Google Cloud → AWS and Azure
AWS and Azure equivalents of IAM deny policies
The closest AWS equivalents of Google Cloud IAM deny policies are AWS Identity and Access Management (IAM) and Service control policies and resource control policies; on Azure, Microsoft Entra ID, Azure role-based access control (Azure RBAC) and Azure Policy.
About IAM deny policies
| Provider | Google Cloud |
|---|---|
| Status | Generally available |
| What it is | Guardrails that deny specific permissions to principals regardless of what allow policies grant. |
| Documentation | docs.cloud.google.com |
| Pricing | No separate pricing page |
Mappings (2)
| Capability | AWS | Match (GCP vs AWS) | Azure |
|---|---|---|---|
| Cloud identity and access management | AWS Identity and Access Management (IAM) | Direct match | Microsoft Entra ID, Azure role-based access control (Azure RBAC) |
| Organization-wide guardrail policies | Service control policies and resource control policies | Direct match | Azure Policy |
Cloud identity and access management Direct match
AWS IAM maps to Google Cloud IAM: allow policies grant predefined or custom roles to principals on resources, and deny policies set guardrails.
- Policies attach to resources in the hierarchy (organization, folder, project, resource) and are inherited; there are no identity-based policy documents like AWS.
- User identities come from Cloud Identity, Google Workspace, or Workforce Identity Federation, not from IAM itself.
Organization-wide guardrail policies Direct match
Service and resource control policies map to Organization Policy constraints (managed and custom) and IAM deny policies, both inherited down the hierarchy.
- Organization policies restrict configurations; deny policies restrict permissions, splitting what SCPs do.