Google Cloud services and their AWS equivalents
216 GCP services mapped to AWS across 7 categories, including retired and maintenance-mode services.
Google Cloud mappings cover all 7 categories.
Compute(28)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| App Engine | Fully managed serverless platform for web apps, in standard (sandboxed runtimes, scale to zero) and flexible (containers on VMs) environments. | AWS Elastic Beanstalk |
| Batch | Fully managed service to schedule, queue, and run batch jobs on Compute Engine VMs, with no separate charge beyond the resources used. | AWS Batch |
| Cloud RDMA (RoCE VPC networks) | RDMA over Converged Ethernet v2 network profiles for HPC (for example H4D) and GPU machine series. | Elastic Fabric Adapter (EFA) |
| Cloud Run | Fully managed platform for running containers, functions, and source code as services, jobs, or worker pools, with request-based autoscaling and scale to zero. | AWS Elastic Beanstalk, Amazon ECS, AWS Fargate, Amazon ECS Express Mode, AWS App Runner, Lambda provisioned concurrency, Lambda SnapStart, AWS Lambda Web Functions, Lambda Managed Instances |
| Cluster Toolkit | Open-source tool with blueprints to deploy HPC, AI, and ML clusters (including Slurm and GKE) on Google Cloud. | AWS ParallelCluster, AWS Parallel Computing Service (PCS) |
| Compute Engine | Google Cloud's IaaS for virtual machine and bare metal instances, with per-second billing and live migration during host maintenance. | Amazon EC2 |
| Compute Engine bare metal instances | Bare metal machine types (for example C3, C4, C4A, C4D, X4, and Z3 metal) with direct access to the host CPU and memory, managed like other Compute Engine… | Amazon EC2 bare metal instances |
| Compute Engine custom images and machine images | Custom OS images (boot disk images, grouped into image families) and machine images (all disks plus instance configuration), shareable across projects with IAM. | Amazon Machine Images (AMIs) |
| Compute Engine machine families and machine types | General-purpose, compute-optimized, memory-optimized, storage-optimized, and accelerator-optimized machine series, plus custom machine types. | Amazon EC2 instance types |
| Compute Engine placement policies | Compact policies place instances close together for low latency; spread policies place them apart for resilience. | EC2 placement groups |
| Compute Engine reservations | Reserve zonal capacity for specific machine types, consumed automatically by matching VMs or only by VMs that target the reservation. Future reservations can… | EC2 On-Demand Capacity Reservations |
| Compute Engine suspend and resume | Saves an instance's memory to storage and stops it, then restores it on resume. An instance can stay suspended for up to 60 days. | Amazon EC2 hibernation |
| Compute flexible committed use discounts (spend-based) | Commit to a minimum hourly spend on eligible compute for 1 or 3 years, applied across machine series, regions, and projects in the billing account. | Savings Plans (Compute & EC2 Instance) |
| Confidential Space | Attested, isolated environment built on Confidential VM for processing sensitive data from multiple parties. | AWS Nitro Enclaves, AMD SEV-SNP on Amazon EC2 |
| Confidential VM | Compute Engine VMs with hardware memory encryption using AMD SEV, AMD SEV-SNP, or Intel TDX. | AWS Nitro Enclaves, AMD SEV-SNP on Amazon EC2 |
| Google Axion Arm VMs (N4A, C4A) | Compute Engine machine series on Google's Axion Arm processor. N4A uses Arm Neoverse N3 cores and C4A uses Neoverse V2 cores. | AWS Graviton (Arm-based EC2) |
| Google Cloud VMware Engine | Fully managed VMware private clouds (vSphere, vSAN, NSX) running on dedicated Google Cloud bare metal nodes. | Amazon Elastic VMware Service (EVS) |
| Google Distributed Cloud connected | Google-certified hardware installed on your premises that runs GKE clusters (containers and VMs), managed from Google Cloud. | AWS Outposts (racks & servers) |
| Identity-Aware Proxy TCP forwarding | Tunnels SSH, RDP, and other TCP traffic to VMs through IAP after an IAM check, so VMs don't need external IP addresses. | AWS Systems Manager Session Manager, EC2 Instance Connect Endpoint |
| Machine type recommendations (Active Assist) | Rightsizing recommendations for VMs and managed instance groups, generated from the last 8 days of Cloud Monitoring metrics. Part of the Recommender / Active… | AWS Compute Optimizer |
| Managed instance groups (MIGs) and autoscaler | Groups of identical VMs built from an instance template, with autoscaling, autohealing, rolling updates, and zonal or regional distribution. | Amazon EC2 Auto Scaling |
| OS Login | Manages Linux SSH access to VMs with IAM roles instead of per-instance SSH keys. | AWS Systems Manager Session Manager, EC2 Instance Connect Endpoint |
| Packer with Cloud Build | Google-documented pattern for building Compute Engine images with HashiCorp Packer running in Cloud Build. Not a dedicated managed image service. | EC2 Image Builder |
| Resource-based committed use discounts | Commit to a quantity of vCPUs, memory, GPUs, or local SSD in a region for 1 or 3 years. Sustained use discounts also apply automatically to some series. | Amazon EC2 Reserved Instances |
| Shielded VM | Secure Boot, virtual Trusted Platform Module (vTPM), and integrity monitoring for Compute Engine VMs. | NitroTPM & UEFI Secure Boot |
| Sole-tenant nodes | Physical Compute Engine servers dedicated to your project's VMs, used for isolation and bring-your-own-license needs. | Amazon EC2 Dedicated Hosts & Dedicated Instances, AWS License Manager |
| Spot VMs | Deeply discounted excess capacity that Compute Engine can preempt at any time, with no maximum runtime. The successor to preemptible VMs. | Amazon EC2 Spot Instances |
| VM Manager Patch | Schedules and runs OS patch jobs across Compute Engine VMs and reports patch compliance, through the OS Config agent. | AWS Systems Manager Patch Manager |
Containers & Serverless(22)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| Agent Sandbox on GKE | Isolated environments (gVisor-based GKE Sandbox) for executing untrusted or AI-generated code on GKE, at no extra charge beyond GKE resources. | AWS Lambda MicroVMs |
| API Gateway | Managed gateway for serverless backends (Cloud Run, Cloud Run functions, App Engine) defined with OpenAPI specs. | Amazon API Gateway |
| Apigee | Full API management platform with policies, developer portal, analytics, and monetization. | Amazon API Gateway |
| Artifact Registry | Regional and multi-regional repositories for container images and other build artifacts and dependencies, with container vulnerability scanning. | Amazon ECR |
| Cloud Run functions (formerly Cloud Functions) | Event-driven and HTTP functions deployed from source on Cloud Run, using the Functions Framework and Eventarc triggers. | AWS Lambda (Event Functions), Lambda function URLs |
| Cloud Scheduler | Managed cron service that triggers HTTP targets, Pub/Sub topics, and other targets on a schedule. | Amazon EventBridge Scheduler |
| Cloud Service Mesh | Managed service mesh built on the open-source Istio APIs for GKE and other supported platforms, with mTLS, traffic management, and telemetry. | Amazon ECS Service Connect, AWS App Mesh, Amazon VPC Lattice |
| Cloud Tasks | Managed task queues that dispatch work to HTTP or App Engine targets with rate limits, retries, and scheduled delivery. | Amazon SQS |
| Config Controller (Config Connector) | Hosted Config Connector, Config Sync, and Policy Controller for managing Google Cloud resources as Kubernetes objects. | Amazon EKS Capabilities (Argo CD, ACK, kro) |
| Config Sync | GitOps service that syncs Kubernetes configuration and policies to clusters from a central source of truth such as a Git repository. | Amazon EKS Capabilities (Argo CD, ACK, kro) |
| Eventarc (Standard and Advanced) | Event routing from Google Cloud services, SaaS, and custom sources. Eventarc Advanced adds a central bus, enrollments, and pipelines. | Amazon EventBridge (event buses & Pipes) |
| Firebase App Hosting | Git-connected hosting for server-rendered web apps (built-in Next.js and Angular support), served on Cloud Run and cached in Cloud CDN. | AWS Amplify Hosting |
| Firebase Hosting | Static and single-page web hosting on a global CDN, deployed with one command. | AWS Amplify Hosting |
| Firebase SQL Connect (formerly Data Connect) | GraphQL-based backend over a managed Cloud SQL for PostgreSQL database, with generated type-safe web and mobile SDKs. | AWS AppSync |
| GKE attached clusters | Registers conformant Kubernetes clusters running elsewhere (for example EKS and AKS) to a Google Cloud fleet for central management. | Amazon EKS Hybrid Nodes & EKS Anywhere |
| GKE Autopilot | GKE mode where Google provisions and manages nodes, applies security defaults, and bills per Pod resource requests. | Amazon EKS Auto Mode, AWS Fargate |
| GKE release channels (incl. Extended channel) | Rapid, Regular, Stable, and Extended channels control upgrade cadence. Extended keeps a minor version for up to 24 months for an extra per-cluster fee. | Amazon EKS Kubernetes version support (standard & extended) |
| Google Distributed Cloud (software only) for bare metal | Google-managed Kubernetes software you install on your own bare metal servers (a VMware variant also exists), managed from Google Cloud. | Amazon EKS Hybrid Nodes & EKS Anywhere |
| Google Kubernetes Engine (GKE) | Managed Kubernetes with Standard mode (you manage node pools) and Autopilot mode (Google manages nodes), plus release channels and fleet features. | Amazon EKS |
| Pub/Sub | Global asynchronous messaging service with topics and push or pull subscriptions, used for fan-out, queues, and streaming pipelines. | Amazon SQS, Amazon SNS |
| Workflows | Fully managed orchestration that runs steps written in YAML or JSON, calling Google Cloud services and HTTP APIs, billed per step executed. | AWS Step Functions, Lambda durable functions |
| Workload Identity Federation for GKE | Lets Kubernetes service accounts act as IAM principals, so Pods call Google Cloud APIs without service account keys. | EKS Pod Identity (and IRSA) |
Storage(28)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| Apache Iceberg managed tables in BigQuery (BigLake) | Fully managed Apache Iceberg tables whose data lives in your Cloud Storage buckets, managed and queried through BigQuery. | Amazon S3 Tables |
| Backup and DR Service | Centralized, policy-based backup for Compute Engine, disks, Filestore, VMware Engine VMs, Cloud SQL, AlloyDB, and databases on VMs. | AWS Backup, AWS Elastic Disaster Recovery (DRS) |
| Backup vaults | Google-managed regional storage that keeps backups isolated, immutable, and indelible for a set retention period. | AWS Backup logically air-gapped vault |
| BigQuery vector search | Store embeddings in BigQuery tables and run similarity search with the VECTOR_SEARCH function and vector indexes. | Amazon S3 Vectors |
| Bucket Lock and Object Retention Lock | Bucket retention policies that can be locked permanently, and per-object retention configurations, for WORM compliance. | Amazon S3 Object Lock |
| Cloud Storage | Object storage in buckets with regional, dual-region, and multi-region locations, storage classes, and strong global consistency. | Amazon S3 |
| Cloud Storage access control (IAM, signed URLs) | IAM with uniform bucket-level access (or legacy ACLs), managed folders, and time-limited signed URLs. | Amazon S3 access control (IAM, bucket policies, presigned URLs) |
| Cloud Storage Autoclass | Moves each object between storage classes automatically based on access, with Nearline or Archive as the configurable coldest class. | Amazon S3 Intelligent-Tiering |
| Cloud Storage classes (Standard, Nearline, Coldline, Archive) | Storage classes with lower storage prices for colder data, offset by minimum storage durations and retrieval fees. All classes return data in milliseconds. | Amazon S3 storage classes, Amazon Glacier (original vault service) |
| Cloud Storage FUSE | Mounts Cloud Storage buckets as a local file system on VMs and GKE, with caching options. Not a POSIX file system. | Amazon S3 Files, Mountpoint for Amazon S3 |
| Cloud Storage hierarchical namespace | Bucket option with real folders and atomic folder operations such as rename, for analytics and AI/ML workloads. | Amazon S3 |
| Cloud Storage inventory reports (Storage Intelligence) | Scheduled CSV or Parquet reports of object metadata, an alternative to listing objects. Part of Storage Intelligence. | Amazon S3 Inventory and S3 Metadata |
| Cloud Storage managed folders | Folders inside a bucket that you can grant IAM roles on, for finer-grained access to groups of objects. | Amazon S3 Access Points |
| Cloud Storage Rapid Bucket (Rapid storage class) | Zonal buckets that store objects in the Rapid storage class, colocated with compute for lower latency and higher throughput, with appendable objects. | Amazon S3 Express One Zone |
| Compute Engine disk snapshots | Incremental, compressed, encrypted backups of disks (standard and archive snapshots), stored regionally or multi-regionally. | Amazon EBS snapshots |
| Disk sharing (multi-writer and read-only) | Attach one disk to several instances in read-only mode or multi-writer mode. | Amazon EBS Multi-Attach |
| Dual-region and multi-region buckets (incl. turbo replication) | Bucket locations that store data redundantly across regions, with optional turbo replication for dual-region buckets. | Amazon S3 Replication (CRR, SRR, Batch Replication) |
| Filestore | Managed NFS file servers in zonal, regional, and other service tiers for VMs and GKE. | Amazon EFS |
| GKE storage (CSI drivers) | Managed CSI drivers for Hyperdisk and Persistent Disk, Filestore, Cloud Storage FUSE, Managed Lustre, and more. | Amazon EKS storage CSI drivers (EBS, EFS, FSx, Mountpoint for S3) |
| Google Cloud Managed Lustre | Fully managed Lustre parallel file system for AI and HPC, at multi-petabyte scale. Old Parallelstore documentation links redirect here. | Amazon FSx for Lustre |
| Google Cloud NetApp Volumes | Fully managed NetApp ONTAP-based storage with NFS (v3, v4.1, v4.2), SMB, iSCSI, and NVMe/TCP, plus snapshots and replication. | Amazon FSx for NetApp ONTAP, Amazon FSx for Windows File Server |
| Hyperdisk and Persistent Disk | Network block storage for Compute Engine. Hyperdisk lets you provision capacity, IOPS, and throughput separately; Persistent Disk is the older family. | Amazon EBS |
| Hyperdisk Storage Pools | Buy Hyperdisk capacity and performance in bulk and share it across many disks in a zone. | Amazon FSx for NetApp ONTAP |
| Local SSD | Physically attached SSDs for instances. Data can be lost if the instance stops or is terminated. | Amazon EC2 instance store |
| Object Lifecycle Management | Bucket rules that delete objects or change their storage class based on age, versions, and other conditions. | Amazon S3 Lifecycle |
| Storage batch operations | Serverless bulk jobs (such as deleting objects or updating metadata) across billions of objects. Requires a Storage Intelligence configuration. | Amazon S3 Batch Operations |
| Storage Transfer Service | Managed transfers from Amazon S3, Azure Blob Storage, HDFS, on-premises file systems (through agents), and between Cloud Storage buckets, including… | Amazon S3 Replication (CRR, SRR, Batch Replication), AWS DataSync |
| Transfer Appliance | High-capacity storage device you load and ship to Google, which uploads the data to Cloud Storage. | AWS Snowball Edge (Snow Family), AWS Data Transfer Terminal |
Databases(16)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| AlloyDB for PostgreSQL | Fully managed PostgreSQL-compatible database with disaggregated storage, read pool instances, a columnar engine, and cross-region secondary clusters. | Amazon Aurora PostgreSQL-Compatible Edition, Amazon Aurora Global Database, Amazon RDS Proxy |
| AlloyDB Omni | Downloadable edition of AlloyDB that runs on Linux VMs, on premises, or in Kubernetes (with an operator). | Amazon RDS on AWS Outposts |
| Bigtable | Wide-column NoSQL database for large, low-latency workloads, with an HBase-compatible client, replication across clusters, and change streams. | Amazon DynamoDB global tables, Amazon DynamoDB Streams, Amazon Keyspaces (for Apache Cassandra), Amazon Timestream for LiveAnalytics |
| Cloud SQL Enterprise Plus edition features (HA, advanced DR, managed connection pooling) | Regional HA instances, cross-region DR replicas with switchover, and managed connection pooling (Enterprise Plus) for Cloud SQL. | Amazon RDS Multi-AZ deployments, Amazon Aurora Global Database, Amazon RDS Proxy |
| Cloud SQL for MySQL | Managed MySQL in Enterprise and Enterprise Plus editions, with high availability, read replicas, backups, and point-in-time recovery. | Amazon RDS for MySQL, Amazon Aurora MySQL-Compatible Edition, Amazon RDS read replicas |
| Cloud SQL for PostgreSQL | Managed PostgreSQL in Enterprise and Enterprise Plus editions, with high availability, read replicas, backups, and point-in-time recovery. | Amazon RDS for PostgreSQL, Amazon RDS read replicas |
| Cloud SQL for SQL Server | Managed Microsoft SQL Server with high availability, backups, and license-included pricing. | Amazon RDS for SQL Server |
| Database Migration Service | Managed migrations into Cloud SQL and AlloyDB, homogeneous (for example MySQL to Cloud SQL for MySQL) and heterogeneous (for example Oracle to Cloud SQL for… | AWS Database Migration Service (DMS) |
| Datastream | Serverless change data capture and replication from operational databases into BigQuery, Cloud Storage, and other targets. | AWS Database Migration Service (DMS), Amazon RDS and Aurora zero-ETL integrations |
| Firestore | Serverless document database (Standard and Enterprise editions) with regional or multi-region locations, strong consistency, and client SDKs for web and mobile. | Amazon DynamoDB, Amazon DynamoDB global tables |
| Firestore with MongoDB compatibility | MongoDB-compatible API (drivers, MQL, tools) on Firestore Enterprise edition, serverless with multi-region replication. | Amazon DocumentDB (with MongoDB compatibility) |
| Memorystore for Valkey | Managed Valkey (open-source Redis-compatible) with cluster mode, replicas, and optional RDB or AOF persistence. | Amazon ElastiCache, Amazon MemoryDB |
| Oracle Database@Google Cloud | Oracle Exadata and Autonomous Database services operated by Oracle (OCI) and deployed in Google Cloud data centers, integrated with Google Cloud networking… | Amazon RDS for Oracle, Oracle Database@AWS |
| Spanner | Globally distributed, strongly consistent relational database with GoogleSQL and PostgreSQL dialects, up to 99.999% availability, and compute measured in… | Amazon Aurora Serverless v2, Amazon Aurora DSQL, Amazon Aurora PostgreSQL Limitless Database, Amazon Keyspaces (for Apache Cassandra) |
| Spanner Graph | Graph database capability in Spanner with an ISO GQL-compatible query interface over relational data. | Amazon Neptune (Database and Analytics) |
| SQL Server on Compute Engine | Compute Engine VMs with license-included SQL Server images (or your own licenses), giving full OS and instance control. | Amazon RDS Custom (Oracle and SQL Server) |
Networking & Content Delivery(33)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| Application Load Balancer | Layer 7 proxy load balancer, global (single anycast IP) or regional, external or internal. | Application Load Balancer, AWS Global Accelerator |
| Cloud CDN | Caching at Google's edge for content served through the external Application Load Balancer. | Amazon CloudFront |
| Cloud DNS | Managed authoritative DNS with public and private zones, DNSSEC, forwarding, and server policies. | Amazon Route 53 (DNS hosting and domains), Route 53 private hosted zones, Route 53 Resolver (endpoints and rules) |
| Cloud DNS response policies | Override or block DNS answers for private resolution inside VPC networks. | Route 53 Resolver DNS Firewall |
| Cloud DNS routing policies | Weighted round robin, geolocation, and failover routing policies with health checks. | Route 53 routing policies and health checks |
| Cloud Interconnect | Dedicated Interconnect and Partner Interconnect private connections, with VLAN attachments. | AWS Direct Connect, Direct Connect gateway |
| Cloud NAT | Software-defined managed NAT for outbound traffic from resources without external IP addresses; no proxy VMs. | NAT gateway (zonal and regional) |
| Cloud Next Generation Firewall | Stateful distributed firewall with Essentials, Standard, and Enterprise tiers, VPC firewall rules, and network firewall policies. | Security groups |
| Cloud NGFW Enterprise (intrusion prevention) | Layer 7 threat inspection through zonal firewall endpoints that intercept traffic transparently. | AWS Network Firewall |
| Cloud Router | Managed BGP speaker that exchanges dynamic routes for Cloud VPN, Cloud Interconnect, and router appliances. | Amazon VPC Route Server |
| Cloud VPN (HA VPN) | IPsec VPN with HA VPN gateways that provide a 99.99% SLA for most topologies. | AWS Site-to-Site VPN |
| Cloud WAN | Managed global WAN built on Google's network and partners, part of the Cross-Cloud Network solution. | AWS Cloud WAN |
| Connectivity Tests (Network Intelligence Center) | Analyzes network configuration, and sometimes live data plane, between endpoints. | VPC Reachability Analyzer and Network Access Analyzer |
| Cross-Cloud Interconnect | Dedicated physical connections between Google Cloud and other clouds, plus partner options for AWS and OCI. | AWS Direct Connect |
| DNS Armor | Advanced DNS threat detection, powered by Infoblox, for queries from VPC networks. | Route 53 Resolver DNS Firewall |
| Google Cloud Armor | WAF and DDoS protection for load balancers, in Standard and Cloud Armor Enterprise pricing models. | AWS WAF, AWS Shield (Standard and Advanced) |
| Hierarchical firewall policies | Firewall policies attached to the organization or folders that apply to every VPC network below them. | AWS Firewall Manager |
| Internal ranges | Reserve and manage blocks of internal IP addresses for VPC networks. | Amazon VPC IP Address Manager (IPAM) |
| Media CDN | Edge delivery for high-throughput workloads such as video streaming and large downloads. | Amazon CloudFront |
| Network Connectivity Center | Hub-and-spoke connectivity among VPC spokes and hybrid spokes (VPN, Interconnect, router appliances). | AWS Transit Gateway, AWS Cloud WAN, Direct Connect gateway |
| Network Connectivity Center router appliance | Peer Cloud Router with a third-party network virtual appliance over BGP. | Amazon VPC Route Server |
| Network Load Balancer | Layer 4 load balancers in proxy and passthrough modes. | Network Load Balancer, AWS Global Accelerator |
| Network Security Integration | Inserts third-party security appliance VMs in-band or out-of-band using packet intercept. | Gateway Load Balancer |
| Organization Policy network constraints | Organization-wide guardrails such as restricting external IP addresses on VMs or VPC peering. | VPC Block Public Access |
| Packet Mirroring | Clones instance traffic to collector instances behind an internal load balancer. | VPC Traffic Mirroring |
| Private Google Access | Lets VMs with only internal IP addresses reach Google APIs and services. | Gateway VPC endpoints |
| Private Service Connect | Private endpoints and backends for Google APIs, Google-managed services, and published third-party services. | AWS PrivateLink (interface endpoints), Amazon VPC Lattice |
| Service Extensions | Plugins (custom code inline in the data path) and callouts for Cloud Load Balancing, Media CDN, and Secure Web Proxy. | CloudFront Functions |
| Static external IP addresses and BYOIP | Reserved regional or global external IP addresses, including bring-your-own IP ranges. | Elastic IP addresses (and BYOIP), Internet gateway (and egress-only internet gateway) |
| Virtual Private Cloud (VPC) network | A global virtual network with regional subnets, firewall rules, and routes, shared across projects with Shared VPC. | Amazon VPC, VPC subnets, Internet gateway (and egress-only internet gateway) |
| VPC Flow Logs | Sampled flow records aggregated by 5-tuple connection, sent to Cloud Logging. | VPC Flow Logs |
| VPC Network Peering | Private connectivity between two VPC networks; not transitive. | VPC peering |
| VPC routes | System, custom static, dynamic, and policy-based routes for a VPC network. | VPC route tables |
Identity & Security(34)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| Artifact Analysis | Vulnerability scanning for container images and packages in Artifact Registry. | Amazon Inspector |
| Assured Workloads | Control packages for data residency, access, and personnel controls for regulated workloads. | AWS Audit Manager |
| Certificate Authority Service | Managed private CAs, with custom root and subordinate CAs, in DevOps and Enterprise tiers. | AWS Private Certificate Authority |
| Certificate Manager | Google-managed and self-managed TLS certificates for Google Cloud load balancers. | AWS Certificate Manager (ACM) |
| Chrome Enterprise Premium | Zero trust access and data protection that extends IAP with paid capabilities. | AWS Verified Access |
| Cloud Asset Inventory | Inventory of resources and policies with up to 35 days of change history. | AWS Config |
| Cloud Audit Logs | Admin Activity, Data Access, System Event, and Policy Denied audit logs in Cloud Logging. | AWS CloudTrail |
| Cloud External Key Manager | Use keys held in a supported external key manager outside Google Cloud. | AWS Key Management Service (KMS) |
| Cloud HSM | Keys protected in clusters of FIPS 140-2 Level 3 certified HSMs, managed through Cloud KMS. | AWS Key Management Service (KMS) |
| Cloud Identity | Google identity service for users and groups, with free and premium editions, 2-Step Verification, and SSO. | AWS IAM Identity Center |
| Cloud Key Management Service | Software, hardware (Cloud HSM), and external keys with key-version and operation pricing. | AWS Key Management Service (KMS) |
| Compliance Manager (Security Command Center) | Cloud controls and frameworks with auditing and evidence collection in Premium and Enterprise tiers. | AWS Audit Manager |
| Compliance Reports Manager | Download Google Cloud compliance reports and certifications. | AWS Artifact |
| Enterprise foundations blueprint | Google-recommended reference architecture and deployable code for a secure foundation. | AWS Control Tower |
| Event Threat Detection | Security Command Center service that detects threats in near real time from logs. | Amazon GuardDuty |
| Google Cloud Setup | Guided flow for administrators to configure an organization foundation. | AWS Control Tower |
| Google Security Operations | SIEM, SOAR, and threat intelligence platform with a Unified Data Model. | Amazon Detective, Amazon Security Lake |
| IAM deny policies | Guardrails that deny specific permissions to principals regardless of what allow policies grant. | AWS Identity and Access Management (IAM), Service control policies and resource control policies |
| Identity and Access Management (IAM) | Allow policies that grant roles to principals on resources in the organization, folder, and project hierarchy. | AWS Identity and Access Management (IAM), AWS Resource Access Manager (RAM) |
| Identity Platform | Customer identity and access management that backs Firebase Authentication, billed per monthly active user. | Amazon Cognito |
| Identity-Aware Proxy (IAP) | Identity- and context-based access to applications and VMs (including TCP forwarding) without a VPN. | AWS Verified Access |
| Managed Service for Microsoft Active Directory | Highly available, hardened Microsoft Active Directory domains hosted by Google Cloud. | AWS Directory Service |
| Organization Policy Service | Managed and custom constraints that restrict resource configurations across the hierarchy. | Service control policies and resource control policies |
| Policy Intelligence (role recommendations, Policy Analyzer) | Role recommendations to remove excess permissions and Policy Analyzer to find who has access to what. | IAM Access Analyzer |
| Privileged Access Manager | Just-in-time, temporary privilege elevation through entitlements with optional approvals. | AWS IAM Identity Center |
| Resource Manager (organization, folders, projects) | The resource hierarchy of organization, folders, and projects used for policy and billing. | AWS Resource Access Manager (RAM), AWS Organizations |
| Secret Manager | Stores secrets as versioned objects with global or regional service options and rotation schedules. | AWS Secrets Manager |
| Security Command Center | Security and risk management in Standard and Premium tiers; the Enterprise tier is deprecated and shuts down May 21, 2027. | Amazon GuardDuty, AWS Security Hub CSPM, AWS Security Hub, Amazon Inspector |
| Security Command Center security posture | Define and deploy security postures and detect drift from them. | AWS Config, AWS Security Hub CSPM, AWS Security Hub |
| Sensitive Data Protection (formerly Cloud DLP) | Discovers, classifies, and de-identifies sensitive data (PII and more) in text, images, and Google Cloud storage. | Amazon Macie, Amazon Comprehend, Amazon Bedrock Guardrails |
| Service accounts | Identities for workloads; attach a service account to a resource to get short-lived credentials without keys. | IAM roles for AWS services |
| Single-tenant Cloud HSM | A single-tenant instance of HSM partitions for your exclusive use, managed through Cloud KMS. | AWS CloudHSM |
| Workforce Identity Federation | Lets users from an external IdP access Google Cloud with SSO, without syncing accounts. | AWS IAM Identity Center |
| Workload Identity Federation | Lets workloads on AWS, Azure, or OIDC/SAML identity providers access Google Cloud without service account keys. | IAM Roles Anywhere, AWS Identity and Access Management (IAM) |
AI & Machine Learning(55)
| GCP service | What it is | AWS equivalent(s) |
|---|---|---|
| Agent Development Kit (ADK) | Open-source framework (Python, TypeScript, Go, Java) for building single and multi-agent systems with workflow agents, tools, and evaluation. Runs anywhere;… | Amazon Bedrock Flows & Prompt management, Strands Agents SDK |
| Agent Gateway Preview | Central gateway that governs how agents reach tools, models, and other agents. | Amazon Bedrock AgentCore |
| Agent Identity | Gives each deployed agent its own IAM identity so access can be granted, audited, and revoked per agent. | Amazon Bedrock AgentCore |
| Agent Platform AutoML | Trains tabular (classification, regression, forecasting) and image models from your data with little or no code. | SageMaker Autopilot, Amazon SageMaker Canvas, Amazon Rekognition Custom Labels |
| Agent Platform dataset labeling | Label images, video, text, and tabular data yourself in the console inside a managed dataset. | Amazon SageMaker Ground Truth |
| Agent Platform Experiments | Tracks runs, parameters, and metrics, with TensorBoard integration, for comparing training experiments. | Managed MLflow on SageMaker AI |
| Agent Platform Feature Store | Feature registry over BigQuery tables and views, with online stores for low-latency serving. | Amazon SageMaker Feature Store |
| Agent Platform inference (endpoints) | Online endpoints and batch inference for your own or Model Garden models, on CPU, GPU, or TPU nodes. | SageMaker AI inference (endpoints) |
| Agent Platform model evaluation (incl. fairness metrics) | Evaluation metrics for trained models, including data and model bias (fairness) metrics. | Amazon SageMaker Clarify |
| Agent Platform Model Monitoring | Detects training-serving skew and prediction drift for deployed models. | Amazon SageMaker Model Monitor |
| Agent Platform Model Registry | Central registry of model versions, aliases, and evaluations, with deployment to endpoints. | SageMaker Model Registry |
| Agent Platform Pipelines | Serverless runner for ML workflows written with the Kubeflow Pipelines SDK or TensorFlow Extended (TFX). | Amazon SageMaker Pipelines |
| Agent Platform serverless training (custom training) | Run your own training code in containers on managed CPU, GPU, or TPU workers, billed for the job's duration. | SageMaker AI training jobs |
| Agent Platform Sessions and Memory Bank | Managed short-term session state and long-term memory that agents read and write across conversations. | Amazon Bedrock AgentCore |
| Agent Platform tabular forecasting | AutoML and other tabular workflows for time-series forecasting. | Amazon Forecast, Amazon SageMaker Canvas |
| Agent Platform TensorBoard Profiler | Profiles custom training jobs (step time, input pipeline, accelerator use) in managed TensorBoard. | SageMaker Debugger & Profiler |
| Agent Platform training clusters | Persistent, reserved accelerator clusters with Slurm orchestration and resiliency features for large-scale training. | Amazon SageMaker HyperPod |
| Agent Platform Workbench | Managed JupyterLab instances on Compute Engine with Agent Platform and BigQuery integration. | Amazon SageMaker Studio |
| Agent Registry Preview | Catalog of agents, tools, and MCP servers for discovery and governance. | Amazon Bedrock AgentCore |
| Agent Runtime (formerly Agent Engine) | Managed runtime to deploy and scale agents built with ADK or other frameworks, with Sessions, Memory Bank, code execution, and observability. | Amazon Bedrock AgentCore, Amazon Bedrock Agents Classic |
| Agent Search (formerly Vertex AI Search) | Managed Google-quality search and grounding over websites, structured, and unstructured data, with connectors and generative answers. | Amazon Kendra, Amazon Bedrock Knowledge Bases |
| Agent Studio (formerly Vertex AI Studio) | Console workspace for trying models, refining system instructions and prompts, and prototyping agents. | Amazon Bedrock Flows & Prompt management, Amazon Bedrock Agents Classic, Amazon Bedrock AgentCore |
| AI Commerce Search (formerly Vertex AI Search for commerce) | Product search, browse, and recommendations for retail catalogs, part of Gemini Enterprise for Customer Experience. | Amazon Personalize |
| Anti Money Laundering AI | Banking-specific ML that scores customers for money-laundering risk from transaction and party data. | Amazon Fraud Detector |
| BigQuery ML | Create and run ML models with SQL inside BigQuery, including forecasting (ARIMA_PLUS, TimesFM), anomaly detection, and calls to remote Gemini models. | Amazon SageMaker Unified Studio, Amazon SageMaker Canvas, Amazon Forecast, Amazon Lookout for Metrics |
| Cloud Healthcare API (FHIR stores) | Managed FHIR stores with a REST API and Pub/Sub notifications. The same API also offers HL7v2 stores. | AWS HealthLake |
| Cloud Natural Language API | Pretrained entity, sentiment, syntax, classification, and text moderation analysis. | Amazon Rekognition, Amazon Comprehend |
| Cloud Speech-to-Text | Batch and streaming transcription, including Chirp 3 and medical conversation and dictation models. | Amazon Transcribe, AWS HealthScribe |
| Cloud Text-to-Speech | Speech synthesis in many voices and languages, with SSML support. | Amazon Polly |
| Cloud TPU | Google's custom AI accelerators (for example v6e Trillium and TPU7x Ironwood) for both training and inference, on Compute Engine, GKE, or Agent Platform. | AWS Trainium (Trn1, Trn2, Trn3), AWS Inferentia (Inf2) |
| Cloud Translation | Neural machine translation (Basic and Advanced), document translation, glossaries, custom models, and LLM-based (adaptive) translation. | Amazon Translate |
| Cloud Vision API | Pretrained image analysis (labels, objects, OCR, faces without identity, landmarks, logos, SafeSearch). | Amazon Rekognition, Amazon Comprehend |
| Colab Enterprise | Managed, collaborative Colab notebooks with IAM, runtimes you control, and integration with BigQuery and Agent Platform. | Amazon SageMaker Unified Studio, Amazon SageMaker Studio |
| Compute Engine GPU machines | Accelerator-optimized and N1 VMs with NVIDIA GPUs, also used by GKE and Agent Platform. | Amazon EC2 accelerated computing (NVIDIA GPU) |
| Customer Experience Insights (formerly Contact Center AI Insights) | Imports contact-center calls and chats, transcribes them, and finds topics, sentiment, and quality patterns. | Amazon Transcribe Call Analytics |
| Deep Learning VM Images | Compute Engine images preinstalled with ML frameworks, CUDA drivers, and JupyterLab. | AWS Deep Learning AMIs |
| Dialogflow CX (Conversational Agents) | Builder for chat and voice virtual agents with flows, playbooks (LLM-driven), and telephony integration. | Amazon Lex V2 |
| Document AI | OCR, form and layout parsing, pretrained specialized processors, and custom extractors for documents. | Amazon Bedrock Data Automation, Amazon Textract |
| Gemini Cloud Assist Preview | AI assistant in the Google Cloud console for designing, operating, troubleshooting, and optimizing workloads. | Amazon Q Developer |
| Gemini Code Assist Standard/Enterprise Deprecated | AI coding assistant for IDEs and the console. | Kiro, Amazon Q Developer |
| Gemini Enterprise | Per-user AI assistant and agent workspace that searches and acts across company apps through connectors. | Amazon Quick, Amazon Q Business |
| Gemini Enterprise Agent Platform (formerly Vertex AI) | Google Cloud's unified platform for generative AI models, agents, and classic ML (training, inference, pipelines, feature store, model registry). | Amazon SageMaker AI |
| Gemini Live API | Low-latency, bidirectional streaming voice and video conversations with Gemini. | Amazon Nova |
| Gemini model tuning | Supervised fine-tuning and preference tuning for Gemini models, embedding tuning, and tuning of open models from Model Garden. | Amazon Bedrock model customization, Amazon Comprehend |
| Gemini models on Agent Platform | Google's first-party models (Gemini, Gemma, Veo, Lyria, embeddings) served per token or per output unit through the Agent Platform API. | Amazon Bedrock, Amazon Nova, Amazon Bedrock Data Automation, Amazon Rekognition, AWS HealthScribe |
| Gen AI evaluation service | Evaluates generative models with adaptive rubrics, static rubrics, computation-based metrics (such as ROUGE and BLEU), and custom Python functions. Agent… | Amazon Bedrock Evaluations, Amazon Bedrock AgentCore |
| Google Antigravity | Google's agentic development platform (IDE and agents). Enterprise use is through Gemini Enterprise. | Kiro, Amazon Q Developer |
| Google Cloud Fraud Defense (reCAPTCHA) | Bot, account-takeover, and payment-fraud risk scoring for web and mobile interactions. | Amazon Fraud Detector |
| Model Armor | Screens prompts and responses for prompt injection, jailbreaks, harmful content, sensitive data, and malicious URLs, for any model. | Amazon Bedrock Guardrails, Amazon Rekognition, Amazon Comprehend |
| Model Garden | Catalog of Google, partner, and open models. Partner models (for example Anthropic Claude, xAI Grok, Mistral) are offered as managed APIs. Open models (for… | Amazon Bedrock, Amazon SageMaker JumpStart, Amazon Bedrock Marketplace |
| Provisioned Throughput | Fixed-term subscription that reserves throughput for Google models, as an alternative to pay-as-you-go (Standard, Priority, and Flex PayGo). | Amazon Bedrock Provisioned Throughput & cross-Region inference |
| RAG Engine | Managed retrieval-augmented generation that ingests, chunks, embeds, and retrieves your data, with a managed or bring-your-own vector database. | Amazon Bedrock Knowledge Bases |
| Vector Search | Managed approximate-nearest-neighbor vector search built on Google's ScaNN algorithm. | Amazon Bedrock Knowledge Bases |
| Vertex Explainable AI Deprecated | Feature attributions and example-based explanations for model predictions. | Amazon SageMaker Clarify |
| Video Intelligence API Deprecated | Pretrained video analysis (labels, shots, objects, text, explicit content). | Amazon Rekognition |