Compare AWS and Azure networking options

This article compares the core networking services that Azure and Amazon Web Services (AWS) offer.

For links to articles that compare other AWS and Azure services and a complete service mapping between AWS and Azure, see Azure for AWS professionals.

Azure virtual networks and AWS VPCs

Azure virtual networks and AWS virtual private clouds (VPCs) are similar in that they both provide isolated, logically defined network spaces within their respective cloud platforms. There are, however, key differences in terms of architecture, features, and integration.

• Subnet placement. In AWS, each subnet is bound to a single Availability Zone, so achieving zonal redundancy requires creating one subnet per Availability Zone. In Azure, a subnet is a regional construct that spans all availability zones in the region. Resources deployed into the same subnet can reside in different availability zones and use the same subnet CIDR or address space. If you redeploy or move a given resource into a different availability zone, the resource's private IP address might or might not be preserved, depending on the resource type and how you redeploy or move it.

• Security models. AWS layers stateful security groups (attached to ENIs) with stateless network ACLs (applied at the subnet boundary). Azure uses stateful network security groups (NSGs), which can be applied at the subnet or NIC level, and application security groups, which you can use to create NSG rules by using logical workload tags instead of IP ranges. The latter approach is conceptually similar to AWS security groups that reference other security groups. For deeper inspection, Azure Firewall provides a managed, stateful, cloud-native firewall with FQDN filtering, threat intelligence, and optional IDPS/TLS inspection, similar to AWS Network Firewall.

• Peering. Both Azure and AWS support virtual network / VPC peering. Both technologies allow more complex peering via Azure Virtual WAN or AWS Transit Gateway.

VPN

Both AWS Site-to-Site VPN and Azure VPN Gateway are robust solutions for connecting on-premises networks to the cloud. They provide similar features, but there's a notable difference with performance. VPN Gateway offers higher throughput for certain configurations (up to 10 Gbps), whereas Site-to-Site VPN generally ranges between 1.25 Gbps and 5 Gbps per connection (using ECMP).

Elastic Load Balancing, Azure Load Balancer, and Azure Application Gateway

The Azure equivalents of the Elastic Load Balancing services are:

• Load Balancer provides the same network layer 4 capabilities as the AWS Network Load Balancer, so you can distribute traffic for multiple VMs at the network level. It also provides failover capability.

• Application Gateway provides application-level rule-based routing comparable to that of the AWS Application Load Balancer.

Route 53, Azure DNS, and Azure Traffic Manager

In AWS, Route 53 provides both DNS name management and DNS-level traffic routing and failover services. In Azure, two services handle these tasks:

• Azure DNS provides domain and DNS management.

• Traffic Manager provides DNS-level traffic routing, load balancing, and failover capabilities.

AWS Direct Connect and Azure ExpressRoute

AWS Direct Connect can link a network directly to AWS. Azure provides similar site-to-site dedicated connections through ExpressRoute. You can use ExpressRoute to connect your local network directly to Azure resources by using a dedicated private network connection. Both Azure and AWS offer site-to-site VPN connections.

Route tables

AWS route tables contain routes that direct traffic from a subnet or gateway subnet to the destination. In Azure, the corresponding feature is called user-defined routes.

With user-defined routes, you can create custom or user-defined (static) routes. These routes override the default Azure system routes. You can also add more routes to a subnet's route table.

Azure Private Link

Private Link is similar to AWS PrivateLink. Azure Private Link provides private connectivity from a virtual network to an Azure platform as a service (PaaS) solution, a customer-owned service, or a Microsoft partner service.

VPC peering and virtual network peering

In AWS, a VPC peering connection is a networking connection between two VPCs. You can use this connection to route traffic between the VPCs by using private Internet Protocol version 4 (IPv4) addresses or Internet Protocol version 6 (IPv6) addresses.

You can use Azure virtual network peering to connect two or more virtual networks in Azure. For connectivity purposes, the virtual networks appear as one. The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure. Like traffic between virtual machines in a single network, traffic is routed only through the Microsoft private network.

Neither virtual networks nor VPCs allow transitive peering. In Azure, however, you can achieve transitive networking by using network virtual appliances (NVAs) or gateways in the hub virtual network.

Network service comparison

Networking architectures

View all networking architectures.

Migration

If you plan to migrate an AWS workload to Azure, see Migrate networking from Amazon Web Services to Azure, which includes some specific example migration scenarios that might align to your use case.

Contributors

Microsoft maintains this article. The following contributors wrote this article.

Principal author:

• Konstantin Rekatas | Principal Cloud Solution Architect

Other contributors:

• Adam Cerini | Director, Partner Technology Strategist
• Juan Carlos Osorio | Cloud Solution Architect

To see nonpublic LinkedIn profiles, sign in to LinkedIn.

Next steps

• Create a virtual network by using the Azure portal
• Plan and design Azure virtual networks
• Azure network security best practices

Related resources

• Compare AWS and Azure resource management
• Compare AWS and Azure accounts