add OU structure

aws/projects/adsd-chris/README.md

@@ -28,3 +28,51 @@ to any future MSSQL setups.
 
 ## FSx Windows
 * Integration with boc.ad.census.gov
+
+## Active Directory Integrations
+
+The components of AWS which integrate with Active Directory require some AD constructs to be setup:
+
+1. OU structure to isolate AWS systems from other systems
+   * GPO inheritance restrictions
+   * Specific per-OU permissions by service accounts
+1. Service Account
+   * Requires a service account
+   * userame/password to configure the service
+   * cannot use a gMSA
+   * Automatic rotation may be possible with custom Lambdas
+
+The proposed structure is this:
+
+```
+dc=boc,dc=ad,dc=census,dc=gov/
+└── OU=Cloud Services
+    └── OU=AWS
+        ├── OU=Computers
+        │   └── OU={base-label-format}-{short-region}
+        └── OU=Service Accounts
+            └── cn=svc-{purpose}-{base-label-format}-{short-region}
+```
+
+For the service account username:
+
+*  purpose
+  * rds: for RDS MSSQL
+  * fsx: for FSx Windows
+  * other ones to be discussed and documented before implementing
+* [base-label-format](https://github.e.it.census.gov/terraform/cloud-information/tree/master/aws/documentation/naming-tagging-standard#base-label-format)
+  * org-app-env
+  * example: adsd-chris-dev
+* short-region
+  * uge1: us-gov-east-1
+  * ugw1: us-gov-west-1
+
+The OU object will contain a description showing the AWS Account ID and the AWS Account Alias.
+
+The reason behind the region here is so we can create the specific resources within code in the AWS account in each region,
+though this is up for dicusssion.
+
+
+
+At this  tim
+