Home icon

Enable self-managed AD Kerberos authentication with Amazon RDS for Db2

Database Blog

This article explains how to enable Kerberos authentication for Amazon RDS for Db2 using a self-managed Active Directory domain for centralized authentication and single sign-on.

  • Delegate nine specific AD permissions to a dedicated service account using PowerShell scripts or UI wizards
  • Create a KMS key and store service account credentials in AWS Secrets Manager with resource policies
  • Configure RDS for Db2 instance with domain FQDN, OU, secret ARN, and DNS IPs
  • Join EC2 client to AD domain, install Db2 Runtime Client, and connect using Kerberos tickets without passwords
  • Use ADSI Edit (not ADUC) to grant servicePrincipalName permissions on User objects
  • Support multiple networking topologies: same VPC, Azure-hosted AD, or cross-VPC/account scenarios
  • Key ports required: DNS (53), Kerberos (88, 464), LDAP (389, 3268), RPC dynamic (49152–65535)

The solution provides end-to-end guidance with PowerShell scripts, CLI commands, and verification tools in the aws-samples GitHub repository for quick deployment.

Go to article

The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.

Related articles

Jul 28
2025
Enable Kerberos Authentication with Amazon RDS for Db2
Jul 1
2026
Amazon RDS for Db2 now supports self-managed Active Directory
Dec 16
2024
Authenticate Amazon RDS for Db2 instances using on-premises Microsoft Active Directory and Kerberos
Aug 19
2025
Amazon RDS for SQL Server now supports Kerberos authentication with self-managed Active Directory

The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.