Microsoft Azure → Amazon Web Services
AWS equivalent of Azure Storage access control (Entra RBAC, SAS, network rules)
The closest AWS equivalent of Azure Storage access control (Entra RBAC, SAS, network rules) is Amazon S3 access control (IAM, bucket policies, presigned URLs).
About Azure Storage access control (Entra RBAC, SAS, network rules)
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Data access through Microsoft Entra ID with Azure RBAC data roles (and ABAC conditions), shared access signatures for time-limited delegated access, account keys (which can be disallowed), and the storage firewall, private endpoints, and network security perimeter. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| Object storage access control and temporary sharing links | Amazon S3 access control (IAM, bucket policies, presigned URLs) | Direct match |
Object storage(1)
Object storage access control and temporary sharing links Direct match
S3 IAM policies, bucket policies, and presigned URLs map to Microsoft Entra ID with Azure RBAC data roles, the storage account firewall and private endpoints, and shared access signatures (SAS).
- Resource policies. S3 bucket policies are JSON resource policies that can grant cross-account access and restrict by VPC endpoint or source IP. Azure has no bucket policy. Access is RBAC role assignments (optionally with ABAC conditions) plus account-level network rules.
- Network control. On AWS, network restriction is usually written into the bucket policy (aws:SourceVpce). On Azure it's the storage firewall, private endpoints, or network security perimeter, configured on the storage account, not per container.
- Temporary links. A presigned URL is signed with the creator's credentials and lasts up to 7 days. A user delegation SAS is signed with Entra credentials and is the recommended SAS type. Service and account SAS are signed with the account key, so Microsoft recommends disallowing shared key access where possible.