-
Notifications
You must be signed in to change notification settings - Fork 7
Expand file tree
/
Copy pathcloud-security-comparison.html
More file actions
1479 lines (1419 loc) · 127 KB
/
Copy pathcloud-security-comparison.html
File metadata and controls
1479 lines (1419 loc) · 127 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="robots" content="index, follow, max-snippet:-1, max-image-preview:large">
<meta name="description"
content="The definitive AWS vs Azure vs GCP cloud security comparison - side-by-side coverage of identity, detection, data protection, network, compliance…">
<meta name="author" content="Shawn Nunley">
<meta name="keywords"
content="AWS vs Azure vs GCP, cloud security comparison, AWS security, Azure security, GCP security, multi-cloud security, IAM comparison, CSPM, CNAPP, Security Hub, Defender for Cloud, Security Command Center, VPC Service Controls, PrivateLink, Private Link, Private Service Connect, FedRAMP, GovCloud, Assured Workloads">
<title>AWS vs Azure vs GCP Security - Side-by-Side - CSOH</title>
<link rel="canonical" href="https://csoh.org/cloud-security-comparison.html">
<link rel="alternate" hreflang="en-US" href="https://csoh.org/cloud-security-comparison.html">
<link rel="alternate" hreflang="x-default" href="https://csoh.org/cloud-security-comparison.html">
<link rel="alternate" type="application/rss+xml" title="CSOH Cloud Security News" href="/feed.xml">
<link rel="icon" type="image/png" href="/favicon.png">
<link rel="manifest" href="/manifest.json">
<link rel="author" type="text/plain" href="/humans.txt">
<meta name="theme-color" content="#0f172a">
<meta name="apple-mobile-web-app-title" content="CSOH">
<meta property="og:title" content="AWS vs Azure vs GCP Security - Side-by-Side - CSOH">
<meta property="og:description"
content="The 80% of cloud security is equivalent across AWS, Azure, and GCP. The 20% delta is what matters - and that's what this page enumerates.">
<meta property="og:site_name" content="Cloud Security Office Hours">
<meta property="og:locale" content="en_US">
<meta property="og:type" content="article">
<meta property="article:published_time" content="2026-05-17">
<meta property="article:modified_time" content="2026-05-17">
<meta property="article:author" content="Shawn Nunley">
<meta property="article:section" content="Cloud Providers">
<meta property="article:tag" content="AWS vs Azure vs GCP">
<meta property="article:tag" content="cloud security comparison">
<meta property="article:tag" content="AWS security">
<meta property="article:tag" content="Azure security">
<meta property="article:tag" content="GCP security">
<meta property="article:tag" content="multi-cloud security">
<meta property="article:tag" content="IAM comparison">
<meta property="article:tag" content="CSPM">
<meta property="og:url" content="https://csoh.org/cloud-security-comparison.html">
<meta property="og:image" content="https://csoh.org/img/og/cloud-security-comparison.jpg">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="AWS vs Azure vs GCP Security - Side-by-Side">
<meta name="twitter:description"
content="Vendor-neutral comparison of AWS, Azure, and GCP security services - what's equivalent, what isn't, and how to choose for each workload.">
<meta name="twitter:image" content="https://csoh.org/img/og/cloud-security-comparison.jpg">
<link rel="preconnect" href="https://csoh.kit.com" crossorigin>
<link rel="preconnect" href="https://github.com" crossorigin>
<link rel="dns-prefetch" href="https://github.com">
<link rel="preload" href="/style.css?v=1e291ebe" as="style"
integrity="sha384-cmJCUejgb9pjIE2R0gLcoQPFMvLAYC2m+mGFzuJZlzLCW6JrL8U6Vo3Pc/nJ02wU">
<link rel="stylesheet" href="/style.css?v=1e291ebe"
integrity="sha384-cmJCUejgb9pjIE2R0gLcoQPFMvLAYC2m+mGFzuJZlzLCW6JrL8U6Vo3Pc/nJ02wU">
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "AWS vs Azure vs GCP Security - Side-by-Side",
"description": "A vendor-neutral, practitioner-level comparison of AWS, Azure, and GCP security services across identity, detection, data protection, network, compliance, pricing, containers, and serverless - with the conceptual differences that bite multi-cloud teams.",
"author": {
"@type": "Person",
"@id": "https://csoh.org/about-shawn-nunley.html#shawn-nunley",
"name": "Shawn Nunley",
"url": "https://csoh.org/about-shawn-nunley.html"
},
"publisher": {
"@type": "Organization",
"name": "Cloud Security Office Hours",
"logo": {
"@type": "ImageObject",
"url": "https://csoh.org/banner.png"
}
},
"datePublished": "2026-05-17",
"dateModified": "2026-05-17",
"mainEntityOfPage": "https://csoh.org/cloud-security-comparison.html",
"speakable": {
"@type": "SpeakableSpecification",
"cssSelector": ["h1", "main p:first-of-type"]
},
"image": "https://csoh.org/banner.png"
}
</script>
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "BreadcrumbList",
"itemListElement": [
{"@type": "ListItem", "position": 1, "name": "Home", "item": "https://csoh.org/"},
{"@type": "ListItem", "position": 2, "name": "AWS vs Azure vs GCP", "item": "https://csoh.org/cloud-security-comparison.html"}
]
}
</script>
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "Which cloud is most secure - AWS, Azure, or GCP?",
"acceptedAnswer": {
"@type": "Answer",
"text": "None of them, and all of them. The baseline security capabilities of AWS, Azure, and GCP are roughly 80% equivalent in 2026 - each ships native IAM with fine-grained policy, a CSPM-shaped posture tool, KMS, audit logging, WAF, DDoS protection, and dozens of compliance attestations. The 20% delta is where the choice matters: GCP wins on VPC Service Controls and Zero Trust heritage, Azure wins on Microsoft-ecosystem integration and Defender for Cloud's multi-cloud reach, AWS wins on the breadth of services and the longest-running operational playbooks. The cloud that's most secure is the one your team operates best."
}
},
{
"@type": "Question",
"name": "Should I avoid one cloud for security reasons?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Almost never. All three clouds clear the bar for almost every commercial workload - including most regulated workloads. The cases where the cloud choice itself is a security decision are narrow: certain sovereign-cloud requirements (where one provider has a regional offering the others don't), specific FedRAMP High or DoD impact levels (AWS GovCloud and Azure Government have the deepest catalog, GCP Assured Workloads is catching up fast), and tight Microsoft-stack shops where Entra ID's reach into endpoints, M365, and identity governance is too valuable to give up. Outside those, your team's expertise and your workload's data-gravity should dominate the decision."
}
},
{
"@type": "Question",
"name": "Is multi-cloud more secure or less secure than single-cloud?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Less, almost always - at the same headcount. Multi-cloud doubles or triples the surface area your team has to operate: two or three IAM models, two or three logging schemas, two or three CSPM rule packs, two or three on-call rotations for cloud-specific incidents. The 'multi-cloud for resilience' argument rarely survives contact with reality; the providers themselves are far more reliable than a multi-cloud failover engineered by humans. Multi-cloud is a fine strategic outcome when it serves real business drivers (acquired companies, regulatory requirements, customer demand for choice), but it should not be picked for its own sake."
}
},
{
"@type": "Question",
"name": "How do I compare a specific AWS service to its Azure or GCP equivalent?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Start with the capability, not the service. 'I need a managed Kubernetes with private-only control plane, signed-image admission, and a network policy enforcement layer' maps to EKS + IAM Roles for Service Accounts on AWS, AKS + Workload Identity on Azure, and GKE + Binary Authorization + Workload Identity on GCP. Each provider has equivalent primitives, but the integration story (which other native services they hook into) differs. Read the architecture-reference docs for each cloud, then map your existing controls against them. A side-by-side feature checklist is rarely as useful as one or two end-to-end scenarios."
}
},
{
"@type": "Question",
"name": "Which cloud has the most mature native CSPM?",
"acceptedAnswer": {
"@type": "Answer",
"text": "It's effectively a tie between Microsoft Defender for Cloud and Google Security Command Center Premium / Enterprise - both have evolved into full CNAPP-shaped platforms that cover posture, workload protection, agentless scanning, and threat detection. AWS Security Hub is a strong aggregator (it surfaces findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools) but is less of a unified CNAPP than the other two. Most multi-cloud organizations standardize on a third-party CNAPP (Wiz, Orca, FortiCNAPP, Sysdig, Prisma) over all three rather than picking a single cloud's native tooling as the system of record."
}
},
{
"@type": "Question",
"name": "Which cloud is best for highly regulated workloads?",
"acceptedAnswer": {
"@type": "Answer",
"text": "For U.S. federal workloads at FedRAMP Moderate or below, all three are credible - AWS GovCloud is the longest-running, Azure Government has the deepest Microsoft-stack story, GCP Assured Workloads is the newest but moves fastest on Zero Trust. For FedRAMP High and DoD IL5+, AWS and Azure currently have more services in scope; GCP is closing the gap. For non-U.S. sovereign-cloud requirements (Germany's BSI C5, France's SecNumCloud, Australia's IRAP), each provider has region- and partner-specific offerings - verify against the specific regulation rather than the marketing page. For healthcare (HIPAA), financial services (PCI DSS, NYDFS), and most international standards (ISO 27001/17/18, SOC 2), all three are well past the bar."
}
},
{
"@type": "Question",
"name": "Does one cloud have better Zero Trust than the others?",
"acceptedAnswer": {
"@type": "Answer",
"text": "GCP, by heritage. The BeyondCorp model that became the public Zero Trust pattern was Google's own internal architecture; Identity-Aware Proxy, BeyondCorp Enterprise, and the deep integration between Cloud IAM and workload identity are the most mature implementation of the principles in a public cloud. Azure is a close second: Entra ID Conditional Access, Continuous Access Evaluation, and the Defender / Microsoft-stack telemetry are formidable, especially if your endpoints are also Microsoft-managed. AWS has the building blocks (Verified Access, Verified Permissions, IAM Identity Center) but the user experience is more do-it-yourself than the other two."
}
}
]
}
</script>
<noscript><style>.js-enabled header nav{display:block !important}</style></noscript>
</head>
<body class="js-enabled">
<a href="#main-content" class="skip-link">Skip to main content</a>
<header>
<div class="header-content">
<div class="logo">
<a href="/" class="logo-link">
<svg class="logo-mark" viewBox="0 0 32 32" width="32" height="32" role="img" aria-label="CSOH logo"><defs><linearGradient id="lm-cloud" x1="0" y1="0" x2="1" y2="1"><stop offset="0%" stop-color="#7dd3fc"/><stop offset="100%" stop-color="#0284c7"/></linearGradient></defs><path d="M7 19 a4 4 0 0 1 4-4 a6 6 0 0 1 11 0 a3.5 3.5 0 0 1 3.5 3.5 a3.5 3.5 0 0 1 -3.5 3.5 H8 a3.5 3.5 0 0 1 -1-7 z" fill="url(#lm-cloud)"/><path d="M11 13 L21 13 L21 18 a5 5.5 0 0 1 -5 5 a5 5.5 0 0 1 -5 -5 z" fill="#f59e0b"/><path d="M13.5 16.7 L15.3 18.4 L18.6 15" stroke="#fff" stroke-width="1.5" fill="none" stroke-linecap="round" stroke-linejoin="round"/></svg>
<div class="logo-title">CSOH</div>
</a>
<p>Cloud Security Office Hours</p>
</div>
<button class="hamburger" aria-label="Toggle navigation" aria-expanded="false">☰</button>
<button class="theme-toggle" aria-label="Switch to dark mode">🌙</button>
<nav>
<ul>
<li class="has-dropdown has-mega">
<button class="dropdown-toggle active" aria-expanded="true" aria-haspopup="true">Learn <span class="caret" aria-hidden="true">▾</span></button>
<div class="dropdown-menu mega-menu mega-6col">
<div class="mega-col">
<span class="mega-heading">Foundations</span>
<ul>
<li><a href="what-is-cloud-security.html">What is Cloud Security?</a></li>
<li><a href="shared-responsibility-model.html">Shared Responsibility</a></li>
<li><a href="cspm-vs-cnapp.html">CSPM vs CNAPP</a></li>
<li><a href="cloud-security-best-practices.html">Best Practices</a></li>
<li><a href="vendor-landscape.html">Vendor Landscape</a></li>
<li><a href="glossary.html">Glossary</a></li>
<li><a href="faq.html">FAQ</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">By Cloud</span>
<ul>
<li><a href="aws-security.html">AWS Security</a></li>
<li><a href="azure-security.html">Azure Security</a></li>
<li><a href="gcp-security.html">GCP Security</a></li>
<li><a href="cloud-security-comparison.html" aria-current="page">AWS vs Azure vs GCP</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Workloads & Platform</span>
<ul>
<li><a href="containers.html">Containers</a></li>
<li><a href="kubernetes.html">Kubernetes</a></li>
<li><a href="serverless.html">Serverless</a></li>
<li><a href="service-mesh-security.html">Service Mesh</a></li>
<li><a href="ci-cd.html">CI/CD</a></li>
<li><a href="landing-zones.html">Landing Zones</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Security Domains</span>
<ul>
<li><a href="iam.html">IAM & Identity</a></li>
<li><a href="non-human-identity.html">Non-Human Identity</a></li>
<li><a href="zero-trust.html">Zero Trust</a></li>
<li><a href="network-security.html">Network Security</a></li>
<li><a href="data-security.html">Data Security & KMS</a></li>
<li><a href="vulnerability-management.html">Vulnerability Management</a></li>
<li><a href="api-security.html">API Security</a></li>
<li><a href="saas-security.html">SaaS Security (SSPM)</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Governance & AI</span>
<ul>
<li><a href="backup-dr.html">Backup, DR & Ransomware</a></li>
<li><a href="threat-modeling.html">Threat Modeling</a></li>
<li><a href="grc.html">GRC</a></li>
<li><a href="compliance-frameworks.html">Compliance Frameworks</a></li>
<li><a href="ai-learning.html">AI Learning</a></li>
<li><a href="ai-ml-security.html">AI/ML Security</a></li>
<li><a href="mcp-security.html">MCP Security</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Build It</span>
<ul>
<li class="mega-featured"><a href="cloud-deployment.html">Multi-Cloud Secure Deploy<span class="mega-tag">AWS · GCP · Azure, end to end</span></a></li>
<li><a href="github-actions.html">GitHub Actions</a></li>
<li><a href="terraform.html">Terraform</a></li>
<li><a href="version-control.html">Git & Version Control</a></li>
</ul>
</div>
</div>
</li>
<li><a href="resources.html">Resources</a></li>
<li class="has-dropdown">
<button class="dropdown-toggle" aria-expanded="false" aria-haspopup="true">Threat Intel <span class="caret" aria-hidden="true">▾</span></button>
<ul class="dropdown-menu">
<li><a href="news.html">News</a></li>
<li><a href="threat-research.html">Threat Research</a></li>
<li><a href="breach-timeline.html">Breach Kill Chains</a></li>
<li><a href="cloud-soc.html">Cloud SOC</a></li>
<li><a href="detection-engineering.html">Detection Engineering</a></li>
<li><a href="incident-response.html">Incident Response</a></li>
<li><a href="cloud-pentesting.html">Cloud Pentesting</a></li>
<li><a href="ctfs.html">CTFs</a></li>
</ul>
</li>
<li class="has-dropdown has-mega">
<button class="dropdown-toggle" aria-expanded="false" aria-haspopup="true">Careers <span class="caret" aria-hidden="true">▾</span></button>
<div class="dropdown-menu mega-menu mega-3col">
<div class="mega-col">
<span class="mega-heading">Getting Started</span>
<ul>
<li><a href="cloud-security-careers.html">Careers Overview</a></li>
<li><a href="breaking-into-cloud-security.html">Breaking In</a></li>
<li><a href="learning-path.html">Learning Path</a></li>
<li><a href="cloud-security-certifications.html">Certifications</a></li>
<li><a href="cloud-security-degree-programs.html">Degree Programs</a></li>
<li><a href="cloud-security-home-lab.html">Home Lab</a></li>
<li><a href="cloud-security-portfolio-projects.html">Portfolio Projects</a></li>
<li><a href="cloud-security-reading-list.html">Reading List</a></li>
<li><a href="cloud-security-interview-questions.html">Interview Questions</a></li>
<li><a href="cloud-security-resume-guide.html">Resume Guide</a></li>
<li><a href="mentorship.html">Mentorship</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Engineering Roles</span>
<ul>
<li><a href="cloud-security-engineer.html">Cloud Security Engineer</a></li>
<li><a href="cloud-security-architect.html">Security Architect</a></li>
<li><a href="cloud-security-platform-engineer.html">Platform / Security SRE</a></li>
<li><a href="cloud-security-appsec-engineer.html">AppSec / IaC Engineer</a></li>
<li><a href="cloud-security-cnapp-analyst.html">CSPM / CNAPP Analyst</a></li>
<li><a href="cloud-security-iam-architect.html">IAM / Identity Architect</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Specialist & Field Roles</span>
<ul>
<li><a href="cloud-security-detection-engineer.html">Detection Engineer</a></li>
<li><a href="cloud-security-incident-responder.html">Incident Responder (DFIR)</a></li>
<li><a href="cloud-security-penetration-tester.html">Penetration Tester / Red Team</a></li>
<li><a href="cloud-security-grc-engineer.html">GRC / Compliance Engineer</a></li>
<li><a href="cloud-security-sales-engineer.html">Sales Engineer</a></li>
<li><a href="cloud-security-customer-success-engineer.html">Customer Success Engineer</a></li>
</ul>
</div>
</div>
</li>
<li class="has-dropdown has-mega">
<button class="dropdown-toggle" aria-expanded="false" aria-haspopup="true">Community <span class="caret" aria-hidden="true">▾</span></button>
<div class="dropdown-menu mega-menu mega-3col">
<div class="mega-col">
<span class="mega-heading">Live</span>
<ul>
<li><a href="sessions.html">Friday Zoom Sessions</a></li>
<li><a href="community.html">Community & Signal</a></li>
<li><a href="mentorship.html">Mentorship</a></li>
<li><a href="conferences.html">Conferences</a></li>
<li><a href="present.html">Present at CSOH</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Archive</span>
<ul>
<li><a href="meetings.html">Meeting Recaps</a></li>
<li><a href="presentations.html">Presentations</a></li>
<li><a href="speakers.html">Guest Speakers</a></li>
<li><a href="chat-resources.html">Chat Resources</a></li>
</ul>
</div>
<div class="mega-col">
<span class="mega-heading">Connect</span>
<ul>
<li><a href="mailto:admin@csoh.org">Contact</a></li>
<li><a href="https://csoh.kit.com/39feb4f397" target="_blank" rel="noopener noreferrer">Mailing List</a></li>
<li><a href="https://github.com/CloudSecurityOfficeHours/csoh.org" target="_blank" rel="noopener noreferrer">GitHub</a></li>
<li><a href="rss.html">RSS Feed</a></li>
<li><a href="contribute.html">Contribute</a></li>
<li><a href="contribute-resources.html">Add a Resource</a></li>
</ul>
</div>
</div>
</li>
<li class="nav-coffee-item"><a href="https://buymeacoffee.com/csoh" class="nav-coffee" target="_blank" rel="noopener noreferrer" title="Support CSOH on Buy Me a Coffee" aria-label="Support CSOH on Buy Me a Coffee"><span class="nav-coffee-icon" aria-hidden="true">☕</span> <span class="nav-coffee-label">Support</span></a></li>
<li class="nav-cta-item"><a href="https://csoh.kit.com/39feb4f397" class="nav-cta" target="_blank" rel="noopener noreferrer">Join Friday Zoom →</a></li>
</ul>
</nav>
</div>
</header>
<nav class="breadcrumb-nav" aria-label="Breadcrumb">
<ol>
<li><a href="index.html">Home</a></li>
<li><span aria-current="page">AWS vs Azure vs GCP</span></li>
</ol>
</nav>
<section class="hero hero--illustrated">
<div class="hero-inner">
<div class="hero-text">
<h1>AWS vs Azure vs GCP Security - Side-by-Side</h1>
<p>The definitive, practitioner-level comparison of the three major clouds' security services. Identity, detection, data protection, network, compliance, pricing, containers, <a class="glossary-link" href="glossary.html#term-serverless">serverless</a> - and the conceptual differences that quietly cost <a class="glossary-link" href="glossary.html#term-public">multi-cloud</a> teams the most. Vendor-neutral, dense by design, and aimed at the engineer or architect who has to make the call.</p>
<div class="cta-buttons">
<a href="#tables" class="btn btn-primary">Jump to the tables →</a>
<a href="#concepts" class="btn btn-secondary">Conceptual differences</a>
</div>
</div>
<div class="hero-illustration" aria-hidden="true">
<svg viewBox="0 0 600 480" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Illustration of three clouds - AWS in orange, Azure in blue, GCP in multi-color - balanced on a scale" width="600" height="480">
<defs>
<linearGradient id="ccmp-sky" x1="0%" y1="0%" x2="0%" y2="100%"><stop offset="0%" stop-color="#dbeafe"/><stop offset="100%" stop-color="#bae6fd"/></linearGradient>
<linearGradient id="ccmp-aws" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="#fde68a"/><stop offset="100%" stop-color="#f59e0b"/></linearGradient>
<linearGradient id="ccmp-azure" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="#7dd3fc"/><stop offset="100%" stop-color="#0284c7"/></linearGradient>
<linearGradient id="ccmp-gcp-1" x1="0%" y1="0%" x2="100%" y2="100%"><stop offset="0%" stop-color="#34d399"/><stop offset="50%" stop-color="#facc15"/><stop offset="100%" stop-color="#ef4444"/></linearGradient>
<radialGradient id="ccmp-halo" cx="50%" cy="50%" r="50%"><stop offset="0%" stop-color="#7dd3fc" stop-opacity="0.35"/><stop offset="100%" stop-color="#7dd3fc" stop-opacity="0"/></radialGradient>
</defs>
<rect x="0" y="0" width="600" height="480" fill="url(#ccmp-sky)" opacity="0.4"/>
<circle cx="300" cy="240" r="220" fill="url(#ccmp-halo)"/>
<!-- Scale base -->
<rect x="280" y="380" width="40" height="60" fill="#1f2937"/>
<rect x="240" y="430" width="120" height="14" rx="2" fill="#1f2937"/>
<!-- Scale beam -->
<rect x="80" y="200" width="440" height="6" rx="2" fill="#1f2937"/>
<!-- Pivot -->
<circle cx="300" cy="203" r="10" fill="#fbbf24" stroke="#1f2937" stroke-width="2"/>
<!-- Hangers -->
<line x1="120" y1="206" x2="120" y2="260" stroke="#1f2937" stroke-width="2"/>
<line x1="300" y1="206" x2="300" y2="260" stroke="#1f2937" stroke-width="2"/>
<line x1="480" y1="206" x2="480" y2="260" stroke="#1f2937" stroke-width="2"/>
<!-- AWS pan (left) -->
<ellipse cx="120" cy="270" rx="70" ry="12" fill="#374151"/>
<path d="M75 200 a18 18 0 0 1 22 -14 a26 26 0 0 1 48 0 a18 18 0 0 1 18 14 a16 16 0 0 1 -9 30 H84 a16 16 0 0 1 -9 -30 z" transform="translate(0,-40)" fill="url(#ccmp-aws)" stroke="#fff" stroke-width="1.5" stroke-opacity="0.6"/>
<text x="120" y="200" text-anchor="middle" fill="#7c2d12" font-size="13" font-weight="800">AWS</text>
<text x="120" y="295" text-anchor="middle" fill="#1f2937" font-size="11" font-weight="600">100+ services</text>
<!-- Azure pan (middle) -->
<ellipse cx="300" cy="270" rx="70" ry="12" fill="#374151"/>
<path d="M255 200 a18 18 0 0 1 22 -14 a26 26 0 0 1 48 0 a18 18 0 0 1 18 14 a16 16 0 0 1 -9 30 H264 a16 16 0 0 1 -9 -30 z" transform="translate(0,-40)" fill="url(#ccmp-azure)" stroke="#fff" stroke-width="1.5" stroke-opacity="0.6"/>
<text x="300" y="200" text-anchor="middle" fill="#0c4a6e" font-size="13" font-weight="800">Azure</text>
<text x="300" y="295" text-anchor="middle" fill="#1f2937" font-size="11" font-weight="600">Entra + Defender</text>
<!-- GCP pan (right) -->
<ellipse cx="480" cy="270" rx="70" ry="12" fill="#374151"/>
<path d="M435 200 a18 18 0 0 1 22 -14 a26 26 0 0 1 48 0 a18 18 0 0 1 18 14 a16 16 0 0 1 -9 30 H444 a16 16 0 0 1 -9 -30 z" transform="translate(0,-40)" fill="url(#ccmp-gcp-1)" stroke="#fff" stroke-width="1.5" stroke-opacity="0.6"/>
<text x="480" y="200" text-anchor="middle" fill="#1f2937" font-size="13" font-weight="800">GCP</text>
<text x="480" y="295" text-anchor="middle" fill="#1f2937" font-size="11" font-weight="600"><a class="glossary-link" href="glossary.html#term-beyondcorp">BeyondCorp</a> + <a class="glossary-link" href="glossary.html#term-guardduty">SCC</a></text>
<!-- Comparison labels at top -->
<text x="300" y="50" text-anchor="middle" fill="#0c4a6e" font-size="14" font-weight="700">Side-by-side</text>
<text x="300" y="70" text-anchor="middle" fill="#0c4a6e" font-size="11">identity · detection · data · network · compliance</text>
<!-- Checkmark dots between -->
<g>
<circle cx="210" cy="350" r="7" fill="#10b981"/>
<path d="M206 350 l3 3 l5 -5" stroke="#fff" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/>
<circle cx="390" cy="350" r="7" fill="#10b981"/>
<path d="M386 350 l3 3 l5 -5" stroke="#fff" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/>
</g>
</svg>
</div>
</div>
</section>
<main class="container contribute-article" id="main-content">
<figure class="page-photo">
<picture>
<source srcset="/img/photos/dashboard-graphs.webp" type="image/webp">
<img src="/img/photos/dashboard-graphs.jpg" alt="Multiple monitors showing dashboards with graphs and charts side by side" width="1880" height="1253" loading="lazy" decoding="async">
</picture>
<figcaption>Photo by Pixabay on Pexels</figcaption>
</figure>
<p class="page-meta"><time datetime="2026-05-17">Last updated <strong>2026-05-17</strong></time> · <a href="about-shawn-nunley.html" rel="author">By Shawn Nunley</a> · Vendor-neutral · <a href="https://github.com/CloudSecurityOfficeHours/csoh.org/blob/main/cloud-security-comparison.html" target="_blank" rel="noopener noreferrer">View source on GitHub</a></p>
<div class="info-box--blue">
<p><strong>The 30-second version:</strong> The native security capabilities of AWS, Azure, and GCP are roughly <strong>80% equivalent</strong> in 2026 - each provider ships identity, posture management, key management, audit logging, <a class="glossary-link" href="glossary.html#term-waf">WAF</a>, <a class="glossary-link" href="glossary.html#term-ddos">DDoS</a> protection, and dozens of compliance attestations. The <strong>20% delta</strong> is where the choice matters: <strong>GCP</strong> leads on <a class="glossary-link" href="glossary.html#term-vpc-sc">VPC Service Controls</a> and the BeyondCorp / <a class="glossary-link" href="glossary.html#term-zero-trust">Zero Trust</a> story; <strong>Azure</strong> leads on <a class="glossary-link" href="glossary.html#term-entra-id">Entra ID</a>, Defender for Cloud multi-cloud reach, and Microsoft-stack integration; <strong>AWS</strong> leads on service breadth, regional depth, and the longest-running operational playbooks.</p>
<p style="margin-top:0.75rem;">This page enumerates the delta. Choose the cloud, don't fight it - and where you must run all three, run a third-party <a class="glossary-link" href="glossary.html#term-cnapp">CNAPP</a> over the top to normalize the view. The tables below are designed to be skimmable; the narrative sections cover the conceptual differences that don't fit in a grid.</p>
</div>
<div class="toc">
<h2>On this page</h2>
<ol>
<li><a href="#intro">Choose the cloud, don't fight it</a></li>
<li><a href="#verdict">Quick verdict by category</a></li>
<li><a href="#tables">Comparison tables by category</a>
<ul>
<li><a href="#t-iam">Identity & access</a></li>
<li><a href="#t-detect">Detection & response</a></li>
<li><a href="#t-data">Data protection</a></li>
<li><a href="#t-network">Network security</a></li>
<li><a href="#t-compliance">Compliance</a></li>
<li><a href="#t-pricing">Pricing models</a></li>
<li><a href="#t-cust-iam">Customer identity</a></li>
<li><a href="#t-compute">Compute platform security</a></li>
<li><a href="#t-container">Container security</a></li>
<li><a href="#t-serverless">Serverless security</a></li>
</ul>
</li>
<li><a href="#concepts">Conceptual differences that bite you</a></li>
<li><a href="#pick">Which cloud should you pick for…</a></li>
<li><a href="#normalizer">The third-party normalizer</a></li>
<li><a href="#scorecard">Comparison summary scorecard</a></li>
<li><a href="#faq">FAQ</a></li>
<li><a href="#further">Where next</a></li>
</ol>
</div>
<section id="intro">
<h2>Choose the cloud, don't fight it</h2>
<p>The most expensive mistake in cloud security is treating the cloud you're on as if it were one of the others. Teams that came up on AWS look at Azure <a class="glossary-link" href="glossary.html#term-rbac">RBAC</a> and try to write JSON allow/deny policies against it; teams from Azure land in GCP and look for management groups that aren't there; GCP-native teams move to AWS and miss VPC Service Controls so badly they re-implement it in flawed software. Each cloud has a coherent security model. The model is internally consistent. The cost of fighting it is paid in unintended permissions, misconfigurations the <a class="glossary-link" href="glossary.html#term-cspm">CSPM</a> doesn't flag, and architectures the auditor doesn't recognize.</p>
<p>This page is built on the premise that you've already picked your cloud (or had it picked for you), and you want to know - concretely - what the security delta is to the others. Or you're picking between them and want a practitioner's read rather than the marketing matrix. Or you're running on more than one and want to understand the gaps between the native tools well enough to fill them with a CNAPP or a thin internal abstraction.</p>
<p>The framing for everything below: <strong>capability parity is high</strong>; <strong>operational ergonomics differ</strong>; <strong>the integration story differs more</strong>; and <strong>the pricing model differs the most</strong>. A capability that's free on one cloud and metered on another can quietly drive a six-figure spend variance with no functional difference. The pricing section gets disproportionate attention here for that reason.</p>
</section>
<section id="verdict">
<h2>Quick verdict by category</h2>
<p>Skim this once, then jump to the relevant table. Every line is opinionated and contestable; the tables below show the reasoning.</p>
<ul>
<li><strong>Identity & access:</strong> <em>AWS leads on policy expressiveness</em> (<a class="glossary-link" href="glossary.html#term-iam">IAM</a> JSON conditions are the richest); <em>Azure leads on identity governance</em> (Entra ID <a class="glossary-link" href="glossary.html#term-pim">PIM</a> + Access Reviews + <a class="glossary-link" href="glossary.html#term-conditional-access">Conditional Access</a> is the deepest IGA story); <em>GCP leads on <a class="glossary-link" href="glossary.html#term-service-account">workload identity</a></em> (the federated workload-identity model is the cleanest of the three).</li>
<li><strong>Detection & response:</strong> <em>Tie between Azure and GCP</em> on integrated CNAPP (Defender for Cloud and Security Command Center Premium are both mature and unified); <em>AWS leads on aggregation breadth</em> (Security Hub pulls from a dozen specialist services and a long list of third parties).</li>
<li><strong>Data protection:</strong> <em>Tie</em> on <a class="glossary-link" href="glossary.html#term-kms">KMS</a> / <a class="glossary-link" href="glossary.html#term-hsm">HSM</a> / <a class="glossary-link" href="glossary.html#term-byok">BYOK</a> / confidential compute; <em>GCP leads on <a class="glossary-link" href="glossary.html#term-dlp">DLP</a></em> (Sensitive Data Protection's coverage and accuracy is the strongest); <em>Azure leads on data classification</em> (Purview Information Protection's reach into M365 is unmatched).</li>
<li><strong>Network security:</strong> <em>GCP leads</em> - VPC Service Controls is unique, the global <a class="glossary-link" href="glossary.html#term-vpc">VPC</a> model is the cleanest, and the network telemetry depth (<a class="glossary-link" href="glossary.html#term-vpc-flow-logs">VPC Flow Logs</a> + Packet Mirroring + Firewall Insights) is mature. AWS and Azure both shipped equivalents to most of GCP's network primitives but they don't compose as elegantly.</li>
<li><strong>Compliance:</strong> <em>AWS leads on breadth</em> (the longest attestation list, the most regional accreditations); <em>Azure leads on Microsoft-stack regulated workloads</em>; <em>GCP leads on Zero-Trust-shaped frameworks</em> (Assured Workloads with deep Zero Trust enforcement). For most commercial workloads, all three clear the bar.</li>
<li><strong>Pricing:</strong> <em>It's complicated.</em> AWS is generally cheapest for log retention if you stay on <a class="glossary-link" href="glossary.html#term-cloudtrail">CloudTrail</a> + <a class="glossary-link" href="glossary.html#term-s3">S3</a> Glacier; Azure is most expensive on Log Analytics ingest; GCP is in the middle on logs but cheapest on KMS per-request operations. <a class="glossary-link" href="glossary.html#term-ingress">Egress</a> is roughly equivalent across the three and remains the largest single line item for most workloads.</li>
<li><strong>Customer identity (B2C / external):</strong> <em>Azure leads</em> - Entra External ID has the most mature B2C / CIAM offering. Cognito has the longest pedigree; GCP Identity Platform is the newest and most JavaScript-ergonomic.</li>
<li><strong>Compute <a class="glossary-link" href="glossary.html#term-hardening">hardening</a> defaults:</strong> <em>AWS leads since <a class="glossary-link" href="glossary.html#term-imds">IMDSv2</a> became default-on</em>; Azure and GCP each have credible metadata-service defenses but the AWS model is the most thoroughly battle-tested.</li>
<li><strong><a class="glossary-link" href="glossary.html#term-container-security">Container security</a>:</strong> <em>GCP leads</em> on <a class="glossary-link" href="glossary.html#term-eks">GKE</a> (Autopilot, Binary Authorization, Workload Identity); <em>Azure leads</em> on registry scanning depth (Defender for Containers reach into ACR); <em>AWS leads</em> on ecosystem (EKS has the longest list of third-party integrations).</li>
<li><strong>Serverless:</strong> <em>AWS leads on maturity</em> (<a class="glossary-link" href="glossary.html#term-lambda">Lambda</a> has the deepest security feature set - signed code, VPC integration without the cold-start penalty since Hyperplane, IAM-based event filtering); <em>GCP Cloud Run leads on ergonomics</em>; <em>Azure Functions leads on Microsoft-stack integration</em>.</li>
</ul>
</section>
<section id="tables">
<h2>Comparison tables by category</h2>
<p>Each table compares the named capability across AWS, Azure, and GCP. Where a cell links to provider docs, those are first-party authoritative references. Where a cell links to another CSOH page, that page goes deeper than this comparison allows.</p>
<h3 id="t-iam">Identity & access</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Capability</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">Primary identity service</th>
<td>IAM (users, roles, groups, policies) + IAM Identity Center for <a class="glossary-link" href="glossary.html#term-sso">SSO</a></td>
<td>Entra ID (formerly Azure AD) - users, groups, applications, devices</td>
<td>Cloud IAM + Cloud Identity (separate <a class="glossary-link" href="glossary.html#term-idp">IdP</a> and resource-IAM layers)</td>
</tr>
<tr>
<th scope="row">Policy language</th>
<td>JSON Allow / Deny statements with <code>Action</code>, <code>Resource</code>, <code>Condition</code> - the richest condition language of the three</td>
<td>RBAC role assignments (built-in or custom roles) scoped to management group / subscription / RG / resource</td>
<td>Member → role → resource bindings with inheritance down the org hierarchy; IAM Conditions add expression-based constraints</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-federation">Federation</a> / SSO</th>
<td>IAM Identity Center; <a class="glossary-link" href="glossary.html#term-saml-2-0">SAML 2.0</a> + <a class="glossary-link" href="glossary.html#term-oidc">OIDC</a>; AWS-managed or external IdP</td>
<td>Entra ID is the IdP; federation to other tenants and external IdPs via OIDC / SAML</td>
<td>Cloud Identity or Workspace as IdP; SAML / <a class="glossary-link" href="glossary.html#term-oidc-federation">OIDC federation</a>; Workforce Identity Federation</td>
</tr>
<tr>
<th scope="row">Just-in-time elevation / PIM</th>
<td>IAM Identity Center temporary credentials + session policies; AWS Identity Center "permission sets" elevation; no built-in time-bound role-activation workflow comparable to PIM</td>
<td>Entra ID Privileged Identity Management (PIM) - time-bound, approval-gated role activation; the deepest of the three</td>
<td>IAM Conditions + <a class="glossary-link" href="glossary.html#term-jit">Just-in-Time Access</a> (via Privileged Access Manager, currently in preview/GA staged) and Access Approval for provider personnel</td>
</tr>
<tr>
<th scope="row">Workload identity</th>
<td>IAM roles for <a class="glossary-link" href="glossary.html#term-ec2">EC2</a> / <a class="glossary-link" href="glossary.html#term-ecs">ECS</a> / Lambda; <a class="glossary-link" href="glossary.html#term-irsa">IAM Roles for Service Accounts</a> (IRSA) on EKS; <a class="glossary-link" href="glossary.html#term-pod">pod</a> identity for EKS</td>
<td>Managed identities (system-assigned, user-assigned); <a class="glossary-link" href="glossary.html#term-wif">Workload Identity Federation</a> for external workloads</td>
<td>Service accounts as first-class principals; Workload Identity (GKE) and Workload Identity Federation (external) - the cleanest model of the three</td>
</tr>
<tr>
<th scope="row">Permission analysis / <a class="glossary-link" href="glossary.html#term-least-privilege">least privilege</a></th>
<td><a class="glossary-link" href="glossary.html#term-iam-access-analyzer">IAM Access Analyzer</a> (external access, unused access, policy generation); CloudTrail-based action-last-used</td>
<td>Entra ID + Microsoft Defender for Cloud Permissions Management (formerly CloudKnox) - multi-cloud <a class="glossary-link" href="glossary.html#term-ciem">CIEM</a></td>
<td>IAM Recommender; Policy Analyzer; Policy Intelligence; Asset Inventory queries</td>
</tr>
<tr>
<th scope="row">Identity governance (IGA)</th>
<td>Limited native IGA; rely on third-party (SailPoint, Saviynt) or IAM Identity Center + access reviews via custom tooling</td>
<td>Entra ID Governance - access reviews, entitlement management, lifecycle workflows - the most complete native IGA in any cloud</td>
<td>Access Reviews and group-based access patterns; less feature-complete than Entra; third-party for full IGA</td>
</tr>
<tr>
<th scope="row">Trust between accounts / projects</th>
<td>Cross-account trust via role assumption (<code>sts:AssumeRole</code> with explicit trust policies)</td>
<td>Implicit trust within a <a class="glossary-link" href="glossary.html#term-tenant">tenant</a>; cross-tenant via guest invitations or B2B collaboration</td>
<td>IAM bindings can cross projects; the org hierarchy makes most cross-project access a single grant, not a trust dance</td>
</tr>
<tr>
<th scope="row">Service-control / preventive policy</th>
<td>Service Control Policies (SCPs) at AWS Organizations level; Resource Control Policies (RCPs)</td>
<td>Azure Policy at management group level (<code>deny</code> effect); Azure Blueprints (deprecated, migrating to Deployment Stacks)</td>
<td>Organization Policy constraints - the most consistent enforcement model, since constraints inherit cleanly down the hierarchy</td>
</tr>
</tbody>
</table>
</div>
<p>See <a href="iam.html">IAM & Identity</a> for the conceptual deep-dive that sits under this table.</p>
<h3 id="t-detect">Detection & response</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Capability</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">Native CSPM</th>
<td>Security Hub (aggregator) + AWS Config Rules + Inspector + IAM Access Analyzer + Macie</td>
<td>Microsoft Defender for Cloud - full CSPM, integrated, multi-cloud</td>
<td>Security Command Center Standard / Premium / Enterprise - full CSPM and CNAPP at Premium+</td>
</tr>
<tr>
<th scope="row">Native <a class="glossary-link" href="glossary.html#term-cwpp">CWPP</a> / workload protection</th>
<td>GuardDuty (network + DNS + runtime), GuardDuty Malware Protection, Inspector (vulns)</td>
<td>Defender for Servers / Containers / Storage / SQL - each workload type its own SKU</td>
<td>SCC Premium / Enterprise - Container Threat Detection, Virtual Machine Threat Detection, Event Threat Detection</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-siem">SIEM</a></th>
<td>Amazon Security Lake (OCSF schema, queryable from Athena / partner SIEMs); no native SIEM <a class="glossary-link" href="glossary.html#term-saas">SaaS</a></td>
<td><a class="glossary-link" href="glossary.html#term-sentinel">Microsoft Sentinel</a> - full SaaS SIEM / <a class="glossary-link" href="glossary.html#term-soar">SOAR</a> with <a class="glossary-link" href="glossary.html#term-detection-query-languages">KQL</a>, deep Microsoft-stack integration</td>
<td>Google Security Operations (formerly Chronicle) - full SaaS SIEM with petabyte ingest and YARA-L rules</td>
</tr>
<tr>
<th scope="row">Threat detection signals</th>
<td>GuardDuty findings (VPC Flow, DNS, CloudTrail, EKS audit, RDS login, runtime, malware)</td>
<td>Defender <a class="glossary-link" href="glossary.html#term-edr">XDR</a> (endpoint + identity + cloud + email) - the broadest signal aggregation across an org's whole estate</td>
<td>Event Threat Detection (Cloud Audit Logs), Container Threat Detection (<a class="glossary-link" href="glossary.html#term-ebpf">eBPF</a>), VM Threat Detection (<a class="glossary-link" href="glossary.html#term-hypervisor">hypervisor</a> signal)</td>
</tr>
<tr>
<th scope="row">Audit logging defaults</th>
<td>CloudTrail management events on by default in every account; data events opt-in (and the most expensive log class)</td>
<td>Activity Log (subscription scope) on by default; Microsoft Entra audit logs separate; Diagnostic Settings opt-in per resource</td>
<td>Cloud Audit Logs - Admin Activity always on, free; Data Access opt-in, paid; System Event always on, free</td>
</tr>
<tr>
<th scope="row">Default log retention (free tier)</th>
<td>CloudTrail management events free for 90 days in the console; permanent retention requires S3 (cheap) or CloudWatch Logs (paid by GB)</td>
<td>Activity Log retained 90 days free; export to Log Analytics is paid by GB ingested + retained</td>
<td>Admin Activity free for 400 days; Data Access opt-in + paid; sinks to BigQuery / GCS make long-term retention cheap</td>
</tr>
<tr>
<th scope="row">Log retention pricing model</th>
<td>S3 + Glacier tiers - cheapest cold-storage tier; per-GB ingest into CloudWatch Logs adds up fast</td>
<td>Log Analytics priced per-GB ingest with retention tiers; can be the most expensive on the three at scale</td>
<td>Sinks to BigQuery / Storage are cheap; Cloud Logging itself paid by ingested volume</td>
</tr>
<tr>
<th scope="row">Cross-cloud detection support</th>
<td>Security Hub partner integrations; Security Lake OCSF makes cross-cloud query feasible</td>
<td>Defender for Cloud connects natively to AWS and GCP - the strongest first-party multi-cloud story</td>
<td>SCC Enterprise + Mandiant integration; native AWS / Azure connector support growing</td>
</tr>
</tbody>
</table>
</div>
<p>See <a href="cloud-soc.html">Cloud SOC</a> and <a href="detection-engineering.html">Detection Engineering</a> for the operator's view of these tools.</p>
<h3 id="t-data">Data protection</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Capability</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">KMS (customer-managed keys)</th>
<td>AWS KMS - symmetric, asymmetric, HMAC; AWS-managed and customer-managed keys; per-region</td>
<td><a class="glossary-link" href="glossary.html#term-key-vault">Key Vault</a> (vault tier) - keys, secrets, certificates; Premium tier adds HSM-backed</td>
<td><a class="glossary-link" href="glossary.html#term-cloud-kms">Cloud KMS</a> - symmetric, asymmetric, MAC; HSM and software protection levels; per-location</td>
</tr>
<tr>
<th scope="row">HSM</th>
<td>CloudHSM (dedicated <a class="glossary-link" href="glossary.html#term-fips-140">FIPS 140-2</a> Level 3 cluster) - separate from KMS</td>
<td>Key Vault Managed HSM (FIPS 140-3 Level 3) - integrated with the KMS abstraction</td>
<td>Cloud HSM (FIPS 140-2 Level 3) - integrated into Cloud KMS as a protection level</td>
</tr>
<tr>
<th scope="row">External / hold-your-own-key</th>
<td>AWS KMS External Key Store (XKS) - keys live outside AWS, KMS calls out</td>
<td>Azure Key Vault Managed HSM with BYOK; Customer Lockbox for personnel access</td>
<td>External Key Manager (EKM) - the most mature of the three; EKM with VPC Service Controls is the gold-standard sovereign pattern</td>
</tr>
<tr>
<th scope="row">Secrets management</th>
<td>AWS <a class="glossary-link" href="glossary.html#term-secrets-manager">Secrets Manager</a> (rotating secrets, IAM-controlled) + SSM Parameter Store</td>
<td>Key Vault (secrets tier) - the same object model as keys/certs</td>
<td>Secret Manager - versioned, IAM-controlled secrets; cleanest API of the three</td>
</tr>
<tr>
<th scope="row">BYOK</th>
<td>KMS supports importing key material (CMK with imported keys)</td>
<td>Key Vault supports BYOK via HSM-to-HSM transfer</td>
<td>Cloud KMS supports import via key-wrapping protocol</td>
</tr>
<tr>
<th scope="row">Confidential compute</th>
<td>AWS Nitro Enclaves (isolated VMs); Graviton with <a class="glossary-link" href="glossary.html#term-confidential-computing">confidential computing</a>; SEV-SNP and TDX instances</td>
<td>Azure Confidential VMs (AMD SEV-SNP + Intel TDX); Confidential Containers on AKS</td>
<td>Confidential VMs (SEV, SEV-SNP, TDX); Confidential GKE Nodes; Confidential Space (workload attestation)</td>
</tr>
<tr>
<th scope="row">DLP / data classification</th>
<td>Macie (S3-focused, classifier-based)</td>
<td>Purview Information Protection (broad - M365, files, databases) + Defender for Storage</td>
<td>Sensitive Data Protection (formerly Cloud DLP) - the most accurate detector library; covers BigQuery, GCS, Datastore, and arbitrary text</td>
</tr>
<tr>
<th scope="row">Encryption-in-use / <a class="glossary-link" href="glossary.html#term-tokenization">tokenization</a></th>
<td>Field-level via Lambda + KMS pattern; Macie classifies but doesn't tokenize</td>
<td>Always Encrypted (SQL); Purview can apply labels with encryption</td>
<td>Sensitive Data Protection's de-identification (format-preserving encryption, tokenization, masking, bucketing) - the only native tokenization service of the three</td>
</tr>
</tbody>
</table>
</div>
<p>See <a href="data-security.html">Data Security & KMS</a> for the architectural patterns these services are used in.</p>
<h3 id="t-network">Network security</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Capability</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">WAF</th>
<td>AWS WAF (CloudFront, ALB, API Gateway, App Runner, AppSync); managed rule groups + custom rules</td>
<td>Azure WAF (Application Gateway and Front Door variants); Microsoft + <a class="glossary-link" href="glossary.html#term-owasp">OWASP</a> managed rule sets</td>
<td><a class="glossary-link" href="glossary.html#term-cloud-armor">Cloud Armor</a> - the most flexible rule language (CEL); preconfigured WAF rules for OWASP Top 10</td>
</tr>
<tr>
<th scope="row">DDoS - free tier</th>
<td><a class="glossary-link" href="glossary.html#term-shield">AWS Shield</a> Standard - free, automatic, all-customer baseline</td>
<td>Azure DDoS Protection - Basic tier auto-enabled at the platform level (free)</td>
<td>Cloud Armor - free Standard tier with always-on baseline DDoS protection</td>
</tr>
<tr>
<th scope="row">DDoS - paid tier</th>
<td>AWS Shield Advanced - paid per protected resource group; 24x7 Shield Response Team access; cost-protection</td>
<td>Azure DDoS Network Protection - paid per protected resource; engineering rapid-response</td>
<td>Cloud Armor Managed Protection Plus - paid; named "adaptive protection" with ML-based detection</td>
</tr>
<tr>
<th scope="row">Network firewall</th>
<td>Security Groups (instance-level, stateful) + NACLs (subnet, stateless) + AWS Network Firewall (Suricata-based)</td>
<td>NSGs (stateful) + Azure Firewall (managed, FQDN filtering, threat intel) + Firewall Manager</td>
<td>VPC firewall rules (stateful) + Cloud NGFW Standard / Enterprise (Palo Alto-powered IDPS)</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-microsegmentation">Microsegmentation</a> primitive</th>
<td>Security Groups + IAM-based service authorization; ECS task SGs for container-level isolation</td>
<td>NSGs + Application Security Groups; service tags; AKS network policies</td>
<td>Firewall rules + service-attached tags; firewall policies hierarchical at the org level</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-service-mesh">Service mesh</a> (managed)</th>
<td>AWS App Mesh (<a class="glossary-link" href="glossary.html#term-envoy">Envoy</a>); third-party Istio / Linkerd on EKS</td>
<td>Azure Service Fabric Mesh (limited); AKS with Open Service Mesh (deprecated) or third-party</td>
<td>Anthos Service Mesh / Cloud Service Mesh - managed Istio with deep IAM integration</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-privatelink">Private endpoint</a> pattern</th>
<td>VPC Endpoints (Interface = PrivateLink, Gateway = S3/DynamoDB); Resource Access Manager for sharing</td>
<td>Private Link / Private Endpoint - per-resource private IP into your VNet; broader service coverage than AWS PrivateLink</td>
<td>Private Service Connect - endpoint, backend, and producer flavors; the most flexible model</td>
</tr>
<tr>
<th scope="row">Egress filtering</th>
<td><a class="glossary-link" href="glossary.html#term-nat">NAT</a> Gateway + Network Firewall FQDN allow-listing; VPC endpoints for service-internal egress</td>
<td>Azure Firewall FQDN tags + Private Endpoints for first-party egress</td>
<td>Cloud NAT + Secure Web Proxy + VPC Service Controls (egress rules)</td>
</tr>
<tr>
<th scope="row">VPC isolation primitive</th>
<td>VPC (regional); <a class="glossary-link" href="glossary.html#term-peering">peering</a>, Transit Gateway, RAM for sharing</td>
<td>VNet (regional); VNet peering, Virtual WAN, hub-spoke patterns</td>
<td>VPC (global by default); Shared VPC across projects; VPC Peering - the cleanest of the three at multi-region scale</td>
</tr>
<tr>
<th scope="row">Network telemetry</th>
<td>VPC Flow Logs, Traffic Mirroring (Nitro instances), GuardDuty network detections</td>
<td><a class="glossary-link" href="glossary.html#term-nsg">NSG</a> Flow Logs (v2), Virtual Network TAP (preview/regional), Network Watcher</td>
<td>VPC Flow Logs, Packet Mirroring, Firewall Insights, Network Intelligence Center</td>
</tr>
</tbody>
</table>
</div>
<p>See <a href="network-security.html">Network Security</a> for the architectural patterns and <a href="zero-trust.html">Zero Trust</a> for how these compose into a zero-trust posture.</p>
<h3 id="t-compliance">Compliance</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Framework / standard</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-fedramp">FedRAMP</a> Moderate</th>
<td>Yes - most US regions; the deepest catalog of in-scope services</td>
<td>Yes - Azure Commercial (a subset of services)</td>
<td>Yes - GCP Assured Workloads US Regions</td>
</tr>
<tr>
<th scope="row">FedRAMP High</th>
<td>AWS GovCloud (US) + select commercial-region services</td>
<td>Azure Government</td>
<td>GCP Assured Workloads - IL2 / IL4 / IL5 boundaries</td>
</tr>
<tr>
<th scope="row">DoD IL5 / IL6</th>
<td>AWS GovCloud + Secret Region (IL6); the deepest DoD coverage</td>
<td>Azure Government Secret / Top Secret</td>
<td>GCP Assured Workloads IL5 (growing); IL6 limited</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-hipaa">HIPAA</a>-eligible services</th>
<td><a href="https://aws.amazon.com/compliance/hipaa-eligible-services-reference/" target="_blank" rel="noopener noreferrer">~150+ eligible services</a></td>
<td><a href="https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech" target="_blank" rel="noopener noreferrer">Comparable coverage with BAA</a></td>
<td><a href="https://cloud.google.com/security/compliance/hipaa" target="_blank" rel="noopener noreferrer">~100+ HIPAA-covered services</a></td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-pci-dss">PCI DSS</a> 4.0</th>
<td><a class="glossary-link" href="glossary.html#term-sp">Service Provider</a> Level 1; full attestation</td>
<td>Service Provider Level 1; full attestation</td>
<td>Service Provider Level 1; full attestation</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-iso">ISO</a> 27001 / 27017 / <a class="glossary-link" href="glossary.html#term-iso-27017">27018</a></th>
<td>All three certified across most regions</td>
<td>All three certified across most regions</td>
<td>All three certified across most regions</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-soc-2">SOC 2</a> Type 2</th>
<td>Available; published annually</td>
<td>Available; published annually</td>
<td>Available; published annually</td>
</tr>
<tr>
<th scope="row">Sovereign cloud (EU)</th>
<td>AWS European Sovereign Cloud (planned, Brandenburg region build-out)</td>
<td>Microsoft Cloud for Sovereignty + EU Data Boundary</td>
<td>GCP Sovereign Controls (T-Systems Germany, S3NS France, Telecom Italia)</td>
</tr>
<tr>
<th scope="row">Country-specific (sample)</th>
<td>IRAP (AU), C5 (DE), ENS (ES), TISAX, K-ISMS</td>
<td>IRAP (AU), C5 (DE), ENS (ES), TISAX, K-ISMS, China-21V partner</td>
<td>IRAP (AU), C5 (DE), ENS (ES), HKMA, K-ISMS</td>
</tr>
<tr>
<th scope="row">Continuous compliance dashboard</th>
<td>Security Hub + AWS Audit Manager (framework-mapped evidence)</td>
<td>Defender for Cloud regulatory-compliance dashboard + <a class="glossary-link" href="glossary.html#term-purview">Microsoft Purview</a> Compliance Manager</td>
<td>Security Command Center compliance posture + Assured Workloads attestations</td>
</tr>
</tbody>
</table>
</div>
<p>See <a href="compliance-frameworks.html">Compliance Frameworks</a> for the framework-by-framework deep dive and <a href="grc.html">GRC</a> for how these certifications fit into a compliance program.</p>
<h3 id="t-pricing">Pricing models</h3>
<p>The line item where the clouds differ most. Functional capability is similar; pricing structure can swing a workload's annual security bill by 5-10×. The patterns below are the load-bearing ones.</p>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Pricing dimension</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">Threat detection</th>
<td>GuardDuty priced per event (CloudTrail, VPC Flow, DNS) + per protected workload; features (Malware Protection, EKS Audit, Runtime, S3 Protection) bill separately</td>
<td>Defender plans priced per resource per month (servers, containers, storage, SQL each their own SKU)</td>
<td>SCC Premium / Enterprise priced per asset / per workload; transparent tiering</td>
</tr>
<tr>
<th scope="row">CSPM</th>
<td>Security Hub priced per check per month + per security finding ingested</td>
<td>Included in Defender for Cloud plans (free CSPM Foundational, paid Defender CSPM)</td>
<td>SCC Standard free for basic posture; Premium adds compliance + workload protection</td>
</tr>
<tr>
<th scope="row">KMS - per key</th>
<td>$1 / month per CMK</td>
<td>$1 / month per software key; $5 / month per HSM key (Premium vault)</td>
<td>$0.06 / month per active key version (software); $1-$2.50 per key version (HSM)</td>
</tr>
<tr>
<th scope="row">KMS - per request</th>
<td>$0.03 per 10,000 requests (some operations free)</td>
<td>$0.03 per 10,000 transactions</td>
<td>$0.03 per 10,000 operations (symmetric); cheaper than AWS / Azure once the per-key savings are included</td>
</tr>
<tr>
<th scope="row">Audit log retention</th>
<td>CloudTrail management events free in console for 90 days; S3 / Glacier for cheap long-term; CloudWatch Logs paid by GB ingest + retention</td>
<td>Activity Log free 90 days; export to Log Analytics priced per GB ingested + retained; the highest at-scale log cost of the three</td>
<td>Admin Activity free 400 days; sinks to BigQuery / GCS are cheap; Logging itself by GB ingested</td>
</tr>
<tr>
<th scope="row">Egress (the big one)</th>
<td>Tiered: typically $0.09 / GB to internet at low volume, dropping with discounts; same-region cross-AZ also chargeable</td>
<td>Tiered: typically $0.087 / GB to internet; cross-region within Azure also chargeable</td>
<td>Tiered: typically $0.12 / GB to internet at low volume (premium tier); cheaper standard tier; egress to peered or VPC-connected destinations cheaper</td>
</tr>
<tr>
<th scope="row">DDoS protection</th>
<td>Shield Standard free; Shield Advanced $3,000 / month flat + data-processing fees</td>
<td>Basic free; Network Protection ~$2,944 / month for first 100 protected resources + data-processed</td>
<td>Cloud Armor Standard free baseline; Managed Protection Plus subscription tier</td>
</tr>
<tr>
<th scope="row">Free tier / commitment</th>
<td>30-day Security Hub free trial; GuardDuty 30-day free trial per account</td>
<td>30-day Defender for Cloud free trial; free CSPM Foundational stays free</td>
<td>30-day SCC Premium free trial; SCC Standard always free at basic posture</td>
</tr>
</tbody>
</table>
</div>
<p>Egress dominates almost every multi-cloud bill. The fastest way to lose money in cloud security is to architect cross-cloud data flows where logs, backups, or threat-intel feeds traverse provider boundaries hot. Keep telemetry where the workload runs; export aggregates, not raw events.</p>
<h3 id="t-cust-iam">Customer identity (CIAM / B2C / external)</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Capability</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">Primary service</th>
<td>Amazon Cognito (User Pools + Identity Pools)</td>
<td>Microsoft Entra External ID (formerly Azure AD B2C) - unified with Entra ID in 2024+</td>
<td>Google Identity Platform (Firebase Authentication for consumer apps)</td>
</tr>
<tr>
<th scope="row">Federation / social providers</th>
<td>Google, Facebook, Apple, Amazon, OIDC, SAML</td>
<td>Google, Facebook, Twitter, Apple, OIDC, SAML; broader social provider library</td>
<td>Google, Facebook, Twitter, GitHub, Microsoft, Apple, OIDC, SAML, phone, anonymous</td>
</tr>
<tr>
<th scope="row"><a class="glossary-link" href="glossary.html#term-mfa">MFA</a> / passwordless</th>
<td>SMS, TOTP, <a class="glossary-link" href="glossary.html#term-fido2">WebAuthn</a> (passkeys); SDK-level enforcement</td>
<td>Conditional Access policies including passwordless; Authenticator app; FIDO2; SMS</td>
<td>SMS, TOTP, multi-factor enrollment APIs; passkeys via Firebase</td>
</tr>
<tr>
<th scope="row">Customer experience / UX</th>
<td>Hosted UI customizable; SDK-driven custom flows</td>
<td>Custom policies (XML-based) or User Flows (UI-driven); the most flexible CIAM-tier branding</td>
<td>Firebase Auth UI; React / iOS / Android SDKs; the most JavaScript-ergonomic</td>
</tr>
<tr>
<th scope="row">Pricing model</th>
<td>Per monthly active user (MAU); free tier up to 50K MAU (Lite tier)</td>
<td>Per MAU; free tier; Premium for advanced features</td>
<td>Per MAU + per SMS; generous free tier on Firebase</td>
</tr>
<tr>
<th scope="row">Maturity verdict</th>
<td>Longest pedigree; idiosyncratic API; many production users</td>
<td>The most mature CIAM offering of the three; the strongest enterprise B2C integration</td>
<td>Newest entry; cleanest SDK; weaker enterprise B2C features</td>
</tr>
</tbody>
</table>
</div>
<h3 id="t-compute">Compute platform security</h3>
<div class="comparison-table">
<table>
<thead>
<tr>
<th scope="col" class="ct-row-head">Capability</th>
<th scope="col" class="ct-aws"><span class="ct-dot ct-dot-aws" aria-hidden="true"></span> AWS</th>
<th scope="col" class="ct-azure"><span class="ct-dot ct-dot-azure" aria-hidden="true"></span> Azure</th>
<th scope="col" class="ct-gcp"><span class="ct-dot ct-dot-gcp" aria-hidden="true"></span> GCP</th>
</tr>
</thead>
<tbody>
<tr>
<th scope="row">VM service</th>
<td>EC2</td>
<td>Azure Virtual Machines</td>
<td>Compute Engine</td>
</tr>
<tr>
<th scope="row">Metadata service hardening</th>
<td>IMDSv2 - session-token, hop-limit-1, default-on for new instances since 2024</td>
<td>Azure IMDS - header-required for v1; non-routable IP; no hop-limit by default</td>
<td>GCP metadata server - header-required; no hop-limit by default; <code>Metadata-Flavor: Google</code> mandatory</td>
</tr>
<tr>
<th scope="row">Default disk encryption</th>
<td>EBS default encryption (region-level setting); KMS-managed</td>