Security Services at a Glance
| Category |
| Identity Service |
IAM |
Entra ID (Azure AD) |
Cloud IAM |
| Key Management |
KMS |
Key Vault |
Cloud KMS |
| Secret Management |
Secrets Manager |
Key Vault |
Secret Manager |
| WAF |
AWS WAF |
Azure WAF |
Cloud Armor |
| SIEM |
— |
Microsoft Sentinel |
Chronicle |
| Threat Detection |
GuardDuty |
Defender for Cloud |
Security Command Center |
IAM Model Differences
Each provider takes a fundamentally different approach to identity and access management. Understanding these models is critical because IAM mistakes are the #1 cause of cloud security breaches.
AWS IAM
Users, Groups, Roles, and Policies in a flat (non-hierarchical) model. Explicit deny always wins. Supports attribute-based access control (ABAC) with resource tags for fine-grained permissions. The most granular policy language of the three.
# list IAM users
aws iam list-users
# attach policy to role
aws iam attach-role-policy \
--role-name MyRole \
--policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
Azure Entra ID
Hierarchical model with Management Groups, Subscriptions, Resource Groups, and Resources. Native Active Directory integration. RBAC with built-in and custom roles. The strongest enterprise identity solution—Windows, Office 365, and GitHub all tie in natively.
# list role assignments
az role assignment list \
--assignee user@domain.com
# assign a role
az role assignment create \
--role "Reader" \
--assignee user@domain.com
GCP Cloud IAM
Cleanest hierarchy: Organization → Folders → Projects → Resources. Policies inherit downward with clean override semantics. Service accounts for machine identity. Workload Identity Federation for external identity providers.
# list IAM policy
gcloud projects get-iam-policy \
my-project-id
# add IAM binding
gcloud projects add-iam-policy-binding \
my-project-id \
--member="user:dev@example.com" \
--role="roles/viewer"
Key Differentiators
Entra ID (formerly Azure AD) is the clear winner for enterprise identity. Native integration with Windows, Office 365, GitHub, and thousands of SaaS apps via SAML/OIDC. Conditional Access policies, Privileged Identity Management (PIM), and identity governance. AWS and GCP simply cannot match this depth in enterprise identity.
AWS IAM policy language is the most granular of the three. Fine-grained conditions, ABAC with tags, permission boundaries, and service control policies (SCPs) in AWS Organizations. More complex to learn, but more powerful once mastered.
GCP’s hierarchy model (Org → Folder → Project) is the cleanest. Policies cascade naturally. Projects provide a strong isolation boundary that maps well to teams and environments. Workload Identity Federation eliminates the need for service account keys.
Enterprise Identity Reality
If your organization runs on Microsoft (Active Directory, Office 365, Windows endpoints), Azure’s Entra ID integration is a massive advantage. AWS and GCP both require federation with an external IdP for enterprise scenarios. For greenfield or non-Microsoft shops, all three providers are roughly comparable—but Microsoft shops should weight Azure heavily for this reason alone.
Compliance & Certifications
All three major providers maintain comprehensive compliance programs. The core certifications are shared across providers:
ISO 27001
Info Security Mgmt
PCI DSS
Payment Card Data
Compliance Note
Cloud provider compliance certifications cover the infrastructure layer. You are still responsible for configuring your workloads securely (the “shared responsibility model”). AWS, Azure, and GCP all publish detailed shared responsibility matrices—review them before assuming a certification covers your entire stack.
↑ Back to Top