Network-to-network & hybrid connectivity
AWS Site-to-Site VPN vs Azure VPN Gateway (site-to-site)
AWS Site-to-Site VPN maps to Azure VPN Gateway (or VPN in a Virtual WAN hub).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Site-to-Site VPN | Azure VPN Gateway (site-to-site) |
| Lifecycle | Generally available | Generally available |
| What it is | IPsec VPN connections with two tunnels each, terminating on a virtual private gateway, transit gateway, or Cloud WAN. Large bandwidth tunnels (up to 5 Gbps) are available on Transit Gateway and Cloud WAN. | IPsec/IKE VPN gateways for site-to-site and VNet-to-VNet connections, in active-standby or active-active mode, with route-based or policy-based VPNs. Microsoft is moving all SKUs to zone-redundant (AZ) SKUs. |
| Pricing model | Per VPN connection-hour plus data transfer out. | Per gateway-hour by SKU plus data transfer out (and per-tunnel fees beyond the included number). |
| Docs | AWS Site-to-Site VPN docs | Azure VPN Gateway (site-to-site) docs |
| Pricing page | AWS Site-to-Site VPN pricing | Azure VPN Gateway (site-to-site) pricing |
| Exams | SAA-C03 ANS-C01 Retiring | AZ-104 AZ-700 |
Key differences
- Throughput. Standard AWS tunnels support up to 1.25 Gbps each, and large bandwidth tunnels (Transit Gateway or Cloud WAN) up to 5 Gbps. Azure VPN Gateway SKUs range up to 10 Gbps aggregate on the largest SKUs.
- Form factor. An AWS VPN connection is a managed resource with two tunnels and no gateway VM to size. Azure VPN Gateway is a gateway you deploy into a GatewaySubnet and size by SKU, in active-standby or active-active mode. Microsoft is moving all VPN Gateway SKUs to zone-redundant AZ SKUs.
- Policy-based VPNs. Azure supports both route-based and policy-based VPNs. AWS VPNs are route-based (static or BGP).
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per VPN connection-hour plus data transfer out. AWS Site-to-Site VPN pricing →
- Azure
- Per gateway-hour by SKU plus data transfer out (and per-tunnel fees beyond the included number). Azure VPN Gateway (site-to-site) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
Verification notes
- Azure VPN Gateway non-AZ SKUs are being consolidated into AZ SKUs. Check the migration timeline before choosing a SKU.
FAQ
What is the Azure equivalent of AWS Site-to-Site VPN?
AWS Site-to-Site VPN maps to Azure VPN Gateway (or VPN in a Virtual WAN hub).
How does pricing compare between AWS Site-to-Site VPN and Azure VPN Gateway (site-to-site)?
AWS: Per VPN connection-hour plus data transfer out. Azure: Per gateway-hour by SKU plus data transfer out (and per-tunnel fees beyond the included number). Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Network Engineer Associate (AZ-700).