Cloud Services Cross-Reference: Security & Identity

This document provides a side-by-side reference of security and identity services across Amazon Web Services (AWS), Microsoft Azure, Oracle Cloud Infrastructure (OCI), and Google Cloud Platform (GCP). Each section covers a distinct security domain, listing the equivalent or nearest service from each provider with brief notes on unique capabilities or architectural differences.

Identity & Access Management (IAM)

Core IAM controls who can access cloud resources and what actions they can perform. All four providers implement policy-based access control, role assignments, and least-privilege principles, but differ significantly in policy language, inheritance model, and federation integration.

Notable distinctions:

• OCI organizes all resources within compartments; policies are attached to compartments, making resource isolation structural rather than purely policy-driven.
• Azure RBAC is inseparable from Microsoft Entra ID; all role assignments are rooted in the Entra directory.
• Google Cloud uses a unified IAM model across GCP resources with no separate "resource policy" concept — all access is granted at the resource or project level via IAM bindings.

Directory Services

Directory services manage user and group identities, often acting as the authoritative source for authentication across an organization.

Notable distinctions:

• Microsoft Entra ID is the industry-dominant cloud directory, with deep integration across Microsoft 365, Intune, Dynamics, and thousands of SaaS apps.
• OCI Identity Domains replaced Oracle Identity Cloud Service (IDCS) as the unified identity platform; IDCS is no longer offered as a separate service.
• Google Cloud Identity is the standalone identity product; organizations using Google Workspace already have it included.

Single Sign-On & Federation

SSO and federation allow users to authenticate once and access multiple applications or cloud accounts without re-entering credentials.

Notable distinctions:

• AWS IAM Identity Center is the recommended SSO hub for multi-account AWS Organizations environments; it replaced the original "AWS SSO" branding.
• OCI Identity Domains provides SSO with pre-built integrations for Oracle SaaS applications (Fusion, NetSuite, etc.), a meaningful advantage for Oracle-centric organizations.
• Google Workspace organizations get SSO built-in; standalone GCP customers use Cloud Identity or the Identity Platform for consumer apps.

Key Management

Key management services (KMS) provide centralized creation, storage, rotation, and auditing of cryptographic keys used to encrypt data at rest and in transit.

Notable distinctions:

• OCI Vault serves dual purpose: key management and secrets management within the same service, unlike AWS which separates KMS and Secrets Manager.
• Azure Key Vault is the single service for keys, secrets, and certificates — a unified control plane across all three asset types.
• Google Cloud EKM allows keys to be held entirely outside Google, addressing sovereignty requirements.

Secrets Management

Secrets management covers secure storage, retrieval, rotation, and access control for credentials, API keys, database passwords, and other sensitive configuration values.

Notable distinctions:

• AWS separates non-secret configuration (Parameter Store, free) from secrets with rotation (Secrets Manager, paid). Both are commonly used together.
• Azure Key Vault is a single service covering keys, secrets, and certificates with consistent access policy and RBAC across all three.
• OCI Vault is also unified for keys and secrets; certificates are a separate OCI Certificates service.

Certificate Management

Certificate management services issue, store, deploy, and renew TLS/SSL certificates for public-facing and internal workloads.

Notable distinctions:

• OCI Certificates provides a dedicated Certificate Authority Service within OCI, enabling organizations to build private PKI hierarchies for internal services.
• AWS ACM public certificates are free but cannot be exported — they exist purely for AWS service consumption.
• Google Certificate Authority Service (CA Service) provides full FIPS-compliant CA infrastructure; Google-managed certificates are simpler but not downloadable.

Web Application Firewall (WAF)

WAF services filter and monitor HTTP/HTTPS traffic to protect web applications from common exploits including SQL injection, cross-site scripting (XSS), and Layer 7 DDoS.

Notable distinctions:

• OCI WAF has two distinct deployment models: WAF Edge Policy (global edge enforcement, legacy CDN integration) and WAF Firewall Policy (regional, attached to OCI load balancers). The two have different feature sets.
• Google Cloud Armor doubles as both WAF and DDoS protection in a single service, unlike AWS which separates WAF and Shield.
• Azure WAF is not a standalone service; it is a feature of Application Gateway and Azure Front Door.

DDoS Protection

DDoS protection services absorb or mitigate volumetric network attacks (Layer 3/4) and application-layer attacks (Layer 7).

Notable distinctions:

• Google Cloud Armor is a single service providing both WAF and DDoS functionality, making it architecturally simpler.
• OCI includes L3/L4 DDoS protection for free on all tenancies with no configuration; Layer 7 protection requires WAF.
• AWS Shield Advanced provides the strongest financial protection, including cost reimbursement for auto-scaling charges during attacks.

Security Posture Management (CSPM)

Cloud Security Posture Management services continuously assess cloud configurations, detect misconfigurations, and provide remediation guidance against security benchmarks and compliance frameworks.

Notable distinctions:

• OCI Cloud Guard includes built-in Responder Recipes for automatic remediation — a differentiator from AWS Security Hub, which requires custom automation.
• Azure Defender for Cloud natively ingests findings from AWS and GCP resources when those accounts are onboarded, making it a genuine multi-cloud CSPM.
• OCI Security Zones complement Cloud Guard by enforcing preventative controls — certain operations are blocked outright in Security Zones, not just detected after the fact.

Compliance & Audit Logging

Audit logging services record API calls, resource changes, administrative actions, and user activity for forensic, compliance, and operational purposes.

Notable distinctions:

• AWS Audit Manager provides the most structured automated evidence collection framework, mapping directly to named compliance frameworks with pre-built assessment templates.
• OCI Audit logs are immutable by design — users cannot delete or modify audit records, which is a hard compliance guarantee.
• Google Assured Workloads goes beyond logging by enforcing data residency, personnel controls, and key management requirements for regulated workloads (FedRAMP, IL2/IL4, HIPAA, EU Sovereignty).

Data Loss Prevention (DLP)

DLP services discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines to prevent unauthorized exposure.

Notable distinctions:

• Amazon Macie is focused exclusively on S3 — it does not scan databases, endpoints, or other storage types natively.
• Microsoft Purview provides the broadest coverage, extending DLP to endpoints (Windows devices), Microsoft 365 collaboration tools, and cloud storage in a single policy framework.
• Oracle Data Safe is database-specific and uniquely covers Oracle database workloads across multi-cloud and on-premises deployments, including OCI, Azure, AWS, and on-prem Oracle databases.
• Google Sensitive Data Protection provides an API-first approach that can be embedded in custom applications for real-time inspection and de-identification.

Threat Detection

Threat detection services analyze telemetry, logs, network traffic, and behavior patterns to identify active threats, anomalies, and security incidents.

Notable distinctions:

• Amazon GuardDuty requires zero configuration and zero agents — it analyzes CloudTrail, VPC Flow Logs, and DNS logs automatically. GuardDuty Extended Threat Detection (2024/2025) adds multi-stage attack sequence detection.
• Microsoft Sentinel is the most feature-complete cloud-native SIEM/SOAR in this comparison, with 300+ data connectors, UEBA, ML-based threat detection, and native integration with Microsoft Defender XDR.
• Google Security Operations (Chronicle) is built on Google's internal infrastructure, offering petabyte-scale log ingestion, 12+ months of hot retention, and Gemini AI-assisted threat hunting. It was named a Leader in the 2025 Gartner Magic Quadrant for SIEM.
• OCI Cloud Guard is primarily a CSPM/configuration-focused tool; for full SIEM capability, OCI customers typically integrate with partner tools or use OCI Logging Analytics.

Summary Matrix

Quick reference table mapping each capability category to the corresponding service on each cloud.

References

• AWS Security, Identity, and Compliance Services Overview
• Choosing AWS Security Services — Decision Guide
• AWS IAM Identity Center
• Amazon GuardDuty
• AWS Security Hub
• AWS CloudTrail
• Amazon Macie
• AWS Certificate Manager
• Azure Security Fundamentals Overview
• Microsoft Entra ID
• Azure Key Vault Security Overview
• Microsoft Defender for Cloud
• Microsoft Sentinel Overview
• Azure Web Application Firewall
• Azure DDoS Protection
• Microsoft Purview DLP
• OCI Security Services Documentation
• OCI Identity Domains Overview
• OCI Cloud Guard
• OCI Vault
• OCI WAF
• Oracle Data Safe
• OCI Certificates
• Google Cloud Security Products
• Google Cloud IAM
• Google Cloud KMS
• Google Secret Manager
• Google Cloud Armor
• Security Command Center
• Google Security Operations (Chronicle)
• Google Sensitive Data Protection
• Google Certificate Authority Service
• Google Assured Workloads