Microsoft Azure → Amazon Web Services
AWS equivalent of Azure Virtual Network Manager
The closest AWS equivalents of Azure Virtual Network Manager are Amazon VPC IP Address Manager (IPAM), Network ACLs, AWS Transit Gateway and AWS Cloud WAN.
About Azure Virtual Network Manager
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Centrally groups virtual networks across subscriptions and regions to deploy connectivity (mesh or hub-and-spoke), security admin rules, routing, and IP address management (IPAM) pools. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (4)
| Capability | AWS equivalent | Match |
|---|---|---|
| IP address management (IPAM) | Amazon VPC IP Address Manager (IPAM) | Partial match |
| Stateless subnet access control lists | Network ACLs | Partial match |
| Hub-and-spoke transit routing | AWS Transit Gateway | Partial match |
| Policy-defined global WAN | AWS Cloud WAN | Partial match |
Virtual networks, subnets & IP addressing(1)
IP address management (IPAM) Partial match
Amazon VPC IPAM maps to IP address management in Azure Virtual Network Manager, which allocates non-overlapping ranges from IP address pools.
- Scope. VPC IPAM integrates with AWS Organizations, monitors compliance, tracks public IPs, and keeps historical IP data. Azure IPAM is one feature of Virtual Network Manager, which also deploys connectivity and security admin rules.
Network security & firewalls(1)
Stateless subnet access control lists Partial match
Azure has no stateless network ACL. The closest option is an NSG associated with the subnet, which is stateful and supports deny rules. Virtual Network Manager security admin rules can enforce organization-wide rules that override NSGs.
- Statefulness. Network ACLs are stateless, so return traffic needs its own rule (including ephemeral ports). NSGs are stateful.
- Central rules. Virtual Network Manager security admin rules apply across many virtual networks and are evaluated before NSGs, which is useful for guardrails like blocking high-risk ports.
Network-to-network & hybrid connectivity(2)
Hub-and-spoke transit routing Partial match
AWS Transit Gateway maps to Azure Virtual WAN. Many Azure designs instead build a customer-managed hub virtual network (with Azure Firewall or an NVA, plus gateways), optionally deployed with Virtual Network Manager.
- Scope. Transit Gateway is regional and peers with other transit gateways across Regions. Virtual WAN hubs in a Standard virtual WAN are fully meshed across regions automatically.
- Security. Virtual WAN can host Azure Firewall or partner NVAs in secured hubs, managed through Firewall Manager. On AWS, inspection usually uses an inspection VPC with Network Firewall or a Gateway Load Balancer, or native Network Firewall attachments.
- Routes. Microsoft's comparison notes that Transit Gateway allows 100 BGP prefixes per attachment, while Virtual WAN private peering allows 1,000. Check current quotas for your design.
Policy-defined global WAN Partial match
AWS Cloud WAN maps most closely to Azure Virtual WAN, with Virtual Network Manager for policy-based grouping and security rules.
- Policy model. Cloud WAN is driven by a single JSON core network policy that defines Regions, segments, and attachment rules. Virtual WAN uses hubs, route tables, and routing intent; Virtual Network Manager adds network groups and admin rules.
- Segmentation. Cloud WAN segments are global routing domains. Virtual WAN segments with custom route tables and labels in each hub.