AWS.DirectoryService reference

ConditionalForwarder

Source: src/AWS/DirectoryService/ConditionalForwarder.ts

A conditional forwarder on an AWS Managed Microsoft AD (or AD Connector) directory — forwards DNS queries for a remote domain to that domain’s DNS servers. Conditional forwarders are the prerequisite for trust relationships with other domains.

ConditionalForwarder: Creating a Conditional Forwarder

const directory = yield* Directory("Corp", {
  type: "MicrosoftAD",
  name: "corp.example.com",
  password: Redacted.make("SuperSecret123!"),
  vpcId: vpc.vpcId,
  subnetIds: [subnetA.subnetId, subnetB.subnetId],
});
const forwarder = yield* ConditionalForwarder("Partner", {
  directoryId: directory.directoryId,
  remoteDomainName: "partner.example.com",
  dnsIpAddrs: ["10.10.0.2", "10.10.1.2"],
});

CreateComputer

Source: src/AWS/DirectoryService/CreateComputer.ts

Runtime binding for the CreateComputer operation (IAM action ds:CreateComputer), scoped to one Directory.

Creates a computer account in the bound directory — the programmatic half of joining a machine to the domain (e.g. from an instance-provisioning workflow). Password is the one-time machine password and is sensitive; pass a Redacted value. The directory id is injected from the binding. Provide the implementation with Effect.provide(AWS.DirectoryService.CreateComputerHttp).

CreateComputer: Managing Computers

// init — bind the operation to the directory
const createComputer = yield* AWS.DirectoryService.CreateComputer(directory);

// runtime
const { Computer } = yield* createComputer({
  ComputerName: "BUILD-AGENT-01",
  Password: Redacted.make("0ne-Time-Secret!"),
});

CreateSnapshot

Source: src/AWS/DirectoryService/CreateSnapshot.ts

Runtime binding for the CreateSnapshot operation (IAM action ds:CreateSnapshot), scoped to one Directory.

Takes a manual snapshot of the bound Simple AD or Managed Microsoft AD directory — e.g. before a scheduled change — returning the new SnapshotId. Manual snapshots are limited per directory (see GetSnapshotLimits). The directory id is injected from the binding. Provide the implementation with Effect.provide(AWS.DirectoryService.CreateSnapshotHttp).

CreateSnapshot: Managing Snapshots

// init — bind the operation to the directory
const createSnapshot = yield* AWS.DirectoryService.CreateSnapshot(directory);

// runtime
const { SnapshotId } = yield* createSnapshot({ Name: "pre-migration" });

DescribeDirectories

Source: src/AWS/DirectoryService/DescribeDirectories.ts

Runtime binding for the DescribeDirectories operation (IAM action ds:DescribeDirectories).

Reads directory descriptions at runtime — stage, DNS addresses, VPC settings — for some or all of the account’s directories. The action does not support resource-level permissions, so the grant is account-wide. Provide the implementation with Effect.provide(AWS.DirectoryService.DescribeDirectoriesHttp).

DescribeDirectories: Reading Directories

// init — request the account-level capability
const describeDirectories = yield* AWS.DirectoryService.DescribeDirectories();

// runtime
const { DirectoryDescriptions } = yield* describeDirectories({
  DirectoryIds: [directoryId],
});
const directory = DirectoryDescriptions?.[0];
console.log(directory?.Stage, directory?.DnsIpAddrs);

DescribeDomainControllers

Source: src/AWS/DirectoryService/DescribeDomainControllers.ts

Runtime binding for the DescribeDomainControllers operation (IAM action ds:DescribeDomainControllers), scoped to one Directory.

Lists the bound directory’s domain controllers — id, DNS address, Availability Zone, and status (Active, Impaired, …) — so a monitoring function can alert on an impaired controller. The directory id is injected from the binding. Provide the implementation with Effect.provide(AWS.DirectoryService.DescribeDomainControllersHttp).

DescribeDomainControllers: Monitoring the Directory

// init — bind the operation to the directory
const describeDomainControllers =
  yield* AWS.DirectoryService.DescribeDomainControllers(directory);

// runtime
const { DomainControllers } = yield* describeDomainControllers();
for (const controller of DomainControllers ?? []) {
  if (controller.Status === "Impaired") {
    yield* Effect.logError(`impaired controller: ${controller.DomainControllerId}`);
  }
}

DescribeSnapshots

Source: src/AWS/DirectoryService/DescribeSnapshots.ts

Runtime binding for the DescribeSnapshots operation (IAM action ds:DescribeSnapshots), scoped to one Directory.

Lists the bound directory’s snapshots — id, type (Auto/Manual), status, and start time. The directory id is injected from the binding. Provide the implementation with Effect.provide(AWS.DirectoryService.DescribeSnapshotsHttp).

DescribeSnapshots: Managing Snapshots

// init — bind the operation to the directory
const describeSnapshots = yield* AWS.DirectoryService.DescribeSnapshots(directory);

// runtime
const { Snapshots } = yield* describeSnapshots();
for (const snapshot of Snapshots ?? []) {
  console.log(snapshot.SnapshotId, snapshot.Status);
}

Directory

Source: src/AWS/DirectoryService/Directory.ts

An AWS Directory Service managed directory — either Simple AD (Samba) or AWS Managed Microsoft AD.

Directories are VPC-only and require two subnets in different Availability Zones. Provisioning is SLOW: Simple AD takes roughly 10 minutes and Microsoft AD 20-40 minutes, and directories bill hourly while they exist. Destroy directories you are not using.

Directory: Creating a Directory

Simple AD Directory

const directory = yield* Directory("Corp", {
  name: "corp.example.com",
  password: Redacted.make("SuperSecret123!"),
  size: "Small",
  vpcId: vpc.vpcId,
  subnetIds: [subnetA.subnetId, subnetB.subnetId],
});

Managed Microsoft AD Directory

const directory = yield* Directory("Corp", {
  type: "MicrosoftAD",
  name: "corp.example.com",
  shortName: "CORP",
  password: Redacted.make("SuperSecret123!"),
  edition: "Standard",
  vpcId: vpc.vpcId,
  subnetIds: [subnetA.subnetId, subnetB.subnetId],
});

Directory: Using the Directory

const directory = yield* Directory("Corp", { ... });
// the directory-provided DNS servers, one per Availability Zone
const dns = directory.dnsIpAddrs;

EventTopic

Source: src/AWS/DirectoryService/EventTopic.ts

An association between an AWS Directory Service Directory and an Amazon SNS topic. The directory publishes a status message to the topic whenever it changes stage — e.g. from Active to Impaired or Inoperable, and back to Active — which is Directory Service’s native event mechanism.

To consume the notifications from a Lambda function, use consumeDirectoryStatus, which creates this association and subscribes the function to the topic.

EventTopic: Publishing Directory Status Notifications

const topic = yield* SNS.Topic("DirectoryStatus", {});
const eventTopic = yield* DirectoryService.EventTopic("Status", {
  directoryId: directory.directoryId,
  topicName: topic.topicName,
});

GetDirectoryLimits

Source: src/AWS/DirectoryService/GetDirectoryLimits.ts

Runtime binding for the GetDirectoryLimits operation (IAM action ds:GetDirectoryLimits).

Reads the account’s directory limits for the current region — how many cloud directories exist versus the allowed maximum — so an ops function can alert before directory creation starts failing. The action does not support resource-level permissions, so the grant is account-wide. Provide the implementation with Effect.provide(AWS.DirectoryService.GetDirectoryLimitsHttp).

GetDirectoryLimits: Reading Account Limits

// init — request the account-level capability
const getDirectoryLimits = yield* AWS.DirectoryService.GetDirectoryLimits();

// runtime
const { DirectoryLimits } = yield* getDirectoryLimits();
if (DirectoryLimits?.CloudOnlyDirectoriesLimitReached) {
  yield* Effect.logWarning("directory limit reached");
}

GetSnapshotLimits

Source: src/AWS/DirectoryService/GetSnapshotLimits.ts

Runtime binding for the GetSnapshotLimits operation (IAM action ds:GetSnapshotLimits), scoped to one Directory.

Reads the bound directory’s manual snapshot limits — how many manual snapshots exist versus the allowed maximum — so a backup function can prune before taking a new snapshot. The directory id is injected from the binding. Provide the implementation with Effect.provide(AWS.DirectoryService.GetSnapshotLimitsHttp).

GetSnapshotLimits: Managing Snapshots

// init — bind the operation to the directory
const getSnapshotLimits = yield* AWS.DirectoryService.GetSnapshotLimits(directory);

// runtime
const { SnapshotLimits } = yield* getSnapshotLimits();
if (SnapshotLimits?.ManualSnapshotsLimitReached) {
  yield* Effect.logWarning("manual snapshot limit reached");
}

ResetUserPassword

Source: src/AWS/DirectoryService/ResetUserPassword.ts

Runtime binding for the ResetUserPassword operation (IAM action ds:ResetUserPassword), scoped to one Directory.

Resets the password of any user in the bound Simple AD or Managed Microsoft AD directory — the backbone of a self-service password-reset function. NewPassword is sensitive; pass a Redacted value so it never leaks into logs. The directory id is injected from the binding. Provide the implementation with Effect.provide(AWS.DirectoryService.ResetUserPasswordHttp).

ResetUserPassword: Managing Users

// init — bind the operation to the directory
const resetUserPassword = yield* AWS.DirectoryService.ResetUserPassword(directory);

// runtime
yield* resetUserPassword({
  UserName: "jdoe",
  NewPassword: Redacted.make("N3w-Secret!"),
});