How to Keep On-Premises AD Authentication for SFTP on AWS?

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Provision an AWS Transfer Family SFTP server with AWS Directory Service as IdP and AD Connector to authenticate against the on-premises Active Directory.

Question

A company has an on-premises SFTP file transfer solution. The company is migrating to the AWS Cloud to scale the file transfer solution and to optimize costs by using Amazon S3. The company's employees will use their credentials for the on-premises Microsoft Active Directory (AD) to access the new solution. The company wants to keep the current authentication and file access mechanisms. Which solution will meet these requirements with the LEAST operational overhead?
  1. Configure an S3 File Gateway. Create SMB file shares on the file gateway that use the existing Active Directory to authenticate.
  2. Configure an Auto Scaling group with Amazon EC2 instances to run an SFTP solution. Configure the group to scale up at 60% CPU utilization.
  3. Create an AWS Transfer Family server with SFTP endpoints. Choose the AWS Directory Service option as the identity provider. Use AD Connector to connect the on-premises Active Directory. Correct Answer
  4. Create an AWS Transfer Family SFTP endpoint. Configure the endpoint to use the AWS Directory Service option as the identity provider to connect to the existing Active Directory.

Key Takeaways

The question tests whether you know AWS Transfer Family needs AD Connector (or an AD trust) to authenticate users against an on-premises Active Directory, and the trap is choosing the bare Transfer Family endpoint in option D that omits the connector.

Migrating an on-premises SFTP workflow to AWS while preserving Active Directory authentication requires AWS Transfer Family with an SFTP endpoint plus AD Connector, not S3 File Gateway or self-managed EC2. This page establishes why option C meets the least-operational-overhead requirement.

Common mistake: The most common wrong answer is D, because it also proposes AWS Transfer Family SFTP with AWS Directory Service, but it never wires the on-premises AD into Directory Service; without AD Connector, existing AD credentials cannot be validated.

Expert Analysis

Why the Answer Is Correct

Option C keeps both the existing authentication and the existing file access mechanism: employees still log in with on-premises AD credentials over SFTP, and the employer keeps a fully managed AWS service instead of operating SFTP servers. AWS Transfer Family provides the SFTP endpoint, AWS Directory Service provides the identity-provider integration, and AD Connector is the bridge that lets Directory Service query the on-premises Active Directory. Because Transfer Family and AD Connector are managed services, the company avoids the patching, scaling, and availability work that self-managed SFTP would demand. That combination is precisely what makes C the lowest-operational-overhead answer.

Why the Other Options Are Wrong

Option A uses S3 File Gateway with SMB file shares, which changes the access protocol away from SFTP and does not preserve the current file access mechanism. Option B builds a self-managed SFTP farm on EC2 behind an Auto Scaling group, which adds operating-system maintenance, scaling logic, and AD integration work, so it is the highest-overhead choice. Option D looks closest because it also uses AWS Transfer Family with SFTP and Directory Service, but it omits AD Connector; a Directory Service identity provider cannot see the on-premises Active Directory unless AD Connector or an AD trust exists. Without that link, on-premises employees would not be able to authenticate, which is why C is correct and D is incomplete.

Community Comment Notes

Scheldon captured the core requirement by saying the solution needs a Transfer Family SFTP-enabled server plus "AWS Directory Service with AD connector to reach on-premises AD for authentication and authorization." Kaula reinforced this by linking directly to the AD Connector documentation. phoenix2023 asked the exact question that separates the two close options — "what is the difference between C and D" — and the answer is the AD Connector that C includes and D leaves out. sandordini described creating an AWS Managed Microsoft AD directory and using it as the Transfer Family identity provider, which is useful context but still needs AD Connector or a trust when the source directory remains on-premises.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question says "keep the current authentication" and the directory lives on-premises, look for the connector that bridges it into AWS rather than a service that only hosts an endpoint. Also watch for protocol mismatches: SMB file shares are not SFTP, and self-managed EC2 SFTP is rarely the lowest-overhead answer on SAA-C03.

Frequently Asked Questions

Why is option D wrong if it also uses AWS Transfer Family SFTP and Directory Service?

D omits AD Connector, so Directory Service has no path to the on-premises Active Directory; without that link, existing AD credentials cannot authenticate.

Can AWS Transfer Family use on-premises Active Directory without AD Connector?

Not directly; you need AD Connector or an AD trust so Directory Service can query on-premises AD while preserving the current authentication mechanism.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Scheldon 👍 3 Answered C
    Answer C We need Transfer Family SFTP enabled server (with SFTP endpoint). Additiionally AWS Directory Service with AD connector to reach on-premises AD for authentication and authorization. https://docs.aws.amazon.com/transfer/latest/userguide/getting-started.html https://docs.aws.amazon.com/transfer/latest/userguide/create-server-sftp.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/what_is.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_ad_connector.html
  2. sandordini 👍 3 Answered C
    1. Create one or more AWS Managed Microsoft AD directories using the AWS Directory Service console. 2. Use the Transfer Family console to create a server that uses AWS Managed Microsoft AD as its identity provider. 3. Add access from one or more of your AWS Directory Service groups. 4. Although not required, we recommend that you test and verify user access.
  3. Kaula 👍 3 Answered C
    https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_ad_connector.html
  4. phoenix2023 👍 2
    what is the difference between C and D ???

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide