Cloud Provider Comparison¶

Physical datacenter (AWS region)
  │
  ├─ Your VPC (your private building)
  │  ├─ Subnet A (floor 1, private — no internet)
  │  ├─ Subnet B (floor 2, public — has internet gateway)
  │  └─ Security Group = door policy for each instance
  │
  ├─ Another customer's VPC (another private building, completely isolated)
  │
  └─ AWS services (shared, accessed via VPC endpoints)

AWS VPC          ↔   GCP VPC                    ↔   Azure Virtual Network
  Subnet         ↔   Subnetwork                 ↔   Subnet
  Security Group ↔   Firewall Rules             ↔   Network Security Group
  NACLs          ↔   (built into VPC)           ↔   (built into vNet)
  IGW            ↔   Cloud NAT / Cloud Router   ↔   Public IP / NAT Gateway

Three layers:

Layer 1: Network-level (VPC)
  Question: "Can this EC2 instance talk to that database?"
  Answer: Security Group rules + NACLs + route tables

Layer 2: Identity-level (IAM)
  Question: "Can this AWS principal delete this S3 bucket?"
  Answer: IAM policies (roles and permissions)

Layer 3: Application-level (your code)
  Question: "Can this user read this other user's data?"
  Answer: Your application authorization logic

Internet
  │
  ├─ Security Group (network layer)
  │  └─ Allow: TCP:443 from 0.0.0.0/0
  │
  ALB (in public subnet)
  │
  ├─ Security Group (network layer)
  │  └─ Allow: TCP:8080 from ALB security group
  │
  EC2 App Server (in private subnet)
  │ IAM Role: S3ReadOnly (identity layer)
  │ Trusts: Code on this instance can read from S3
  │
  └─ S3 Bucket
     Resource Policy: Only EC2 instance with S3ReadOnly role can read

AWS                    ↔   GCP                       ↔   Azure
────────────────────────────────────────────────────────────────
IAM Roles              ↔   IAM Roles                  ↔   RBAC Roles
IAM Policies           ↔   IAM Predefined Roles       ↔   Role Definitions
EC2 Instance Profile   ↔   Service Account            ↔   Managed Identity
Assume Role            ↔   Workload Identity / SA impersonation ↔   Managed Identity
                         (not a Service Account Key — keys are long-lived JSON files)
STS (temporary tokens) ↔   OAuth2 tokens              ↔   JWT tokens

RDS (database)
  Lives in: VPC (private or public subnet)
  Protected by: Security Group + IAM roles (who can connect?)
  Access: Can only be reached if your app is in the same VPC

S3 (storage)
  Location: Not in VPC (but can use VPC endpoints to reach privately)
  Protected by: IAM policies (who can read/write?) + bucket policies
  Access: Your EC2 instance needs IAM role with S3 permissions

Lambda (serverless)
  Execution: Can run in your VPC (private) or outside it
  Protected by: IAM role (what can this Lambda do?)
  Access: Lambda needs IAM permission to read RDS, write S3, etc.

ALB (load balancer)
  Location: In VPC (public subnet)
  Protected by: Security Group (allow HTTP/HTTPS?)
  Access: Routes traffic to EC2 instances in private subnet

Low-level (you manage everything)          High-level (cloud manages everything)
─────────────────────────────────────────────────────────────────────────────────
VM                                         Serverless
Self-managed DB                            Managed database
Containers (you orchestrate)                Managed orchestration
Custom monitoring                           Built-in monitoring

AWS Path:
  Self-managed: EC2 + install Postgres yourself → full control, ~$0
  RDS:          AWS manages backups, patches, failover → pay 3× more, sleep 10× better

GCP Path:
  Self-managed: Compute Engine + install Postgres → same as AWS
  Cloud SQL:    GCP manages backups, patches, failover → pay similar to RDS, same benefits

Azure Path:
  Self-managed: VM + install Postgres → same
  Azure SQL:    Azure manages everything → similar cost, same benefits

AWS                          GCP                        Azure
─────────────────────────────────────────────────────────────────
EC2 (bare VM, you config)   Compute Engine             Virtual Machines
ECS (Docker orchestration)  GKE (Kubernetes)           AKS (Kubernetes)
Fargate (managed ECS)       Cloud Run (serverless)     Container Instances

RDS (managed DB)            Cloud SQL (managed DB)     Azure SQL
DynamoDB (serverless DB)    Firestore (serverless DB) Cosmos DB (serverless DB)

S3 (object storage)         Cloud Storage              Blob Storage
Lambda (serverless code)    Cloud Functions/Cloud Run  Azure Functions

EC2 (VMs)
  ├─ You choose: OS, CPU, RAM, network
  ├─ You manage: OS patches, application deployment, scaling
  └─ Use when: Need full control, legacy apps, specific OS

ECS (Container orchestration)
  ├─ You provide: Docker images
  ├─ AWS manages: Container scheduling, networking
  └─ Use when: Containers but don't want Kubernetes

EKS (Kubernetes)
  ├─ You provide: Kubernetes manifests
  ├─ AWS manages: Control plane, etcd backups
  └─ Use when: Need Kubernetes, want AWS to handle operations

Lambda (Serverless)
  ├─ You provide: Code (Python, Node, Go, Java, Rust)
  ├─ AWS manages: Everything (scaling, security, OS)
  └─ Use when: Event-driven, unpredictable traffic, low volume

Fargate (Managed containers)
  ├─ You provide: Docker image
  ├─ AWS manages: EC2 instances, orchestration
  └─ Use when: Want ECS without managing EC2

AWS                        GCP                           Azure
────────────────────────────────────────────────────────────────
EC2                    ↔   Compute Engine              ↔ Virtual Machines
ECS                    ↔   (no exact equivalent)        ↔ Container Instances
EKS                    ↔   GKE (more mature)           ↔ AKS
Lambda                 ↔   Cloud Functions             ↔ Azure Functions
Fargate                ↔   Cloud Run                    ↔ Container Instances

S3 (Object storage)
  ├─ Use for: User uploads, backups, static files, logs
  ├─ Structure: Buckets (namespaced folders), zero folder hierarchy
  └─ Cost: $0.023/GB/month + requests

EBS (Block storage for VMs)
  ├─ Use for: Database files, app data on EC2
  ├─ Structure: Volumes attached to instances (like hard drives)
  └─ Cost: $0.10/GB/month provisioned (whether you use it or not)

RDS (Managed relational DB)
  ├─ Use for: Postgres, MySQL, Aurora (AWS's proprietary, PostgreSQL-compatible)
  ├─ Managed: Backups, failover, patches, read replicas
  └─ Cost: $0.195/hour (db.t3.micro) + storage

DynamoDB (Managed NoSQL, serverless)
  ├─ Use for: Document storage, real-time data, high throughput
  ├─ Managed: Global tables, automatic scaling, backups
  └─ Cost: $1.25/M write units + $0.25/M read units (or on-demand)

Elasticache (Managed cache)
  ├─ Use for: Redis or Memcached in front of RDS
  ├─ Managed: Replication, failover, cluster mode
  └─ Cost: $0.017/hour (cache.t3.micro)

AWS             ↔   GCP                    ↔   Azure
────────────────────────────────────────────────────────
S3              ↔   Cloud Storage          ↔   Blob Storage
EBS             ↔   Persistent Disk        ↔   Managed Disk
RDS             ↔   Cloud SQL              ↔   Azure SQL
DynamoDB        ↔   Firestore/BigTable     ↔   Cosmos DB
Elasticache     ↔   Memorystore            ↔   Cache for Redis

VPC (Virtual Private Cloud)
  ├─ Your isolated network within AWS
  ├─ Contains subnets (public, private), security groups (firewalls), route tables
  └─ Think: a corporation's internal network, but in the cloud

Security Groups
  ├─ Inbound rules: "allow traffic from X"
  ├─ Outbound rules: "allow traffic to X"
  └─ Applied per-instance (fine-grained firewall)

ALB (Application Load Balancer) / NLB (Network Load Balancer)
  ├─ ALB: L7, route by hostname/path, typical for microservices
  ├─ NLB: L4, millions of RPS, non-HTTP protocols
  └─ Result: Single VIP distributes traffic to backends

Route53 (DNS + routing)
  ├─ Manage DNS records (A, AAAA, CNAME, MX)
  ├─ Geographic routing: "users in US → us-west API, users in EU → eu-west API"
  └─ Health checks: failover if a region is down

AWS             ↔   GCP                              ↔   Azure
────────────────────────────────────────────────────────────────────
VPC             ↔   VPC                              ↔   Virtual Network
Security Groups ↔   Firewall Rules                    ↔   Network Security Groups
ALB             ↔   Cloud Load Balancer (external)   ↔   Application Gateway
NLB             ↔   Cloud Load Balancer (internal)   ↔   Basic LB
Route53         ↔   Cloud DNS                        ↔   Azure DNS
CloudFront      ↔   Cloud CDN                        ↔   Front Door

IAM (Identity & Access Management)
  ├─ Roles: "what can this principal do?" (e.g., ec2-admin)
  ├─ Policies: Statements like "allow s3:GetObject on bucket:my-bucket"
  └─ Applied to: Users, roles, services

Example policy:
  {
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::my-bucket/*"
  }
  ↓ means ↓
  "Let this principal read objects in my-bucket"

AWS                 ↔   GCP                      ↔   Azure
────────────────────────────────────────────────────────────
IAM                 ↔   IAM                      ↔   RBAC (Role-Based Access Control)
Roles & Policies    ↔   Roles & Permissions      ↔   Roles & Assignments
STS (temporary creds) ↔   Service Accounts       ↔   Service Principals

You pay for:
- Compute: EC2 (per hour or second), Lambda (per invocation)
- Storage: S3 (per GB stored + per request), EBS (per GB provisioned)
- Data transfer: Egress out of AWS (expensive; ingress free)
- Services: RDS, ALB, etc. (per hour or per request)

Cost tricks:
- Reserved instances: commit 1-3 years, get 40-60% discount
- Spot instances: up to 90% off, but cloud can reclaim anytime
- Data transfer within region: cheap; cross-region: 10× more
- Putting data on S3 Glacier: very cheap but slow to retrieve

EC2 t3.micro:              $7/month
RDS db.t3.micro:          $25/month
ALB:                       $16/month
Data (10 GB/month):        $1/month
───────────────────
Total:                    ~$50/month

Same with reserved instances (1 year commitment):
EC2: $4/month
RDS: $12/month
ALB: $16/month
───────────────────
Total:                    ~$32/month

You pay for:
- Compute: Per second (more granular than AWS)
- Storage: Per GB (slightly cheaper than S3)
- Requests: Per million requests (BigQuery, Cloud Run, etc.)
- Data transfer: Ingress free; egress cheap (cheaper than AWS)

No reserved instances by default, but automatic 25-30% discount for sustained use.

Example: A small API on Cloud Run
Cold start: ~100ms, costs nothing until request arrives
Per request: ~$0.000002 (for 128MB, 100ms)
1M requests/month: ~$2
Data storage: ~$0.05/GB
───────────────────
Total: ~$10-50/month (depending on traffic)

You pay for:
- Compute: Per hour or second
- Storage: Per GB
- Requests: Depends on service

Reserved instances: Up to 72% discount for 3-year commitment (better than AWS).
Hybrid benefit: Bring your own Windows/SQL license, get discount.

Example: A Windows VM with SQL Server
VM (D2s):              $100/month
SQL Server license:    $100-200/month (or bring-your-own)
Storage (100GB):       $20/month
───────────────────
Total:                $220-320/month

With reserved instance (3-year):
VM:                   $40/month
───────────────────
Total:               ~$160-260/month

Cost: $50/month (or $32/month reserved)
Effort: Manage security groups, VPC, etc.

Cost: $20-50/month (depends on traffic)
Effort: Deploy container, forget about infrastructure