Microsoft Azure → Amazon Web Services
AWS equivalent of Azure role-based access control (Azure RBAC)
The closest AWS equivalents of Azure role-based access control (Azure RBAC) are AWS Identity and Access Management (IAM) and AWS Resource Access Manager (RAM).
About Azure role-based access control (Azure RBAC)
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Authorizes access to Azure resources by assigning built-in or custom roles to Entra principals at management group, subscription, resource group, or resource scope, with deny assignments and ABAC conditions. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (2)
| Capability | AWS equivalent | Match |
|---|---|---|
| Cloud identity and access management | AWS Identity and Access Management (IAM) | Partial match |
| Share resources across accounts | AWS Resource Access Manager (RAM) | Partial match |
Identity & access management(2)
Cloud identity and access management Partial match
AWS IAM maps to two Azure services. Microsoft Entra ID holds the identities (users, groups, apps, managed identities), and Azure RBAC grants them roles on resources. AWS IAM does both jobs inside each account.
- Where identities live. IAM users and roles live in each AWS account (workforce users usually come through Identity Center). Entra ID is one tenant-wide directory shared by Azure, Microsoft 365, and your apps.
- Policy model. IAM uses JSON policies attached to identities or resources, with explicit deny, conditions, and permissions boundaries. Azure RBAC assigns roles (sets of actions) at a scope that inherits downward, with deny assignments and attribute-based conditions in limited cases.
- Data plane. Some Azure services use separate data-plane roles (for example, Storage Blob Data Reader or Key Vault Secrets User). IAM actions cover both management and data APIs.
Share resources across accounts Partial match
Microsoft maps AWS Resource Access Manager to Azure RBAC. Because Azure subscriptions share one Entra tenant, you usually share by granting roles on a resource, rather than by creating resource shares.
- On AWS, accounts are hard boundaries, so RAM explicitly shares subnets, transit gateways, and similar resources. On Azure, cross-subscription access works through role assignments in the same tenant, and some services have their own sharing (for example, Azure Compute Gallery or virtual network peering).