Google Cloud AWS and Azure - Cloud Network Security – Same Goals but Different Flavors

Azure, AWS, and Google Cloud all preach the same gospel — things like Zero Trust and network segmentation — but the way they do it is more like three chefs cooking the same dish with totally different recipes.

• AWS: throws every tool in the kitchen at you, then says “layer it up and don’t forget governance.”

• Azure: organizes everything around identity, policies, and blueprints — basically the corporate rulebook with extra tabs.

• Google Cloud: keeps it sleek and simple, sprinkling in automation and AI like it’s secret sauce.

Here is a quick overview of how their network security approaches differ.

1. Zero Trust Implementation and Access Control

All three providers prioritize the Zero Trust model, which mandates verifying access based on identity, device, and context, rather than network location. However, their primary implementation tools vary:

• Microsoft Azure: Promotes Zero Trust using Microsoft Entra Conditional Access to apply automated access control decisions based on required conditions like identity, device, and network location. For secure virtual machine (VM) access, Azure recommends Azure Bastion, which provides secure RDP/SSH connectivity directly through the Azure portal over TLS, eliminating the need to expose public IP addresses.

• Google Cloud (GCP): Addresses Zero Trust through its BeyondCorp framework, which includes single sign-on, access control policies, and authentication/authorization services.

• AWS: Zero Trust Network Access (ZTNA) on AWS enforces the principle of least privilege, verifying the user's identity via multi-factor authentication (MFA), checking the device's security status, and validating access conditions (like location and time) before granting access only to the specific application, not the entire network.

2. Basic Network Filtering and Segmentation

The foundational methods used to segment and filter traffic within the virtual network differ in implementation details and capability layering:

Feature	Microsoft Azure	AWS
Basic Firewall	Uses Azure Network Security Groups (NSGs) for basic, stateful packet filtering based on the 5-tuple (source IP/port, destination IP/port, protocol).	Uses two distinct tools: Amazon VPC Security Groups (host-based stateful firewalls for EC2 instances) and Network ACLs (NACLs) (stateless firewalls for VPC subnets).
Rule Simplification	Supports Augmented security rules which combine multiple ports, IP addresses, and ranges into a single rule to simplify security definition and reduce the total number of rules needed.	AWS NACLs and Security Groups operate primarily on individual rules, although they use Application Security Groups or service tags for grouping objects.
Segmentation Goal	Logical segmentation into subnets is a best practice, and NSGs are used to create network access controls between those subnets.	GCP advocates micro-segmentation with fine-grained security policies to strictly control traffic and contain lateral movement if an attacker infiltrates the network.

3. Advanced Firewall Capabilities and Third-Party Integration Model

The providers take distinctly different approaches to offering advanced security services like Intrusion Detection and deep packet inspection (DPI):

• Microsoft Azure (Native-Centric Model): Azure offers Azure Firewall as a cloud-native, intelligent, fully stateful firewall service available in three SKUs (Basic, Standard, Premium). The Premium SKU directly integrates advanced features like TLS inspection, signature-based Intrusion Detection and Prevention System (IDPS), and URL filtering.

• Google Cloud (Integration-Centric Model): Google Cloud provides the Network Security Integration service to enable customers to seamlessly integrate purpose-built appliances from third-party independent software vendors (ISVs) for advanced security protections. This approach is specifically designed for gaining visibility and performing advanced tasks like deep packet inspection (DPI) by inspecting the packet payload. This uses an out-of-band producer-consumer model, where customer traffic is redirected for inspection to a producer network (containing the third-party appliances backed by an internal load balancer).

• AWS (Managed Service Model): AWS offers the AWS Network Firewall for VPC protection, featuring native capabilities like stateful inspection, intrusion prevention, and web filtering.

4. Centralized Network Management and Governance

Managing security policies across large enterprises requires dedicated control planes:

• Microsoft Azure: Utilizes Azure Virtual Network Manager to centrally manage virtual networks at scale. It introduces Security admin rules defined in this manager, which have a higher priority than local Network Security Group (NSG) rules, thereby enforcing baseline security policies and preventing conflicts or misconfigurations in downstream NSGs.

• AWS: Provides AWS Firewall Manager as a single place to centrally configure and manage firewall rules across multiple accounts and networks to ensure consistent policy compliance throughout the entire infrastructure.

• Google Cloud: Offers the Network Intelligence Center as a single console for network observability, monitoring, and troubleshooting.

5. Private Connectivity to PaaS Services

All providers emphasize keeping PaaS traffic private, minimizing exposure to the public internet:

• Microsoft Azure: Provides Azure Private Link, allowing private access to Azure PaaS services using a private endpoint within the virtual network. This ensures traffic remains strictly on the Microsoft Azure backbone network.

• Google Cloud: Securing connections between environments is critical, and GCP recommends private access options so that clients (cloud-based or on-premises) can communicate with supported APIs and services without needing an external IP address.

Summing it all up.

While all major cloud providers adhere to a layered, Zero Trust philosophy, Azure focuses on refining its native cloud firewall capabilities with specific priority rules (Security Admin Rules over NSGs) and robust tools like Azure Bastion. AWS relies on a comprehensive suite of host- and network-level native tools managed centrally by Firewall Manager. Google Cloud uniquely provides a framework (Network Security Integration) that prioritizes the seamless deployment of specialized third-party appliances for deep traffic inspection using an out-of-band model.

back to more articles

---

security   AWS   AWS Firewall Manager   Access Control Policies   Azure   Azure Private Link   Azure Virtual Network Manager   BeyondCorp   Centralized Network Management   context   DevSecOps   Device   firewall   GCP   Google Cloud   IDPS   Identity   Identity-Centric   Intrusion Detection and Prevention System   Lateral Movement Containment   Micro-segmentation   NACL   NSG   Native-Centric vs. Integration-Centric Model   Network Intelligence Center   PaaS   Platform as a Service   Policy Compliance   Private Connectivity   SecDevOps   SecOps   TLS inspection   VPC Security Groups   ZTA   Zero Trust   Zero-Trust Architecture   Containment   Network ACL   network filtering   Network Security   network security group   Network Segmentation   secure engineering   security architecture   2024