Amazon Web Services → Microsoft Azure
Azure equivalent of Amazon S3 access control (IAM, bucket policies, presigned URLs)
S3 IAM policies, bucket policies, and presigned URLs map to Microsoft Entra ID with Azure RBAC data roles, the storage account firewall and private endpoints, and shared access signatures (SAS).
About Amazon S3 access control (IAM, bucket policies, presigned URLs)
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Access is granted by IAM identity policies and bucket policies (ACLs are disabled by default), with Block Public Access, VPC endpoints for network control, and presigned URLs for time-limited sharing. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Object storage access control and temporary sharing links | Azure Storage access control (Entra RBAC, SAS, network rules) | Direct match |
Object storage(1)
Object storage access control and temporary sharing links Direct match
S3 IAM policies, bucket policies, and presigned URLs map to Microsoft Entra ID with Azure RBAC data roles, the storage account firewall and private endpoints, and shared access signatures (SAS).
- Resource policies. S3 bucket policies are JSON resource policies that can grant cross-account access and restrict by VPC endpoint or source IP. Azure has no bucket policy. Access is RBAC role assignments (optionally with ABAC conditions) plus account-level network rules.
- Network control. On AWS, network restriction is usually written into the bucket policy (aws:SourceVpce). On Azure it's the storage firewall, private endpoints, or network security perimeter, configured on the storage account, not per container.
- Temporary links. A presigned URL is signed with the creator's credentials and lasts up to 7 days. A user delegation SAS is signed with Entra credentials and is the recommended SAS type. Service and account SAS are signed with the account key, so Microsoft recommends disallowing shared key access where possible.