IAM integration with on premise LDAP

You can manually create IAM users with passwords for access to AWS resources using the AWS Management Console, AWS CLI or API calls. This is a great way to start, but you may already have an identity store (such as Active Directory) that you wish to leverage for AWS resource access. Two methods are possible: Replication and Federation.

With replication, you copy account credentials from your identity store into AWS IAM. This is useful for smaller organizations who need a quick solution without building ongoing connectivity between the two identity stores. While fast to execute, this method has some drawbacks such as: Limited to the number of accounts supported by IAM (5,000 default), changes between identity stores are not automatically propagated, this includes password changes, and disabling or deleting of accounts.

Federation can be done using AWS STS or a third-party such as Okta.   

Remember IAM is not a substitute for an identity store such as Active Directory. 

AWS SSO integration with AWS

This is a question that comes up quite often, "How can I delegate authentication into my on premise MS AD for AWS users?"  This product has just been released.

SSO integration with AWS

http://www.okta.com/aws/

They were also showcased in Andy’s keynote on Tuesday at the SF AWS Summit.

http://www.youtube.com/watch?v=bWL0_Xdntzo#t=50m52s  

The other option is to use AWS STS: http://docs.aws.amazon.com/STS/latest/UsingSTS/Welcome.html

Microsoft Active Directory with AWS

Microsoft Active Directory (or any compliant LDAP Server) can be used for application level authorization and authentication. 
There are three options you can use for this:
1. Run Microsoft Active Directory on AWS/EC2.  This option means that if you are running Active Directory in your on-premise location you will be running a separate MS Active Directory instance.
2. All authentication and authorization is handled by Microsoft AD on premise.  This means all calls to MS AD will have to go over the internet or a AWS DirectConnect connection. Be aware you will take a performance hit here.

3. Set up MS AD on AWS/EC2 and sync it with you on-premise MS AD installation. The syncing can be done using Microsoft’s Active Directory Federation Services (AD FS) technology.  More information can be found here:   http://media.amazonwebservices.com/EC2_ADFS_howto_2.0.pdf.

When using an on-premise MS AD or using MS Active Directory Federation Services, you will need to set up to secure connection using AWS VPC.