AWS Directory Service for Microsoft Active Directory , also known as AWS Managed Microsoft AD, now gives you an additional option to implement the principle of least privilege by reducing the scope of access through the Active Directory (AD) trusts between AWS Managed Microsoft AD and your existing Microsoft AD. As an alternative to forest-wide trust, you can now use external trusts to connect to specific child or tree domains in your existing Microsoft AD forest.