Question

A company is migrating a fleet of on-premises Windows Server applications to AWS. The applications currently authenticate against an on-premises Active Directory forest and depend on Group Policy, domain-joined service accounts, and Kerberos authentication. The migration team wants to move the servers with minimal application code changes while reducing the operational burden of managing domain controllers. They also want migrated EC2 instances to remain domain-joined during and after migration without maintaining a full-time high-bandwidth link to the on-premises forest. Which approach BEST meets these requirements?

Accepted Answer

Rehost the servers with AWS Application Migration Service (MGN), deploy AWS Managed Microsoft AD, and establish a trust or directory synchronization so migrated instances domain-join the AWS-managed directory.

Answer

Rehost the servers with AWS MGN and configure each migrated EC2 instance to authenticate over an AWS Site-to-Site VPN back to the on-premises domain controllers permanently.

Answer

Refactor the applications to use Amazon Cognito user pools for authentication and remove the Active Directory dependency before migrating with MGN.

Answer

Use AWS DMS to replicate the application servers to AWS and join them to a self-managed Active Directory running on a single EC2 instance.