Cloud Compare / Network protection compared
Network protection compared
Firewall rules, security groups and NSGs; managed firewalls; WAF and DDoS; private access; and admin access without open ports, across Google Cloud, AWS and Azure.
All three clouds protect networks in the same layers: filters on each server, a managed firewall where traffic converges, a web application firewall in front of websites, DDoS protection on public addresses, private access to platform services, and admin access without open ports. The names differ, and so do a few important details, such as where a rule can be set once for the whole organisation.
For the network building blocks themselves, see Networking compared. For a detailed look at the web application firewall layer, starting from Google Cloud Armor, see Cloud Armor, AWS WAF and Azure WAF.
The layers at a glance
| Layer | Google Cloud | AWS | Azure |
|---|
| Stateful filter on each server | VPC firewall rules and network firewall policies | Security groups | Network security groups (NSGs) |
| Subnet-level filter | None separate (rules apply network-wide, by target) | Network ACLs (stateless) | NSG associated with the subnet |
| Group servers by role in rules | Service accounts, secure tags, network tags | Security group references | Application security groups |
| Organisation-wide rules no project can override | Hierarchical firewall policies | Firewall Manager security group policies; SCPs for guardrails | Security admin rules (Azure Virtual Network Manager) |
| Managed firewall (FQDN filtering, IDS/IPS) | Cloud NGFW Standard / Enterprise; Secure Web Proxy | AWS Network Firewall | Azure Firewall (Basic, Standard, Premium) |
| DNS-layer filtering | Cloud NGFW FQDN objects; Cloud DNS response policies | Route 53 Resolver DNS Firewall | DNS security policy; Azure Firewall DNS proxy |
| Web application firewall | Cloud Armor | AWS WAF | Azure WAF (Front Door, Application Gateway) |
| DDoS, included at no charge | Infrastructure protection; Cloud Armor Standard on load balancers | Shield Standard | DDoS infrastructure protection |
| DDoS, paid tier | Cloud Armor Enterprise | Shield Advanced | DDoS Network Protection or IP Protection |
| Central policy management | Organisation and folder policies; Cloud Armor policies per project | AWS Firewall Manager | Azure Firewall Manager; Azure Policy |
Filters on each server
| GCP firewall rules | AWS security groups | Azure NSGs |
|---|
| Belongs to | The VPC network | The VPC; attached to interfaces | Associated with subnets and/or NICs |
| Deny rules | Yes | No (allow only) | Yes |
| Order | Priority 0–65535, lowest number wins | All rules evaluated together | Priority 100–4096, lowest number wins |
| Default inbound | Deny (implied rule) | Deny | Allow from the VNet and load balancer; deny the rest |
| Default outbound | Allow (implied rule) | Allow | Allow |
| Stateful | Yes | Yes | Yes |
| Pitfall to check first | The default network's SSH/RDP rules from 0.0.0.0/0 | One permissive group added "temporarily"; the default group | Subnet and NIC NSGs that both have to allow |
| Report in these notes | Get-GcpFirewallReport | Get-AwsSecurityGroupReport | Get-AzNsgRuleReport |
Managed firewalls
| Cloud NGFW (Google Cloud) | AWS Network Firewall | Azure Firewall |
|---|
| How traffic reaches it | Built into the network fabric; no routing changes. Enterprise tier uses firewall endpoints per zone | Firewall endpoints in dedicated subnets; route tables send traffic through them | Deployed in AzureFirewallSubnet; route tables (UDR) send traffic through it |
| Rules by domain name | Standard tier (FQDN objects) | Yes (domain lists, Suricata rules) | Standard and Premium (application rules, FQDN tags) |
| Threat intelligence | Standard tier | AWS managed threat signatures | Standard and Premium |
| Intrusion prevention (IPS) | Enterprise tier | Yes (stateful Suricata rules, managed groups) | Premium (IDPS) |
| TLS inspection | Enterprise tier | Yes | Premium |
| Policy object | Firewall policies (hierarchical, global, regional) with security profiles | Firewall policy, rule groups | Firewall Policy (parent and child) |
A notable difference: Google Cloud's basic firewall (Essentials) needs no appliance or routing at all, so there's no Google Cloud equivalent of the "hub firewall every packet must route through" until you need IPS or TLS inspection. In AWS and Azure, a managed firewall is always an extra hop you design routing around.
Web and DDoS protection
| Google Cloud | AWS | Azure |
|---|
| WAF service | Cloud Armor security policies | AWS WAF protection packs (web ACLs) | Azure WAF policies |
| Attaches to | Backend services of Application Load Balancers and Network Load Balancers; Cloud CDN | CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access, Amplify | Front Door, Application Gateway, Application Gateway for Containers |
| Managed rules | Preconfigured rules from the OWASP Core Rule Set | AWS managed rule groups, Marketplace rule groups | Default Rule Set (DRS), based on the OWASP CRS |
| Bots | Bot management with reCAPTCHA | Bot Control; Fraud Control (account takeover, fake sign-ups) | Bot Manager rule set |
| L7 DDoS assistance | Adaptive Protection (Enterprise) | Shield Advanced automatic application-layer mitigation | Front Door and WAF rate limiting; DDoS Protection for L3/L4 |
| Paid DDoS tier | Cloud Armor Enterprise: Paygo or Annual | Shield Advanced: about $3,000 a month per organisation, 1-year term | DDoS Network Protection (per 100 public IPs) or IP Protection (per IP) |
The full comparison, with features, pricing and how to move rules between them, is in Cloud Armor, AWS WAF and Azure WAF.
Private access and data exfiltration
| Need | Google Cloud | AWS | Azure |
|---|
| Platform services without public endpoints | Private Service Connect; Private Google Access | VPC endpoints (PrivateLink) | Private endpoints; public network access disabled |
| Stop data leaving through the provider's APIs, even with valid credentials | VPC Service Controls perimeters | VPC endpoint policies plus resource-based policies and RCPs with aws:SourceVpce / aws:PrincipalOrgID conditions | Network security perimeter (for supported PaaS services); private endpoints with service firewalls |
| Block public storage | Public access prevention (org policy) | S3 Block Public Access (account level) | Storage accounts with blob public access disallowed (Azure Policy) |
Admin access without open ports
| Google Cloud | AWS | Azure |
|---|
| Brokered SSH/RDP | IAP TCP forwarding (allow 35.235.240.0/20 only) | Session Manager (no inbound port at all); EC2 Instance Connect Endpoint | Azure Bastion (Developer, Basic, Standard, Premium) |
| Identity-based Linux login | OS Login | Session Manager with IAM; EC2 Instance Connect | Microsoft Entra login for VMs |
| Time-limited port opening | IAM conditions on IAP access | Not built in (use Session Manager instead) | Just-in-time VM access (Defender for Servers Plan 2) |
| Session recording | Cloud Audit Logs for IAP; no screen recording | Session Manager session logs | Bastion Premium session recording |
Detection and visibility
| Need | Google Cloud | AWS | Azure |
|---|
| Network threat detection | Security Command Center (Event Threat Detection); Cloud NGFW Enterprise IPS | GuardDuty (from VPC flow logs and DNS logs) | Defender for Cloud; Microsoft Sentinel |
| Posture findings for open ports | Security Health Analytics (OPEN_SSH_PORT, OPEN_FIREWALL) | Security Hub CSPM controls; Config rules restricted-ssh | Defender for Cloud recommendations; Azure Policy |
| Flow logs | VPC Flow Logs; firewall rules logging | VPC Flow Logs; Network Firewall logs | Virtual network flow logs; Azure Firewall logs |
A common baseline for all three
| Baseline | Google Cloud | AWS | Azure |
|---|
| No SSH or RDP from the internet | Delete default network rules; IAP | Security groups; Session Manager | NSGs; Bastion or JIT |
| No public IPs on servers | Org policy compute.vmExternalIpAccess | SCP / VPC Block Public Access | Azure Policy deny on public IPs |
| Managed outbound | Cloud NAT | NAT gateway | NAT Gateway |
| WAF on every public website | Cloud Armor | AWS WAF | Azure WAF |
| Private platform services | Private Service Connect | Interface endpoints | Private endpoints |
| Flow logs on production | VPC Flow Logs | VPC Flow Logs | VNet flow logs |
Compared as of October 2026. Service names, tiers and prices change; check the provider's documentation before deciding.