Azure ↔ AWS Landing Zone Translation
Search keywords: Azure AWS landing zone mapping terminology Management Groups Organizations Subscription Account VNet VPC RBAC IAM
| Concept | Azure | AWS |
|---|---|---|
| Organization structure | Management Groups | AWS Organizations |
| Workload boundary | Subscription | AWS Account |
| Identity | Microsoft Entra ID | IAM / IAM Identity Center |
| Access control | Azure RBAC | IAM policies / roles |
| Governance | Azure Policy | SCPs + Config + other controls |
| Network | VNet | VPC |
| Regional design | Azure Region | AWS Region |
| Availability | Availability Zones | Availability Zones |
| Central networking | Hub / Hub-Spoke | Transit Gateway / centralized networking patterns |
| Firewall | Azure Firewall | AWS Network Firewall |
| DNS | Azure DNS / Private DNS | Route 53 / Route 53 Resolver |
| Bastion | Azure Bastion | No direct 1:1 equivalent; commonly SSM or bastion architecture |
| Secrets | Key Vault | Secrets Manager / SSM Parameter Store |
| Monitoring | Azure Monitor / Log Analytics | CloudWatch |
| Security posture | Defender for Cloud | Security Hub / GuardDuty / Inspector etc. |
| IaC | ARM/Bicep/Terraform/CDKTF | CloudFormation/CDK/Terraform |
| Cost | Cost Management | Cost Explorer / Budgets |
| Audit | Activity Log | CloudTrail |
Translate the architecture, not just the service names
When moving between clouds, ask the same questions:
- What is the organizational boundary?
- What is the workload isolation boundary?
- How is identity and access controlled?
- How does network traffic flow?
- Where are preventive controls?
- Where are detective controls and logs?
- How are policies and governance enforced?
- How are costs monitored?
- How is the foundation reproduced with IaC?
- How does it scale to another environment or region?
One sentence
The cloud services have different names, but the landing-zone design problems are similar: boundaries, identity, networking, governance, security, operations and repeatable infrastructure.