Cloud Security Comparison – AWS vs Azure

Within any deployment and across any and all cloud providers – Security is job zero! This means that above all else security comes first. Whether it is AWS Security vs Azure Security, or comparing any other cloud providers to an on-premises equivalent – security minded solutions will always perform better, be safer and be much more reliable than solutions that are not built with security in mind. 

Whether or not you are a burgeoning startup, or a conglomerate – enabling security at every level of your organization is incredibly important. 

When you are building your infrastructure, you need to have security constantly at the forefront of your mind. The fact that within the cloud certain undifferentiated heavy lifting is handled on your behalf will enable yourself and your team to be much more security focused than they otherwise would be. Alongside this general ability to focus more on security, all of the major cloud providers come with a myriad of different services designed to aid you in building the most reliable and secure workloads you possibly can. 

In this blog post, we will talk about AWS security vs Azure security within the cloud. We will discuss different categories of cloud based security and break down AWS vs Azure security and do a detailed AWS vs Azure security comparison and do our best to conclude which cloud is superior. 

Identity and Access Management

First, we will talk about how each cloud implements Identity and Access Management.

An integral part of cloud security is Identity and Access Management (IAM). In order to prevent unauthorized access to data and applications, organizations need to manage access and role permissions. There is a slight difference between the IAM frameworks used by AWS and Azure. For a holistic approach to cloud security, these differences are worth exploring.

Azure Active Directory

Microsoft Azure’s access and authorization services are based on Active Directory (AD).

When you subscribe to Microsoft’s commercial online services like Azure, Power Platform, Dynamics 365, and Intune, you automatically get basic Azure AD features. Furthermore, the free tier offers cloud authentication, unlimited single sign-on (SSO), multi-factor authentication (MFA), and role-based access control (RBAC).

In order to implement more advanced IAM features like secure mobile access, security reporting and enhanced monitoring, you’ll need to pay a premium. Azure AD provides Premium P1 and Premium P2 paid tiers for $6 and $9, respectively every month. This is rather exclusionary for any users who are looking to take advantage of free resources within the cloud, and AWS makes it easier for users to enable a strong security posture with low to no cost. 

AWS Identity and Access Management (AWS IAM)

If you are an AWS customer, Amazon Web Service IAM is free. AWS IAM would be considered a foundational feature by most people, so this structure makes sense. As well as fine-grained access controls, the feature supports logical organization, groups, roles, multi-factor authentication, real-time access monitoring, and JSON policy configuration.

Additionally, Amazon’s IAM comes with excellent security measures by default. Users must be assigned permissions manually by administrators, for example. Due to this, newly created users cannot take any action in AWS until they have received approval.

AWS also natively integrates with effectively every AWS service – to allow effective and safe collaboration between principles, services and different aspects of your AWS architecture. For more info, check out this article on how to get started with AWS IAM.

Key Management and Encryption

Secondly, we will talk about how each cloud handles Key Management and Encryption within the main object storage services of each cloud: Amazon S3 and Azure Blob Storage. 

Amazon S3

Data protection as it travels to and from Amazon S3 and at rest (while it is stored on disks in Amazon S3 data centers) is easy to implement when you are navigating the AWS cloud and specifically, Amazon S3. 

You can protect data in transit using Secure Socket Layer/Transport Layer Security (SSL/TLS) or client-side encryption. 

You have the following options for protecting data at rest in Amazon S3:

• Server-Side Encryption – Request Amazon S3 to encrypt your object before saving it on disks in its data centers and then decrypt it when you download the objects.
• Client-Side Encryption – Encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.

The AWS Key Management service also offers fully managed key services with SSE-KMS and SSE-S3 server-side encryption. All key management functions are handled by AWS without user intervention.

Within Azure Blob, things are carried out effectively the same:

Azure Blob Storage

Azure Blob Storage also offers server-side and client-side encryption using AES-256 symmetric keys. In addition, just like AWS, Azure offers managed key storage and management.

Overall, AWS does have slightly more encryption services and options – however whether you need this additional functionality or not is related to your use case and perhaps your specific industry. 

Data Center Security

Thirdly, we will discuss data center security of AWS vs Azure.

Azure Data Center Security 

The access to data centers is tightly controlled by outer and inner perimeters with progressively more advanced security measures at each level, including perimeter fencing, security officers, locked server racks, integrated alarm systems, around-the-clock video surveillance by the operations center, and multi-factor access control. It is only authorized personnel who have access to Microsoft’s data centers. There is a restriction on logical access to the Microsoft 365 infrastructure, including the customer data, in Microsoft datacenters.

In order to monitor data center sites and facilities, our Security Operations Centers use integrated electronic access control systems. Camera systems provide effective coverage of the facility perimeter, entryways, shipping bays, server cages, interior aisles, and other sensitive security points. Security personnel receive alerts from the integrated security systems whenever an unauthorized entry attempt is detected as part of a multi-layered security posture.

There is an internationally recognized standard for checking the compliance, security and reliability of data centers, known as the Tiering System by the Uptime Institute.

There is no official tier certification for Microsoft. Uptime doesn’t have Microsoft listed in their certified tier database – but this doesn’t make Azure necessarily any better or worse. 

AWS Data Center Security

AWS provides physical data center access only to approved employees. All AWS employees who need data center access must first apply for access and provide a valid business justification in order to gain access. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access, and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions.

A Closed Circuit Television Camera (CCTV) records physical access points to server rooms. Retention of images is governed by legal and compliance requirements.

Ingress points to buildings are controlled by professional security staff using surveillance, detection systems, and other electronic means. Access to data centers is controlled by authorized staff using multi-factor authentication mechanisms. Entrances to server rooms are secured with devices that sound alarms to initiate an incident response if the door is forced or held open and there are also inbuilt intrusion detection methods. AWS is also not certified by the Uptime institute, and whilst this doesn’t necessarily matter either – it is important to note.

Cloud Monitoring

Finally, we will talk about how each cloud provider handles cloud monitoring. 

Amazon CloudWatch

Amazon CloudWatch is AWS’s primary monitoring tool. In one place, your systems and applications’ operational and performance data are neatly consolidated.

Visibility is the cornerstone of CloudWatch’s dashboard. Custom dashboards can be created to monitor specific groups of applications. You will also be able to get a quick overview of your critical infrastructure through its visual tools, such as graphs and metrics.

In addition, the platform combines user-defined thresholds with machine learning models to identify unusual behavior. When abnormal behavior is detected, CloudWatch Alarms alert administrators. When an alarm is triggered, the platform also supports automated responses, such as shutting down unused instances.

In addition to operational tasks, such as capacity and resource planning, this automation extends to administrative tasks as well. Using metrics such as CPU usage, CloudWatch can automatically scale performance.

Azure Monitor

The Azure Monitor service is Azure’s native monitoring tool. As with AWS CloudWatch, it aggregates performance and availability data across the entire Azure ecosystem. The visibility includes both on-premises and cloud environments. CloudWatch’s dashboard appears more cluttered than Azure Monitor’s.

Azure, however, makes things easier by categorizing data into metrics or logs. Finding the relevant data requires a slight learning curve. To detect issues quickly, you may rely on metrics data. When you need to consolidate all the data collected from different sources, you will typically refer to log data.

The Azure platform also offers some automation features, such as auto-scaling resources and security alerts. Azure, however, focuses more on metrics set by users.

Finally, CloudWatch is more focused on improving incident response and reducing the time to resolution. Many users would argue that this is the basis of having a monitoring tool in the first place.

Overall, whilst AWS and Azure do both have very intuitively designed, secure and powerful tools with which to host your architecture, AWS seems to be slightly more user friendly, extensive and resourceful when it comes to making sure your security posture is up to scratch. 

Learn how to Master the AWS Cloud

AWS Training – Our popular AWS training will maximize your chances of passing your AWS certification the first time.
Membership – For unlimited access to our entire cloud training catalog, enroll in our monthly or annual membership program.
Challenge Labs – Build hands-on cloud skills in a secure sandbox environment. Learn, build, test and fail forward without risking unexpected cloud bills.