Amazon Web Services → Microsoft Azure
Azure equivalent of Network ACLs
Azure has no stateless network ACL.
About Network ACLs
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Stateless, numbered allow and deny rules applied at the subnet boundary, evaluated in order for inbound and outbound traffic. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Stateless subnet access control lists | Network security groups and application security groups, Azure Virtual Network Manager | Partial match |
Network security & firewalls(1)
Stateless subnet access control lists Partial match
Azure has no stateless network ACL. The closest option is an NSG associated with the subnet, which is stateful and supports deny rules. Virtual Network Manager security admin rules can enforce organization-wide rules that override NSGs.
- Statefulness. Network ACLs are stateless, so return traffic needs its own rule (including ephemeral ports). NSGs are stateful.
- Central rules. Virtual Network Manager security admin rules apply across many virtual networks and are evaluated before NSGs, which is useful for guardrails like blocking high-risk ports.