Microsoft Azure → Amazon Web Services
AWS equivalent of Network security groups and application security groups
The closest AWS equivalents of Network security groups and application security groups are Security groups and Network ACLs.
About Network security groups and application security groups
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Stateful, prioritized allow and deny rules applied to subnets or network interfaces. Application security groups let rules target groups of VMs instead of IP ranges. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (2)
| Capability | AWS equivalent | Match |
|---|---|---|
| Stateful instance-level firewall rules | Security groups | Direct match |
| Stateless subnet access control lists | Network ACLs | Partial match |
Network security & firewalls(2)
Stateful instance-level firewall rules Direct match
Security groups map to Azure network security groups (NSGs), with application security groups (ASGs) standing in for rules that reference other security groups.
- Rule types. Security groups have allow rules only (everything else is denied). NSGs have prioritized allow and deny rules, plus default rules that allow traffic within the virtual network and from the load balancer.
- Attachment. Security groups attach to network interfaces. NSGs attach to subnets, NICs, or both, and both levels are evaluated.
- References. Security group rules can reference other security groups. NSG rules reference ASGs or service tags (such as Storage or AzureLoadBalancer).
Stateless subnet access control lists Partial match
Azure has no stateless network ACL. The closest option is an NSG associated with the subnet, which is stateful and supports deny rules. Virtual Network Manager security admin rules can enforce organization-wide rules that override NSGs.
- Statefulness. Network ACLs are stateless, so return traffic needs its own rule (including ephemeral ports). NSGs are stateful.
- Central rules. Virtual Network Manager security admin rules apply across many virtual networks and are evaluated before NSGs, which is useful for guardrails like blocking high-risk ports.