Cloud Equivalents

Object storage

Amazon S3 access control (IAM, bucket policies, presigned URLs) vs Azure Storage access control (Entra RBAC, SAS, network rules)

S3 IAM policies, bucket policies, and presigned URLs map to Microsoft Entra ID with Azure RBAC data roles, the storage account firewall and private endpoints, and shared access signatures (SAS).

Direct match Use it to: Decide who can read or write objects, from which networks, and hand out short-lived links without sharing credentials.

Last verified: · Edit on GitHub · Report an error

Side-by-side comparison

Object storage access control and temporary sharing links: AWS vs Azure side by side
AspectAmazon Web ServicesMicrosoft Azure
ServiceAmazon S3 access control (IAM, bucket policies, presigned URLs)Azure Storage access control (Entra RBAC, SAS, network rules)
LifecycleGenerally availableGenerally available
What it isAccess is granted by IAM identity policies and bucket policies (ACLs are disabled by default), with Block Public Access, VPC endpoints for network control, and presigned URLs for time-limited sharing.Data access through Microsoft Entra ID with Azure RBAC data roles (and ABAC conditions), shared access signatures for time-limited delegated access, account keys (which can be disallowed), and the storage firewall, private endpoints, and network security perimeter.
Pricing modelNo charge for IAM or bucket policies. Requests are billed normally.No charge for RBAC or SAS. Private endpoints are billed per hour and per GB processed.
DocsAmazon S3 access control (IAM, bucket policies, presigned URLs) docsAzure Storage access control (Entra RBAC, SAS, network rules) docs
Pricing pageAmazon S3 access control (IAM, bucket policies, presigned URLs) pricingAzure Storage access control (Entra RBAC, SAS, network rules) pricing
ExamsSAA-C03 SCS-C03 SOA-C03AZ-104 AZ-305 SC-500

Key differences

  • Resource policies. S3 bucket policies are JSON resource policies that can grant cross-account access and restrict by VPC endpoint or source IP. Azure has no bucket policy. Access is RBAC role assignments (optionally with ABAC conditions) plus account-level network rules.
  • Network control. On AWS, network restriction is usually written into the bucket policy (aws:SourceVpce). On Azure it's the storage firewall, private endpoints, or network security perimeter, configured on the storage account, not per container.
  • Temporary links. A presigned URL is signed with the creator's credentials and lasts up to 7 days. A user delegation SAS is signed with Entra credentials and is the recommended SAS type. Service and account SAS are signed with the account key, so Microsoft recommends disallowing shared key access where possible.
  • Public access. S3 Block Public Access is on by default for new buckets. On Azure, anonymous access is controlled by the account's "Allow Blob anonymous access" setting and each container's public access level.

Pricing summary

Pricing models only. No prices are quoted because they change by region and over time.

AWS
No charge for IAM or bucket policies. Requests are billed normally. Amazon S3 access control (IAM, bucket policies, presigned URLs) pricing →
Azure
No charge for RBAC or SAS. Private endpoints are billed per hour and per GB processed. Azure Storage access control (Entra RBAC, SAS, network rules) pricing →

Certification exam mapping

ExamProviderLevelStatus
AWS Certified Solutions Architect – Associate SAA-C03AWSAssociatecurrent
Italian version retires after Dec 31, 2026.
AWS Certified Security – Specialty SCS-C03AWSSpecialtycurrent
The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026.
AWS Certified CloudOps Engineer – Associate SOA-C03AWSAssociatecurrent
Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026.
Microsoft Certified – Azure Administrator Associate AZ-104AzureAssociatecurrent
Microsoft Certified – Azure Solutions Architect Expert AZ-305AzureExpertcurrent
English version updated Apr 17, 2026.
Microsoft Certified – Cloud and AI Security Engineer Associate SC-500AzureAssociatecurrent
New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta.

Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.

FAQ

What is the Azure equivalent of Amazon S3 access control (IAM, bucket policies, presigned URLs)?

S3 IAM policies, bucket policies, and presigned URLs map to Microsoft Entra ID with Azure RBAC data roles, the storage account firewall and private endpoints, and shared access signatures (SAS).

How does pricing compare between Amazon S3 access control (IAM, bucket policies, presigned URLs) and Azure Storage access control (Entra RBAC, SAS, network rules)?

AWS: No charge for IAM or bucket policies. Requests are billed normally. Azure: No charge for RBAC or SAS. Private endpoints are billed per hour and per GB processed. Check the official pricing pages for current rates.

Which certification exams cover this topic?

AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Security – Specialty (SCS-C03); AWS Certified CloudOps Engineer – Associate (SOA-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Solutions Architect Expert (AZ-305); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).

Related comparisons

Official sources