Multi-Cloud-Control-Vergleich: AWS, Azure, GCP, Alibaba Cloud
Nebeneinander-Referenz für die Controls, die in einer Landing Zone zählen. Nach Bereich filtern, Provider umschalten, kopieren was Sie brauchen.
Provider
Bereich
Seitlich scrollen, um Provider zu vergleichen. Die Control-Spalte bleibt sichtbar.
| Control | AWS | Azure | GCP | Alibaba Cloud |
|---|---|---|---|---|
| Identity and accessVerified August 2026 | ||||
| standardise Admin / root model Disable root/primary for daily ops on all four providers. | Root account (Organizations). Disable root access keys on day one. Break-glass only. | Global Administrator in Entra ID. Separate break-glass accounts with PIM. | Super Admin in Cloud Identity org. Separate from day-to-day operations. | Primary account (root-equivalent). RAM sub-accounts for all human and programmatic access. |
| diverge IAM policy language Policy languages share concepts but are not portable across providers. | JSON policy documents. Allow/Deny, conditions, resource ARNs. | Azure RBAC. Built-in roles + custom role definitions in JSON. | IAM bindings. Predefined or custom roles in YAML/JSON. | RAM policy JSON (similar to AWS). Action/Resource/Condition structure. |
| standardise Federation / SSO Use one central IdP. See: RBAC patterns for production cloud environments. | IAM Identity Center. SAML 2.0 or OIDC to a central IdP. | Entra ID as the IdP. Acts as IdP for other providers via federation. | Workforce Identity Federation. OIDC/SAML to external IdP. | RAM SAML federation. Integrate with Entra ID or Okta via SAML 2.0. |
| standardise Workload identity All four support OIDC short-lived credentials. No long-lived keys anywhere. | IAM roles via OIDC (GitHub Actions, EKS pod identity). No long-lived keys. | Managed Identity. Workload Identity Federation for external workloads. | Workload Identity Federation. Service account keys explicitly deprecated. | RAM roles with STS. Instance RAM role on ECS avoids AccessKey. |
| diverge Privilege review tooling Export findings to a central SIEM for cross-provider access review. | IAM Access Analyzer. Last-accessed data in IAM console. | Entra ID Access Reviews. PIM for just-in-time access. | Policy Analyzer. IAM Recommender for unused permissions. | RAM Access Advisor. Cloud Governance Center policy audit. |
| Network topologyVerified August 2026 | ||||
| abstract VPC / virtual network model GCP VPC is global by default; AWS/Azure/Alibaba VPCs are regional. See: Network topology in multi-cloud estates. | VPC. Regional, multi-AZ subnets. Secondary CIDR blocks expandable. | VNet. Regional. Address space expandable. Subnets within VNet. | VPC. Global (subnets are regional). Single VPC spans all regions. | VPC. Regional. VSwitch per zone. |
| abstract Cross-account connectivity Hub-and-spoke is universal. CEN Transit Router is functionally equivalent to AWS TGW. | Transit Gateway (hub-and-spoke). VPC Peering for simple pairs. | Azure Virtual WAN or VNet Peering with Azure Firewall hub. | Shared VPC (host + service projects). VPC Peering for cross-project. | Cloud Enterprise Network (CEN). Transit Router for cross-region and cross-account. |
| standardise Private service access Policy: all managed services via private endpoint only in production. | VPC Endpoints (Interface and Gateway). PrivateLink for SaaS. | Private Endpoints. Private Link Service for internal publishing. | Private Service Connect. Private Google Access for Google APIs. | PrivateLink. VPC endpoint for OSS, RDS, and platform services. |
| abstract Egress control GCP requires NVA or Secure Web Proxy for L7 inspection. Azure Firewall is the most opinionated. | NAT Gateway + Security Groups. AWS Network Firewall for deep inspection. | Azure Firewall in hub VNet. UDRs force egress through hub. | Cloud NAT + Secure Web Proxy. Third-party NVA or Cloud Firewall for L7. | NAT Gateway + Cloud Firewall. CEN-based centralised egress. |
| abstract DNS Azure DNS Private Resolver is most feature-complete for complex hybrid setups. | Route 53 Private Hosted Zones. Resolver endpoints for hybrid DNS. | Azure Private DNS Zones. DNS Private Resolver for hybrid. | Cloud DNS private zones. DNS forwarding zones for hybrid. | Alibaba Cloud PrivateZone. VPC-scoped resolution. |
| IaC standardsVerified August 2026 | ||||
| standardise Terraform provider maturity All four have stable providers. Alibaba provider less community-documented; use official modules. See: Terraform module patterns. | hashicorp/aws. Most mature. Largest community module ecosystem. | hashicorp/azurerm. Mature. Azure Verified Modules (AVM) recommended. | hashicorp/google. Mature. Cloud Foundation Toolkit (CFT) for opinionated modules. | aliyun/alicloud. Production-ready. OSS + Table Store backend for state locking. |
| standardise State backend Remote state with locking is non-negotiable. Separate state files per lifecycle boundary. See: Terraform module patterns. | S3 with locking. Native lockfile on current Terraform; DynamoDB on older estates. | Azure Storage Account (blob) with built-in locking. | GCS bucket. Locking via a .tflock object, not object versioning. | OSS bucket + Table Store (OTS) for locking. |
| abstract Module registry / source Use provider-official module sources. Pin versions. Wrap in your own interface module. See: Terraform module patterns. | Terraform Registry + Account Factory for Terraform (AFT) for landing zone. | Azure Verified Modules (AVM). IaC Accelerator for landing zone. | Cloud Foundation Toolkit (CFT) modules. Enterprise Foundations Blueprint. | alibabacloud-automation on GitHub. Official landing-zone-resource-structure module. |
| abstract Drift detection Run terraform plan on a schedule (nightly) on all providers to catch out-of-band changes. | AWS Config + Config Rules. terraform plan in CI to detect drift. | Azure Policy with audit/deny effects. terraform plan in pipeline. | Org Policy constraints. Config Connector for Kubernetes-native enforcement. | Cloud Governance Center Protection Rules. terraform plan in pipeline. |
| Logging and observabilityVerified August 2026 | ||||
| standardise Default audit log sink Immutability is not the default on any provider. Explicitly configure WORM/Object Lock. | CloudTrail (management + data events) to hardened S3 with Object Lock. | Azure Activity Log + Entra audit logs to Log Analytics or Storage Account. | Cloud Audit Logs (Admin Activity, Data Access) to Cloud Logging bucket or BigQuery. | ActionTrail to OSS bucket with immutable lock or SLS Log Store. |
| standardise Structured logging standard Mandate JSON logging at the application level. OpenTelemetry removes provider lock-in. | CloudWatch Logs Insights. JSON preferred. | Log Analytics (KQL). JSON preferred. | Cloud Logging JSON payload. jsonPayload for structured data. | SLS Log Store. Key-value or JSON log format. |
| standardise Log retention defaults GCP and Alibaba default to 30 days. Explicitly set retention rules per environment. | CloudWatch: Never expire default (configure explicitly). S3 Object Lock for WORM. | Log Analytics: 30 days interactive default, up to 730 days (configurable). | Cloud Logging: 30 days default (_Default bucket). Configure per bucket. | SLS: 30 days default. Configurable per Log Store (unlimited with OSS offload). |
| abstract Central aggregation Never rely on one provider console as the single source of truth. | Security Lake or third-party SIEM (Splunk, Datadog) as single sink. | Microsoft Sentinel or third-party SIEM. Log Analytics hub workspace. | Chronicle SIEM or export to BigQuery / third-party via Log Sink. | SLS cross-account aggregation project or export to third-party SIEM. |
| Cost attributionVerified August 2026 | ||||
| standardise Tag enforcement mechanism GCP calls them labels not tags. Define a universal schema: env, team, cost-centre, service. | AWS Config Rules + SCP deny if required tags absent. Tag policies via Organizations. | Azure Policy (deny effect) for required tags at subscription or resource group level. | Org Policy + Budget alerts. Labels (not tags) on resources. Label inheritance from project. | Cloud Governance Center tag policies. Resource Group mandatory tag rules. |
| abstract Budget alerting Set budgets per environment and team on all providers before production cutover. | AWS Budgets with SNS or email alerts. Per-account or per-tag granularity. | Cost Management Budgets. Alerts to action groups (email, webhook, Logic App). | Billing Budgets. Alerts via Pub/Sub or email. Per-project or per-label. | Budget Management in Cost Center. Alerts via SMS, email, or CloudMonitor. |
| diverge Committed use / reserved capacity Commitment models differ meaningfully. Optimise per provider with provider-native tooling. | Reserved Instances (1 or 3 year). Savings Plans (compute or instance). | Reserved VM Instances. Savings Plan for compute. Azure Hybrid Benefit. | Committed Use Discounts (CUDs). Resource-based or spend-based. | Reserved Instances. Savings Plans. Subscription instances. |
| abstract Cost allocation export GCP BigQuery export is the most queryable natively. Use as target if centralising. | Cost and Usage Report (CUR 2.0) to S3. Queryable via Athena or Cost Explorer. | Cost Management exports to Storage Account. Power BI or Azure Data Factory. | Billing export to BigQuery. Standard dataset format, queryable with SQL. | Billing export to OSS. Cost Center reports via download or API. |
| Security baselineVerified August 2026 | ||||
| standardise Default baseline / benchmark SCC Premium required on GCP. Alibaba Security Center requires Enterprise tier. Related: Golden image baselines. | CIS AWS Foundations Benchmark. Security Hub with CIS standard enabled. | Microsoft Cloud Security Benchmark (MCSB). Defender for Cloud with MCSB policy. | CIS Google Cloud Foundation Benchmark. Security Command Center (SCC) with posture. | Security Center baseline rules. CIS-aligned checks available in Security Center. |
| standardise Secret management No long-lived credentials in code, images, env files, or CI secrets on any provider. | AWS Secrets Manager or SSM Parameter Store (SecureString). OIDC for workload identity. | Azure Key Vault. Managed Identity for access. | Secret Manager. Workload Identity Federation. | KMS + Parameter Store (OOS). STS for workload identity via RAM role on ECS. |
| abstract Vulnerability scanning Enable native scanning on all providers. Aggregate findings to a central SIEM or CSPM. | Amazon Inspector (EC2, Lambda, ECR). GuardDuty for threat detection. | Defender for Servers. Microsoft Defender for Containers. | Artifact Registry scanning. Security Command Center vulnerability findings. | Security Center vulnerability management for ECS. Container Registry scanning. |
| standardise Encryption at rest All four encrypt by default with provider-managed keys. CMK required for regulated data. | AWS KMS. Default encryption on S3, EBS, RDS. CMK for regulated workloads. | Azure Key Vault (CMK). Default encryption on storage, managed disks, SQL. | Cloud KMS or Cloud HSM. Default encryption on all GCS and Persistent Disk. | KMS. Default encryption on OSS, ECS disk, RDS. CMK for regulated. |
| Incident responseVerified August 2026 | ||||
| abstract Native alerting Route all critical alerts to a single on-call platform regardless of provider. | CloudWatch Alarms + SNS. EventBridge for event-driven response. | Azure Monitor Alerts + Action Groups. Logic Apps for automation. | Cloud Monitoring alerting policies. Pub/Sub for automated response. | CloudMonitor alerts. EventBridge for event-driven automation. |
| diverge Runbook tooling GCP has no native SSM equivalent. Standardise the runbook format, not the execution platform. | Systems Manager (SSM) Run Command + Automation documents. | Azure Automation Runbooks. Update Manager for patching. | Cloud Run Jobs or Cloud Functions for automated response. No native runbook service. | OOS (Operation Orchestration Service) for runbooks and automated remediation. |
| standardise On-call integrations Alibaba DingTalk integration is strong for China-based teams only. | PagerDuty / OpsGenie via SNS. AWS Chatbot for Slack/Teams. | Azure Monitor + Action Groups to PagerDuty/OpsGenie. Teams integration native. | Pub/Sub to Cloud Function to PagerDuty/OpsGenie webhook. | CloudMonitor webhook to PagerDuty/OpsGenie. DingTalk native. |
| standardise Post-incident audit trail Ensure logs are in a hardened account the compromised account cannot modify. | CloudTrail for all API calls. AWS Config for resource state history. | Activity Log + Entra Sign-in logs. Microsoft Sentinel for timeline reconstruction. | Cloud Audit Logs (Admin Activity immutable). Asset inventory snapshots. | ActionTrail for API audit. Security Center event timeline. |
Bewertung fortsetzen
Häufige Fragen
AWS IAM nutzt JSON-Policy-Dokumente mit Allow/Deny-Regeln an Identities oder Resources. Azure RBAC weist Built-in- oder Custom-Roles auf einem Scope zu (Subscription, Resource Group oder Resource). Beide folgen Least Privilege, aber Policy-Sprache und Assignment-Modell sind nicht portabel. Beide über einen zentralen IdP wie Entra ID oder Okta zu federieren ist der Standardansatz. Siehe: RBAC patterns for production cloud environments.
Ja. Der aliyun/alicloud Terraform-Provider ist produktionsreif. Er unterstützt Resource Directory (Multi-Account), RAM Roles, VPC, OSS und SLS. State Locking läuft über OSS + Table Store (OTS). Offizielle Landing-Zone-Module gibt es unter alibabacloud-automation auf GitHub.
GCP VPCs sind standardmässig global. Subnets sind regional, aber eine einzelne VPC spannt alle Regionen. AWS- und Azure-VPCs/VNets sind regional. Das ändert Annahmen zu Cross-Region-Peering. GCP nutzt Shared VPC für Cross-Account-Netzwerksharing. AWS nutzt Transit Gateway. Azure nutzt Virtual WAN oder VNet Peering.
GCP Cloud Logging defaultet auf 30 Tage. AWS CloudWatch Log Groups defaulten auf Never Expire. Azure Log Analytics defaultet auf 30 Tage interaktiv. Alibaba SLS defaultet auf 30 Tage. Für die meisten Compliance-Frameworks mindestens 90 Tage setzen, ideal 1 Jahr für Management-Audit-Logs. Retention explizit beim Provisioning setzen.
Runbook-Format und On-Call-Eskalationspfad standardisieren. Alle Provider-Alerts auf eine einzige On-Call-Plattform routen. Bei nativem Alerting-Tooling divergieren, das ist provider-nativ und Abstraktion kostet ohne Nutzen.