Amazon Web Services → Microsoft Azure
Azure equivalent of Service control policies and resource control policies
Service control policies (and resource control policies) map most closely to Azure Policy assigned at management groups, which can deny, audit, or fix resource configurations.
About Service control policies and resource control policies
| Provider | Amazon Web Services |
|---|---|
| Status | Generally available |
| What it is | Organization guardrails. SCPs cap the maximum permissions of principals in member accounts, and RCPs cap the permissions that can be granted on supported resources. |
| Documentation | docs.aws.amazon.com |
| Pricing | Official pricing page |
Azure mappings (1)
| Capability | Azure equivalent | Match |
|---|---|---|
| Organization-wide guardrail policies | Azure Policy | Partial match |
Multi-account governance & guardrails(1)
Organization-wide guardrail policies Partial match
Service control policies (and resource control policies) map most closely to Azure Policy assigned at management groups, which can deny, audit, or fix resource configurations. Azure RBAC deny assignments cover only limited scenarios.
- What's controlled. SCPs limit which API actions principals in member accounts can call, and RCPs limit what can be granted on resources (for example, blocking external access to S3). Azure Policy evaluates resource properties at deployment and continuously, so it can deny a public IP or require tags, but it doesn't restrict which management actions an identity may call in general.
- Remediation. Azure Policy can modify resources or deploy missing settings (deployIfNotExists), with compliance reports. SCPs only allow or deny, and AWS uses Config rules or Control Tower proactive controls for configuration checks.