City shared services must host AWS Directory Service once so assessor, permitting, and fleet accounts can join domain resources without each building its own directory. Which multi-account pattern is appropriate?

A shared services account is a standard landing-zone pattern for centralized identity services such as AWS Directory Service. Workload accounts consume the shared directory (for example via networking and appropriate trust or join patterns) rather than operating duplicate directories that drift and raise cost. Public credential stores and local passwd files undermine enterprise identity and audit requirements expected in professional multi-account designs.