Networking & Content Delivery: AWS to Azure service map
40 AWS → Azure mappings: 24 direct, 15 partial, 1 with no equivalent.
Virtual networks, subnets, routing, internet egress, network security and firewalls, hybrid connectivity, private service access, DNS, load balancing, CDN and edge compute, and network monitoring. AWS mapped to Azure, verified against official docs.
Virtual networks, subnets & IP addressing(4)
Private virtual network Direct match
Amazon VPC maps to Azure Virtual Network (VNet). Both are regional, isolated networks with your own IPv4 and IPv6 address space, divided into subnets with routing and security controls.
Subnets and availability zone placement Partial match
VPC subnets map to Azure virtual network subnets, but placement differs. AWS subnets belong to one Availability Zone, while Azure subnets are regional and you pick the zone per resource.
Static public IP addresses Direct match
Elastic IP addresses map to Azure Standard public IP addresses. Public IP prefixes give contiguous ranges, and custom IP prefixes let you bring your own ranges (like AWS BYOIP).
IP address management (IPAM) Partial match
Amazon VPC IPAM maps to IP address management in Azure Virtual Network Manager, which allocates non-overlapping ranges from IP address pools.
Routing & internet access(4)
Custom route tables Direct match
VPC route tables map to Azure user-defined routes (UDRs) in route tables associated with subnets.
BGP routing with network appliances Direct match
Amazon VPC Route Server maps to Azure Route Server. Both peer with your appliances over BGP and program the learned routes into the virtual network.
Internet gateway (inbound and outbound internet access) Partial match
Azure has no internet gateway resource. Resources reach the internet through a public IP, NAT Gateway, load balancer outbound rules, or Azure Firewall. Default outbound access (implicit internet access for VMs) is being phased out with private subnets.
Managed NAT for outbound traffic Direct match
AWS NAT gateway maps to Azure NAT Gateway. Both give private subnets outbound-only internet access from static public IPs.
Network security & firewalls(7)
Stateful instance-level firewall rules Direct match
Security groups map to Azure network security groups (NSGs), with application security groups (ASGs) standing in for rules that reference other security groups.
Stateless subnet access control lists Partial match
Azure has no stateless network ACL. The closest option is an NSG associated with the subnet, which is stateful and supports deny rules. Virtual Network Manager security admin rules can enforce organization-wide rules that override NSGs.
Block internet access at the account level Partial match
VPC Block Public Access has no single Azure switch. The closest combination is private subnets (no default outbound access) plus Azure Policy rules that deny public IPs and internet-facing resources.
Managed network firewall Direct match
AWS Network Firewall maps to Azure Firewall. Both are managed, stateful, autoscaling firewalls with domain filtering, threat intelligence, and intrusion prevention.
Web application firewall (WAF) Direct match
AWS WAF maps to Azure Web Application Firewall, which runs on Application Gateway (regional) or Front Door (global).
DDoS protection Direct match
AWS Shield maps to Azure DDoS Protection. Both include free, always-on baseline protection (Shield Standard and Azure infrastructure DDoS protection) and a paid tier (Shield Advanced, and DDoS Network Protection or IP Protection).
Central firewall and security policy management Partial match
AWS Firewall Manager maps to Azure Firewall Manager for firewall policies. Azure Policy fills the gap for enforcing WAF, DDoS, and NSG settings across subscriptions.
Network-to-network & hybrid connectivity(7)
Network peering Direct match
VPC peering maps to virtual network peering (local or global). Both are non-transitive and route over the provider's backbone.
Hub-and-spoke transit routing Partial match
AWS Transit Gateway maps to Azure Virtual WAN. Many Azure designs instead build a customer-managed hub virtual network (with Azure Firewall or an NVA, plus gateways), optionally deployed with Virtual Network Manager.
Policy-defined global WAN Partial match
AWS Cloud WAN maps most closely to Azure Virtual WAN, with Virtual Network Manager for policy-based grouping and security rules.
Site-to-site IPsec VPN Direct match
AWS Site-to-Site VPN maps to Azure VPN Gateway (or VPN in a Virtual WAN hub).
Remote-access (client) VPN Direct match
AWS Client VPN maps to point-to-site VPN on Azure VPN Gateway (or user VPN in Virtual WAN).
Dedicated private connection to the cloud Direct match
AWS Direct Connect maps to Azure ExpressRoute. Both offer provider-hosted circuits and direct ports at colocation facilities.
Private circuits spanning regions and sites Partial match
Microsoft maps Direct Connect gateways to ExpressRoute Global Reach. The closest AWS feature for linking your own sites over the cloud backbone is Direct Connect SiteLink, which works through a Direct Connect gateway. A Direct Connect gateway also connects one circuit to VPCs and transit gateways in many Regions.
Private access to services(3)
Private endpoints for cloud and partner services Direct match
AWS PrivateLink (interface VPC endpoints and endpoint services) maps to Azure Private Link (private endpoints and Private Link services).
Free backbone access to storage services Partial match
Gateway VPC endpoints (for S3 and DynamoDB) map most closely to Azure virtual network service endpoints. Both are free, use route or subnet configuration rather than an IP in your network, and let the service lock access to your network.
Service-to-service application networking Partial match
Microsoft states there's no single Azure equivalent of Amazon VPC Lattice. Depending on the scenario, combine Private Link (private access to services), Application Gateway for Containers (layer 7 routing for AKS), and API Management (centralized exposure and policy).
DNS & DNS-based routing(5)
Public authoritative DNS hosting Direct match
Route 53 public hosted zones map to Azure DNS public zones. Both support DNSSEC and alias records that point at cloud resources.
Private DNS zones Direct match
Route 53 private hosted zones map to Azure Private DNS zones, linked to virtual networks.
Hybrid DNS resolution Direct match
Route 53 Resolver endpoints and forwarding rules map to Azure DNS Private Resolver inbound and outbound endpoints with forwarding rulesets.
DNS query filtering Direct match
Route 53 Resolver DNS Firewall maps to Azure DNS resolver policy, which can use a Microsoft-managed threat intelligence feed.
DNS-based traffic routing and failover Direct match
Route 53 routing policies and health checks map to Azure Traffic Manager.
Load balancing(3)
Layer 7 (HTTP/HTTPS) load balancing Direct match
Application Load Balancer maps to Azure Application Gateway v2 (with an optional WAF). For AKS, Application Gateway for Containers is the Kubernetes-native option. Application Gateway v1 retired on April 28, 2026.
Layer 4 (TCP/UDP) load balancing Direct match
Network Load Balancer maps to Azure Load Balancer (Standard). Basic Load Balancer retired on September 30, 2025.
Transparent load balancing for network appliances Direct match
Gateway Load Balancer maps to Azure Gateway Load Balancer. Both transparently steer traffic through a pool of virtual appliances using encapsulation.
CDN, edge compute & global acceleration(4)
Content delivery network (CDN) Direct match
Amazon CloudFront maps to Azure Front Door (Standard or Premium), which combines CDN caching with global layer 7 load balancing and WAF. Front Door (classic) retires March 31, 2027, Azure CDN Standard from Microsoft (classic) retires September 30, 2027, and Azure CDN from Edgio shut down on January 15, 2025.
Lightweight edge request logic Partial match
CloudFront Functions maps to Azure Front Door rule sets (no-code rules) and Front Door edge actions (custom JavaScript, in preview).
Full serverless functions at the CDN edge No equivalent
Azure has no equivalent of Lambda@Edge. Front Door edge actions (preview) covers lightweight request logic only, so heavier logic usually runs in Azure Functions or Container Apps in one or more regions behind Front Door.
Global anycast entry point for TCP/UDP apps Partial match
AWS Global Accelerator maps to the Azure global (cross-region) load balancer for layer 4, or Front Door for HTTP(S). Microsoft says the global load balancer most closely matches Global Accelerator's layer 4 behavior.
Network monitoring & diagnostics(3)
Network flow logs Direct match
VPC Flow Logs maps to virtual network flow logs in Azure Network Watcher. NSG flow logs, the older option, can't be created anymore and retire on September 30, 2027.
Network path and access analysis Partial match
VPC Reachability Analyzer and Network Access Analyzer map to Azure Network Watcher tools such as connection troubleshoot, IP flow verify, next hop, and effective security rules.
Packet mirroring Partial match
VPC Traffic Mirroring maps to Azure virtual network TAP, which was in public preview in select regions when verified. For one-off captures, Network Watcher packet capture is generally available.