Cloud Service Comparison: Networking Services¶

Quick Reference¶

This guide provides a comprehensive comparison of networking services across AWS, Google Cloud Platform (GCP), and Microsoft Azure. Use this to understand equivalent services when switching cloud providers or studying multiple certifications.

Virtual Networks (VPC/VNet)¶

Key Differences: - AWS: Subnets are AZ-specific, must create subnet in each AZ - GCP: Subnets span all zones in a region, single subnet across zones - Azure: Subnets span availability zones, similar to GCP

Documentation: - 📖 AWS VPC Documentation - Complete VPC guide - 📖 GCP VPC Documentation - Complete VPC guide - 📖 Azure VNet Documentation - Complete VNet guide

Load Balancers¶

Load Balancer Types Comparison:

Application Load Balancers (Layer 7)¶

• AWS ALB: Best for HTTP/HTTPS, advanced routing, Lambda targets
• GCP HTTP(S) LB: Global distribution, Cloud CDN integration, best latency
• Azure Application Gateway: WAF built-in, URL-based routing, SSL offload

Network Load Balancers (Layer 4)¶

• AWS NLB: Ultra-low latency, static IP, handles millions of requests/sec
• GCP Network LB: Regional TCP/UDP, pass-through, preserve source IP
• Azure Load Balancer: Basic and Standard tiers, HA ports, availability zones

Documentation: - 📖 AWS Elastic Load Balancing - Complete ELB guide - 📖 AWS Application Load Balancer - ALB guide - 📖 AWS Network Load Balancer - NLB guide - 📖 GCP Load Balancing - Complete load balancing guide - 📖 Azure Load Balancer - Load Balancer guide - 📖 Azure Application Gateway - Application Gateway guide

Content Delivery Network (CDN)¶

Key Differences: - CloudFront: Most edge locations, best Lambda@Edge for serverless edge computing - Cloud CDN: Tightly integrated with Google Cloud, best for YouTube-like use cases - Azure CDN: Multiple CDN providers (Microsoft, Verizon, Akamai) - Azure Front Door: Global load balancing + CDN, best for enterprise multi-region apps

Documentation: - 📖 AWS CloudFront Documentation - Complete CloudFront guide - 📖 GCP Cloud CDN Documentation - Complete Cloud CDN guide - 📖 Azure CDN Documentation - Azure CDN guide - 📖 Azure Front Door Documentation - Front Door guide

DNS Services¶

Routing Policy Comparison:

Documentation: - 📖 AWS Route 53 Documentation - Complete Route 53 guide - 📖 GCP Cloud DNS Documentation - Complete Cloud DNS guide - 📖 Azure DNS Documentation - Azure DNS guide - 📖 Azure Traffic Manager Documentation - Traffic routing

VPN Services¶

VPN Gateway SKU Comparison (Azure):

Documentation: - 📖 AWS VPN Documentation - Complete VPN guide - 📖 AWS Site-to-Site VPN - Site-to-Site VPN guide - 📖 AWS Client VPN - Client VPN guide - 📖 GCP Cloud VPN Documentation - Cloud VPN guide - 📖 Azure VPN Gateway Documentation - VPN Gateway guide

Dedicated Connections (Private Connectivity)¶

Connection Speed Comparison:

Use Cases: - Hybrid Cloud: Connect on-premises data center to cloud - Data Migration: Large-scale data transfer (faster than internet) - Latency-sensitive: Sub-10ms latency requirements - Compliance: Data cannot traverse public internet - Cost Savings: Reduced data transfer costs for high-volume egress

Documentation: - 📖 AWS Direct Connect Documentation - Complete Direct Connect guide - 📖 GCP Cloud Interconnect Documentation - Cloud Interconnect guide - 📖 Azure ExpressRoute Documentation - ExpressRoute guide

Firewalls and Security Groups¶

Stateful Firewalls (Security Groups)¶

Stateless Firewalls (Network ACLs)¶

Advanced Firewall Services¶

Documentation: - 📖 AWS Security Groups - Security Groups guide - 📖 AWS Network ACLs - Network ACLs guide - 📖 AWS Network Firewall - Network Firewall guide - 📖 GCP VPC Firewall Rules - Firewall rules guide - 📖 GCP Cloud Armor - Cloud Armor guide - 📖 Azure NSG Documentation - NSG guide - 📖 Azure Firewall Documentation - Azure Firewall guide

NAT Gateways¶

NAT Instance vs NAT Gateway:

Documentation: - 📖 AWS NAT Gateway Documentation - NAT Gateway guide - 📖 GCP Cloud NAT Documentation - Cloud NAT guide - 📖 Azure NAT Gateway Documentation - NAT Gateway guide

Private Connectivity and Service Endpoints¶

Endpoint Types:

AWS VPC Endpoints¶

• Gateway Endpoints: S3, DynamoDB (free, route table-based)
• Interface Endpoints: Most AWS services (powered by PrivateLink)
• Gateway Load Balancer Endpoints: Security appliances

GCP Private Service Connect¶

• Consumer Endpoints: Access Google services or partner services
• Producer Endpoints: Expose your services privately

Azure Private Link¶

• Private Endpoints: Access PaaS services (Storage, SQL, etc.)
• Private Link Service: Expose your own services

Documentation: - 📖 AWS PrivateLink Documentation - PrivateLink guide - 📖 AWS VPC Endpoints - VPC Endpoints guide - 📖 GCP Private Service Connect - Private Service Connect guide - 📖 Azure Private Link Documentation - Private Link guide

Transit and Hub-Spoke Architecture¶

Use Cases: - Centralized Connectivity: Single connection point for all networks - Transitive Routing: Allow VPCs to communicate through hub - Hybrid Cloud: Connect on-premises to multiple cloud networks - Multi-region: Connect networks across regions

Documentation: - 📖 AWS Transit Gateway Documentation - Transit Gateway guide - 📖 GCP Network Connectivity Center - Connectivity Center guide - 📖 Azure Virtual WAN Documentation - Virtual WAN guide

Pricing Comparison¶

VPN Gateway Pricing (Monthly estimates)¶

NAT Gateway Pricing (US East/Central region)¶

Load Balancer Pricing (Approximate)¶

Direct Connect / Interconnect / ExpressRoute (1 Gbps Port)¶

Note: Prices vary by region and are subject to change. Always use official pricing calculators.

Pricing Calculators: - 📖 AWS Pricing Calculator - AWS cost estimates - 📖 GCP Pricing Calculator - GCP cost estimates - 📖 Azure Pricing Calculator - Azure cost estimates

CLI Command Comparison¶

Create a VPC/VNet¶

AWS:

# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=MyVPC}]'

# Create subnet
aws ec2 create-subnet --vpc-id vpc-xxxxx --cidr-block 10.0.1.0/24 --availability-zone us-east-1a

GCP:

# Create VPC (custom mode)
gcloud compute networks create my-vpc --subnet-mode=custom

# Create subnet
gcloud compute networks subnets create my-subnet \
  --network=my-vpc \
  --region=us-central1 \
  --range=10.0.1.0/24

Azure:

# Create VNet with subnet
az network vnet create \
  --resource-group myResourceGroup \
  --name myVNet \
  --address-prefix 10.0.0.0/16 \
  --subnet-name mySubnet \
  --subnet-prefix 10.0.1.0/24

Create a Load Balancer¶

AWS (Application Load Balancer):

# Create ALB
aws elbv2 create-load-balancer \
  --name my-alb \
  --subnets subnet-xxxxx subnet-yyyyy \
  --security-groups sg-xxxxx \
  --scheme internet-facing

# Create target group
aws elbv2 create-target-group \
  --name my-targets \
  --protocol HTTP \
  --port 80 \
  --vpc-id vpc-xxxxx

GCP (HTTP(S) Load Balancer):

# Create backend service
gcloud compute backend-services create my-backend-service \
  --protocol=HTTP \
  --port-name=http \
  --health-checks=my-health-check \
  --global

# Create URL map
gcloud compute url-maps create my-url-map \
  --default-service=my-backend-service

# Create HTTP proxy
gcloud compute target-http-proxies create my-http-proxy \
  --url-map=my-url-map

# Create forwarding rule
gcloud compute forwarding-rules create my-http-rule \
  --global \
  --target-http-proxy=my-http-proxy \
  --ports=80

Azure (Application Gateway):

# Create Application Gateway
az network application-gateway create \
  --name myAppGateway \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --subnet mySubnet \
  --capacity 2 \
  --sku Standard_v2 \
  --http-settings-cookie-based-affinity Disabled \
  --frontend-port 80 \
  --http-settings-port 80 \
  --http-settings-protocol Http \
  --public-ip-address myPublicIP

Create Security Group / Firewall Rule¶

AWS:

# Create security group
aws ec2 create-security-group \
  --group-name my-sg \
  --description "My security group" \
  --vpc-id vpc-xxxxx

# Add ingress rule
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxx \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

GCP:

# Create firewall rule
gcloud compute firewall-rules create allow-http \
  --network=my-vpc \
  --allow=tcp:80 \
  --source-ranges=0.0.0.0/0 \
  --target-tags=web-server

Azure:

# Create NSG
az network nsg create \
  --resource-group myResourceGroup \
  --name myNSG

# Add security rule
az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name allow-http \
  --priority 100 \
  --source-address-prefixes '*' \
  --destination-port-ranges 80 \
  --access Allow \
  --protocol Tcp

Create NAT Gateway¶

AWS:

# Allocate Elastic IP
aws ec2 allocate-address --domain vpc

# Create NAT Gateway
aws ec2 create-nat-gateway \
  --subnet-id subnet-xxxxx \
  --allocation-id eipalloc-xxxxx

# Update route table
aws ec2 create-route \
  --route-table-id rtb-xxxxx \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-xxxxx

GCP:

# Create Cloud Router
gcloud compute routers create my-router \
  --network=my-vpc \
  --region=us-central1

# Create Cloud NAT
gcloud compute routers nats create my-nat \
  --router=my-router \
  --region=us-central1 \
  --nat-all-subnet-ip-ranges \
  --auto-allocate-nat-external-ips

Azure:

# Create public IP
az network public-ip create \
  --resource-group myResourceGroup \
  --name myNatIP \
  --sku Standard \
  --allocation-method Static

# Create NAT Gateway
az network nat gateway create \
  --resource-group myResourceGroup \
  --name myNatGateway \
  --public-ip-addresses myNatIP \
  --idle-timeout 10

# Associate with subnet
az network vnet subnet update \
  --resource-group myResourceGroup \
  --vnet-name myVNet \
  --name mySubnet \
  --nat-gateway myNatGateway

Create VPN Connection¶

AWS:

# Create customer gateway
aws ec2 create-customer-gateway \
  --type ipsec.1 \
  --public-ip 203.0.113.12 \
  --bgp-asn 65000

# Create VPN connection
aws ec2 create-vpn-connection \
  --type ipsec.1 \
  --customer-gateway-id cgw-xxxxx \
  --vpn-gateway-id vgw-xxxxx

GCP:

# Create VPN gateway
gcloud compute vpn-gateways create my-vpn-gateway \
  --network=my-vpc \
  --region=us-central1

# Create VPN tunnel
gcloud compute vpn-tunnels create my-tunnel \
  --peer-address=203.0.113.12 \
  --shared-secret=my-secret \
  --target-vpn-gateway=my-vpn-gateway \
  --region=us-central1

Azure:

# Create VPN Gateway
az network vnet-gateway create \
  --resource-group myResourceGroup \
  --name myVpnGateway \
  --public-ip-address myGatewayIP \
  --vnet myVNet \
  --gateway-type Vpn \
  --vpn-type RouteBased \
  --sku VpnGw1 \
  --no-wait

# Create local network gateway (on-premises)
az network local-gateway create \
  --resource-group myResourceGroup \
  --name myLocalGateway \
  --gateway-ip-address 203.0.113.12 \
  --local-address-prefixes 192.168.0.0/16

# Create VPN connection
az network vpn-connection create \
  --resource-group myResourceGroup \
  --name myConnection \
  --vnet-gateway1 myVpnGateway \
  --local-gateway2 myLocalGateway \
  --shared-key "MySharedKey123"

Decision Tree: Which Networking Service?¶

When to Use VPC Peering¶

• ✅ Connect two VPCs in same or different regions
• ✅ Low latency, private connectivity required
• ✅ Simple hub-spoke with few VPCs (< 10)
• ✅ No transitive routing needed
• ❌ Need to connect many VPCs (use Transit Gateway/Virtual WAN)
• ❌ Need centralized management and routing

When to Use Transit Gateway / Virtual WAN¶

• ✅ Hub-and-spoke architecture with 10+ VPCs
• ✅ Need transitive routing between networks
• ✅ Centralized network management
• ✅ Complex routing requirements
• ✅ SD-WAN integration
• ❌ Only 2-3 VPCs (overhead not worth it)
• ❌ Simple point-to-point connectivity

When to Use VPN¶

• ✅ Connect on-premises to cloud
• ✅ Budget-conscious (lower cost than Direct Connect)
• ✅ Setup time < 1 week
• ✅ Bandwidth < 1 Gbps
• ✅ Can tolerate internet latency and variability
• ❌ Need guaranteed latency/bandwidth
• ❌ High bandwidth requirements (> 1 Gbps)
• ❌ Compliance: data cannot traverse internet

When to Use Direct Connect / Interconnect / ExpressRoute¶

• ✅ High bandwidth requirements (> 1 Gbps)
• ✅ Predictable, consistent latency needed
• ✅ Large data migrations
• ✅ Compliance requires private connectivity
• ✅ Cost savings on high egress (> 10 TB/month)
• ❌ Budget constraints (VPN is cheaper)
• ❌ Need immediate setup (takes weeks)

When to Use Application Load Balancer¶

• ✅ HTTP/HTTPS traffic
• ✅ Need path-based or host-based routing
• ✅ Microservices architecture
• ✅ WebSocket support needed
• ✅ WAF integration required
• ❌ Non-HTTP protocols (use Network Load Balancer)
• ❌ Ultra-low latency required (< 1ms)

When to Use Network Load Balancer¶

• ✅ TCP/UDP traffic
• ✅ Ultra-high performance (millions of requests/sec)
• ✅ Static IP required
• ✅ Preserve source IP address
• ✅ Ultra-low latency (< 1ms)
• ❌ Need Layer 7 routing (use Application LB)
• ❌ Need WAF protection

When to Use CDN¶

• ✅ Static content delivery (images, videos, CSS, JS)
• ✅ Global user base
• ✅ Need to reduce origin load
• ✅ Improve page load times
• ✅ DDoS protection
• ❌ Content is dynamic and user-specific
• ❌ Users are in single region (origin might be faster)

When to Use NAT Gateway¶

• ✅ Private instances need internet access
• ✅ Outbound-only internet connectivity
• ✅ Software updates from internet
• ✅ Call external APIs
• ❌ Need inbound internet access (use Load Balancer)
• ❌ Specific port forwarding required (use NAT instance)

When to Use Private Link / VPC Endpoints¶

• ✅ Access AWS/GCP/Azure services without internet
• ✅ Enhanced security requirements
• ✅ Reduce data transfer costs
• ✅ Access third-party SaaS privately
• ❌ Service not supported by Private Link
• ❌ Budget constraints (adds hourly cost)

Key Takeaways¶

AWS Networking Strengths¶

• ✅ Most comprehensive and mature networking services
• ✅ Transit Gateway for complex multi-VPC architectures
• ✅ Extensive third-party integration (SD-WAN, firewalls)
• ✅ Most Direct Connect locations globally
• ✅ Best documentation and learning resources

GCP Networking Strengths¶

• ✅ Simplest networking model (subnets span all zones)
• ✅ Global VPC (single VPC across all regions)
• ✅ Premium vs Standard network tier options
• ✅ Best network performance (Andromeda SDN)
• ✅ Cloud NAT is regional (auto-scaling, HA built-in)
• ✅ No cross-zone data transfer charges within region

Azure Networking Strengths¶

• ✅ Best for hybrid cloud (ExpressRoute, Virtual WAN)
• ✅ Strong SD-WAN integration in Virtual WAN
• ✅ Azure Firewall with built-in threat intelligence
• ✅ Network Watcher for advanced diagnostics
• ✅ Integration with on-premises Active Directory

Common Networking Patterns¶

Pattern 1: Three-Tier Web Application¶

Architecture: - Web tier: Public subnet with ALB/Load Balancer - App tier: Private subnet with application servers - Data tier: Private subnet with databases - NAT Gateway for outbound internet access from private subnets

AWS Example:

Internet → ALB (Public Subnet) → EC2 (Private Subnet) → RDS (Private Subnet)
                                     ↓
                                NAT Gateway → Internet (updates)

Security: - Web tier: Allow 80/443 from internet - App tier: Allow app port from web tier only - Data tier: Allow DB port from app tier only - All private subnets: Route outbound through NAT Gateway

Pattern 2: Hybrid Cloud Connectivity¶

Architecture: - On-premises data center - Direct Connect / ExpressRoute for primary connectivity - VPN as backup for failover - Transit Gateway / Virtual WAN for hub-and-spoke

Redundancy: - Primary: Direct Connect with 2 connections (different locations) - Backup: VPN over internet - BGP for automatic failover

Pattern 3: Multi-Region Global Application¶

Architecture: - CloudFront / Cloud CDN for static content - Global load balancing (Route 53 latency routing / Traffic Manager) - Regional application deployments - Cross-region VPC peering or Transit Gateway peering

Traffic Flow:

User → CDN (edge location) → Global LB → Regional LB → Application

Pattern 4: Hub-and-Spoke Network¶

Architecture: - Hub VPC/VNet with shared services (firewalls, monitoring) - Spoke VPCs/VNets for workloads - Transit Gateway / Virtual WAN for connectivity - Centralized egress through NAT or firewall

Benefits: - Centralized security and logging - Shared services (DNS, Active Directory) - Cost efficiency (single NAT/firewall) - Simplified management

Comparison Matrix: Quick Reference¶

Related Guides: - Compute Service Comparison - Storage Service Comparison - Database Service Comparison - Security Tools Comparison