Microsoft Azure → Amazon Web Services
AWS equivalent of Azure Policy
The closest AWS equivalents of Azure Policy are Service control policies and resource control policies and AWS Config.
About Azure Policy
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Evaluates and enforces rules on Azure resources (deny, audit, modify, deployIfNotExists), grouped into initiatives and assigned at any scope, with compliance reporting and remediation. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (2)
| Capability | AWS equivalent | Match |
|---|---|---|
| Organization-wide guardrail policies | Service control policies and resource control policies | Partial match |
| Resource configuration history and compliance rules | AWS Config | Partial match |
Multi-account governance & guardrails(1)
Organization-wide guardrail policies Partial match
Service control policies (and resource control policies) map most closely to Azure Policy assigned at management groups, which can deny, audit, or fix resource configurations. Azure RBAC deny assignments cover only limited scenarios.
- What's controlled. SCPs limit which API actions principals in member accounts can call, and RCPs limit what can be granted on resources (for example, blocking external access to S3). Azure Policy evaluates resource properties at deployment and continuously, so it can deny a public IP or require tags, but it doesn't restrict which management actions an identity may call in general.
- Remediation. Azure Policy can modify resources or deploy missing settings (deployIfNotExists), with compliance reports. SCPs only allow or deny, and AWS uses Config rules or Control Tower proactive controls for configuration checks.
Audit, configuration & compliance(1)
Resource configuration history and compliance rules Partial match
AWS Config maps to a combination of Azure Policy (compliance evaluation and remediation) and Azure Resource Graph (inventory and change history).
- Recording. Config records configuration items and relationships continuously for the resource types you select, with history you can keep for years. Resource Graph change analysis covers recent property changes, so long-term history needs exports.
- Rules. Config rules (managed or custom Lambda or Guard) and conformance packs map to Azure Policy definitions and initiatives. Azure Policy can also block non-compliant deployments up front.