ON-PREMISES AWS AZURE GOOGLE
Security Groups Network Security Groups Cloud Armor
Stateful Firewall
AWS Network ACLs (NSG) VPC Firewall
IPS/IDS/HIPS 3rd Party Only 3rd Party Only 3rd Party Only
Web Application Firewall AWS WAF
Application Gateway Cloud Armor
(WAF) AWS Firewall Manager
SIEM AWS CloudTrail
Log Analytics (OMS) Stackdriver Logging
Log Analytics Amazon GuardDuty
Microsoft Antimalware /
Antimalware 3rd Party Only Cloud Security Scanner
Azure Security Center
Privileged Access
3rd Party Only 3rd Party Only 3rd Party Only
Management (PAM)
Data Loss Prevention Information Protection Cloud Data Loss
Amazon Macie
(DLP) (AIP) Prevention API
Amazon Inspector
Vulnerability Assessment Azure Security Center Cloud Security Scanner
AWS Trusted Advisor
Information Protection Various controls
Email Protection 3rd Party Only
Office 365 embedded in G-Suite
Web/URL Filtering 3rd Party Only 3rd Party Only 3rd Party Only
SSL Decryption
Elastic Load Balancer Application Gateway HTTPS Load Balancing
Reverse Proxy
Virtual Private Cloud Virtual Network
VPN Google VPN
(VPC) SSTP
Key Management Cloud Key Management
Key Management Key Vault
Service (KMS) Service
Storage Encryption for Part of Google Cloud
Encryption At Rest Elastic Block Storage
Data at Rest Platform
DDoS AWS Shield Built-in DDoS defense Cloud Armor
Identity and Access Identity and Access Cloud Identity
Azure Active Directory
Management Management (IAM) Cloud IAM
Multi-Factor Security Key
AWS MFA Azure Active Directory
Authentication Enforcement
VPC Flow Logs
Centralized Logging CloudWatch / S3 bucket Azure Audit Logs
Access Transparency
Elastic Load Balancer / Cloud Load Balancing
Load Balancer Azure Load Balancer
CloudFront HTTPS Load Balancing
Virtual Private Cloud Virtual Private Cloud
LAN Virtual Network
(VPC) Network (VPC)
WAN Direct Connect ExpressRoute / MPLS Dedicated Interconnect
On-Premises vs AWS vs Azure vs Google Cloud Terminology v 2.0 – Jan 2019 © Adrian Grigorof, Marius Mocanu