Multi-cloud control comparison: AWS, Azure, GCP, Alibaba Cloud
Side-by-side reference for the controls that matter in a landing zone. Filter by area, toggle providers, and copy what you need.
Scroll sideways to compare providers. The control column stays in view.
| Control | AWS | Azure | GCP | Alibaba Cloud |
|---|
Continue your assessment
Frequently Asked Questions
AWS IAM uses JSON policy documents with Allow/Deny rules attached to identities or resources. Azure RBAC assigns built-in or custom roles at a scope (subscription, resource group, or resource). Both follow least-privilege principles but the policy language and assignment model are not portable. Federating both through a central IdP like Entra ID or Okta is the standard approach. See: RBAC patterns for production cloud environments.
Yes. The aliyun/alicloud Terraform provider is production-ready. It supports Resource Directory (multi-account), RAM roles, VPC, OSS, and SLS. State locking is handled via OSS + Table Store (OTS). Official landing zone modules are available at alibabacloud-automation on GitHub.
GCP VPCs are global by default. Subnets are regional but a single VPC spans all regions. AWS and Azure VPCs/VNets are regional. This changes cross-region peering assumptions. GCP uses Shared VPC for cross-account network sharing. AWS uses Transit Gateway. Azure uses Virtual WAN or VNet Peering.
GCP Cloud Logging defaults to 30 days. AWS CloudWatch log groups default to Never Expire. Azure Log Analytics defaults to 30 days interactive. Alibaba SLS defaults to 30 days. For most compliance frameworks, set at least 90 days and ideally 1 year for management audit logs. Set retention explicitly at provisioning time.
Standardise the runbook format and on-call escalation path. Route all provider alerts to a single on-call platform. Diverge on native alerting tooling since these are provider-native and abstraction adds cost without benefit.