you can access your unit do you want the computer objects to be created so what happens is every time you domain join any RDS instance a computer object is going to be created or two depending if you have multi-ac setup or not every time you join domain join RDS instant because you know tools easy tool is supporting RDS so if you don't Supply that that's an optional field it will just go to your default um or you all these computer objects and the Third Field is uh it's actually the secret which is actually a link to the secret in which you're going to have a couple of name value Pairs and so it's going to have the username and the password it's name value Pairs and then you just have to supply the link to that um that secret and then the last two are the D and the IP of the DNS server that you use for your domain controller if you only have one you can just repeat the same IP twice but then you have the option to supply up to two DNS servers for your active directory Forest okay so then here you can do this in a two moments right you can do this when you create the RBS SQL Server instance and you can do it when you mod it later by modifying the instance and the list of course you can be you can do it also via powershare or the awsc like command which is what you're looking at here and in this case we're doing the same thing we've done in the slide before but you've seen a command and you're going to have some additional switches that are being there enabled for you for the modified database instance in the create database instant that allows you to set up these fields so you can actually have yourself manage AV integration those are frequently asked questions um the first one question we get asked a lot is that does updating a user prediction cause any downtime the answer is no you can just provide a new credentials via a modified DB instance uh AP Echo and it's just it's an online operation there's no night time required for that um in terms of prerequisition is a unique connectivity to your between the active directory your self-managed directory and RDS by basically opening a set of ports to enable active directory you can have it you're going to need a KMS key and you're going to need a secret in which you're going to store the the credentials for your service account that's going to be doing the integration between the two after the recovery forests the other question that comes up a lot is that can customers use ad connector to domain join RDS instances do their on-premises active directory the answer is no this is not supported for initial release next question is will it be possible to migrate existing instances that are using this intermediate managed ad and just go directly to your social manager active directory and the answer is yes it's quite simple all you have to do is just modify the instance you can just do it via the user interface directly just click on the instance and modify when I see it on the demo soon or you can just call the the API and make the command write the parameters and that's all it takes now in terms of the demo we're going to first take a quick look of the self managed ad Forest that we're going to use here for this purposes we're going to set up select the sample user as a in an instance to do this integration and then um we're gonna actually domain join the SQL Server instance uh leveraging the CLI command um and then what we're going to do is once we do that we to verify we actually did uh successfully domain join this RDS we're going to actually try to log in with this and Sample user using authentication will verify that that's actually the case so let's move on now to our demo okay moving on to our demo so the first thing we want to do is you probably uh some of you already noticed I'm a big uh sci-fi fan particular about the Terminator franchise so you can see here we have these uh usual characters we have John Connor we got Sarah Connor you know we have the Terminator of course and Kyle Reese so what I want to do is I want to use John Corner as a sample user for our demo right now in particularly you know he's a member of this group called database administrators and if we go to see the members you'll see that John corner is actually one of the members of this group so so that's actually what we're going to be using uh as a sample for in this case so now let's try to actually domain join this so there's two ways you can actually do this so one is that we can actually go and basically just modify the instance which I'm going to show you in a second so here if we go to our selected database instance which is RDS this demo SQL Server smad1 here this one here we can just click on modify and basically apply those directly I just want to show you so how that looks like in terms of the user interface so here when I click on modify okay if you scroll down there is a section in which yourself authentication so that's when just make it to a place here so if I enable one indication it used to be that you only had one option but now uh you can either choose manage active directory and in that case you just choose directly you want to use as an intermediate directory or you can use self-manager directory and that's it and then that's all it takes and I can just click modify and decide to apply that immediately but then instead what I want to do is want to do this as a command as you can see here we're going to be modifying the instance and then the identifiers demo SQL Server smad1 the fully qualified domain name is actually um skynet.com the OU is RDS is what when these objects to actually exist and the secret we're just gonna We Supply the same secret link we used before and enter the IPS I just repeated the same IPS I had before and then I Hyperlite this switch which is very important that apply immediately then as soon as you issue this command this is submits this uh job to the queue and you get immediately it's a set of parameters of what are what are the current parameters you have for your instance because you're actually you're modifying the instance so what it's showing here as a Json object is what are the current values so we if we continue to scroll down we will see that in the in the windows authentication section we should see this parameter we just set up that's the one thing I want to just verify and then we just wait because it's going to take some time for this to actually complete we're going to see in a second how this goes to uh modifying mode is going to be there between five to six uh seven minutes depending on your environment and then after that okay so here as you can see we got it it's pending join the status the fully qualified domain is skynet.com and the ous RDS and we have the link to the Secrets manager and the IPS are right here so then after that just you know let's say command complete so we we just we submitted the modified command and we're just going to go to the console and actually uh just verify that we that we actually did submit that modification request and then as soon as it completes uh we will try to connect directly leveraging Windows indication in our you know our sample server that's actually a client that for bi purposes that we had and we and then we're going to try to join us let's jump corner so if we come here still the dashboard to come up it's okay let's if we look at the instances we should see that the instance demo SQL Server smad1 should be modifying at the moment so here you can see is that that this instance smad1 is actually modifying so it's going to take a little while to actually complete and then as soon as we come back we'll continue with our demo now we have our uh instance finally is domain join so we're just going to verify that in the interface first so we're going to log in navigate here to the instance properties just to check the connectivity settings and see where the which domain this uh is this is joined to so you can see here if we scroll down you'll see that we are joined to the skynet.com directory so now we're going to do to verify that and it's in the OU RDS so we're going to go back to our server and in which we are our SRS client and we're going to try to um to connect to First we're going to do is say connect remember for SQL Server login as with the master user so what I'm going to do is I'm going to first add the the login database administrators uh to this uh instance so because now this is General domain join you're just going to go and add the instead of fighting specific user I want to add the database administrators group and then since John corner is a member of that group Kyle Reese they just it should have automatically have access so here they go I'm going to connect to the same server but this time I'm going to be using Windows indication so instead of SQL certification is with indication and we're going to be authenticating the Zone corner here so we can see here it connects with other problems then now I just want to verify how they're connected because that's the final thing point I want to make is that at the moment uh in this current release we only support ntlm for application with navigation we don't support care for us yet we're actively working on it it's going to be available pretty soon but at the moment we only supported ntlm so just to verify that I wanted to select this query and just look at the DMV theme exact connections and you can see here the authentication scheme is ntlm so basically what we did is we we definitely we issued this the modified DB instance with the right parameters we waited for a little while it domain joined directly or obvious SQL Server instance and now we we added a group um just like in real medication to the resource security and now we could just log in directly leveraging wind authentication in groups which is basically how people use this and that completes our demo for today I hope you enjoyed it and thank you very much [Music] [Music] thank you [Music]