<p>Yes, you just need a Read Only Domaine Controler (search for RODC) in the vpc and you'll be able to have a one way replication as the read only controler won't need to send datas back.</p>

<p>This bring limitation for clients in the vpc, as they won't be able to reach a writable DC they can't change passwords and you'll need a careful site architecture in your forest. </p>

CC BY-SA 3.0
2017-12-30T16:01:41.363Z
2017-12-30T16:01:41.363Z
Tensibai
<p>In our work environment we have a standard Corporate Intranet with <a href="https://msdn.microsoft.com/en-us/library/bb742424.aspx" rel="nofollow noreferrer">Active Directory</a>. </p>

<p>We've been granted limited access to an <a href="https://aws.amazon.com/vpc/" rel="nofollow noreferrer">AWS VPC</a>. Our connection allows outbound (from the Intranet to the VPC) but not inbound. </p>

<p>That is - if we run a webserver in the AWS VPC, then a client in the Corporate Intranet can connect and browse to it. But a client in the AWS VPC cannot connect to a webserver in the Corporate intranet. Note that this 'outbound connections only principle' applies to all ports, not just http port 80. </p>

<p>An associate has suggested we need to replicate our Active Directory down to the <a href="https://docs.aws.amazon.com/quickstart/latest/active-directory-ds/overview.html" rel="nofollow noreferrer">AWS VPC AD</a>. I think it is not possible to do a one-way replication. </p>

<p>My question is: <strong>Can you replicate Active Directory from a Corporate Intranet to an AWS VPC where there is an outbound-only link?</strong></p>

<amazon-web-services><aws-vpc><active-directory>
Can you replicate Active Directory from a Corporate Intranet to an AWS VPC where there is an outbound-only link?
hawkeye
# Can you replicate Active Directory from a Corporate Intranet to an AWS VPC where there is an outbound-only link?

(Asked by: username_0 on 2017-12-30)

In our work environment we have a standard Corporate Intranet with [Active Directory](https://msdn.microsoft.com/en-us/library/bb742424.aspx).

We've been granted limited access to an [AWS VPC](https://aws.amazon.com/vpc/). Our connection allows outbound (from the Intranet to the VPC) but not inbound.

That is - if we run a webserver in the AWS VPC, then a client in the Corporate Intranet can connect and browse to it. But a client in the AWS VPC cannot connect to a webserver in the Corporate intranet. Note that this 'outbound connections only principle' applies to all ports, not just http port 80.

An associate has suggested we need to replicate our Active Directory down to the [AWS VPC AD](https://docs.aws.amazon.com/quickstart/latest/active-directory-ds/overview.html). I think it is not possible to do a one-way replication.

My question is: **Can you replicate Active Directory from a Corporate Intranet to an AWS VPC where there is an outbound-only link?**

**Tags:** amazon-web-services, aws-vpc, active-directory


---

## 1 answers

### Answer by username_1 on 2017-12-30. Score: 1 | Accepted answer

Yes, you just need a Read Only Domaine Controler (search for RODC) in the vpc and you'll be able to have a one way replication as the read only controler won't need to send datas back.

This bring limitation for clients in the vpc, as they won't be able to reach a writable DC they can't change passwords and you'll need a careful site architecture in your forest.


---

