Network security & firewalls
VPC Block Public Access vs Private subnets (default outbound access off)
VPC Block Public Access has no single Azure switch.
The closest combination is private subnets (no default outbound access) plus Azure Policy rules that deny public IPs and internet-facing resources.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | VPC Block Public Access | Private subnets (default outbound access off) |
| Lifecycle | Generally available | Generally available |
| What it is | Account- or Region-wide switch that blocks internet gateway traffic to and from VPCs and subnets, with exclusions for subnets that need it. | Subnets with default outbound access turned off, so VMs need an explicit outbound method (NAT Gateway, Standard Load Balancer outbound rules, public IP, or firewall). New virtual networks created with API versions released after March 31, 2026 default to private subnets. |
| Pricing model | Free. | Private subnets and Azure Policy are free. |
| Docs | VPC Block Public Access docs | Private subnets (default outbound access off) docs |
| Pricing page | VPC Block Public Access pricing | Private subnets (default outbound access off) pricing |
| Exams | SCS-C03 ANS-C01 Retiring | AZ-700 SC-500 |
Key differences
- VPC Block Public Access blocks internet gateway traffic for an account and Region in one setting, with exclusions per VPC or subnet. On Azure, the guardrail is assembled from private subnets, policies, NSG or security admin rules, and routing through Azure Firewall.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Free. VPC Block Public Access pricing →
- Azure
- Private subnets and Azure Policy are free. Private subnets (default outbound access off) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Advanced Networking – Specialty ANS-C01 | AWS | Specialty | retiring The exam is being retired. The last day to take it is Dec 31, 2026. Existing certifications stay active for their three-year period. |
| Microsoft Certified – Azure Network Engineer Associate AZ-700 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of VPC Block Public Access?
VPC Block Public Access has no single Azure switch. The closest combination is private subnets (no default outbound access) plus Azure Policy rules that deny public IPs and internet-facing resources.
How does pricing compare between VPC Block Public Access and Private subnets (default outbound access off)?
AWS: Free. Azure: Private subnets and Azure Policy are free. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); AWS Certified Advanced Networking – Specialty (ANS-C01) [retiring]; Microsoft Certified – Azure Network Engineer Associate (AZ-700); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).