Letra ChicaDictionary
Not services but structure: how each cloud organizes accounts, networks, zones, identity and metadata. It is where people switching clouds get confused the most.
Billing and quota boundaryOrganization
Which object gets the bill and at what level quotas apply.
Azure
The subscription is the unit of billing and service limits; several subscriptions are grouped under management groups.
AWS
Each account is a billing boundary; with Organizations, member account billing is consolidated in the management account.
GCP
A Cloud Billing account pays for the projects linked to it; quotas generally apply per project.
⚠ Where the analogy breaks
In GCP the billing account is a separate object from the hierarchy: a project can move to another folder without changing who pays for it, and vice versa.
Resource hierarchyOrganization
How accounts and resources are organized, and where permissions and policies are applied and inherited.
Azure
Tenant root group → management groups (up to six levels, not counting the root or subscriptions) → subscriptions → resource groups → resources. Roles and policies assigned higher up are inherited downward.
AWS
Root → nested OUs (up to five levels) → accounts. The account is the boundary for resources, IAM and billing; there's no container equivalent to a resource group inside it.
GCP
Organization → folders (optional, up to ten levels) → projects → resources. The effective IAM policy is the union of the resource's policy and those of all its ancestors.
⚠ Where the analogy breaks
The Azure resource group has no direct equivalent: AWS "Resource Groups" are a tag- or CloudFormation stack-based query, not a container, and in GCP the closest container is the project.
In AWS, SCPs never grant permissions: they set a ceiling, and they don't affect the management account. In Azure and GCP a role assigned higher up does grant access to everything below.
Workforce identityIdentity
Where human users live and how they get access to several accounts, subscriptions or projects.
Azure
Each subscription trusts a single Entra ID tenant; tenant users get roles on management groups, subscriptions or resources.
AWS
IAM is per account. For people, AWS recommends IAM Identity Center, which grants access to several accounts with permission sets, instead of creating IAM users in each account.
GCP
The Google Cloud organization is linked to a Cloud Identity or Workspace account; people get IAM roles in the hierarchy.
⚠ Where the analogy breaks
In Azure there's one directory for every subscription that trusts it. In AWS each account has its own IAM and workforce access is centralized with Identity Center: an IAM user created in one account doesn't exist in the others.
Availability zonesNetworking
How zones are named and whether the name you see points to the same datacenter another account or subscription sees.
Azure
Physical zones are mapped to logical zones per subscription, and two subscriptions can have a different order. Aligning zones across subscriptions requires checking the mapping (az account list-locations).
AWS
The AZ ID identifies the same physical zone in every account. In older accounts in the oldest Regions, the AZ name can point to different zones per account; accounts created since November 2025 get the same mapping.
GCP
Zones are named region + letter. The documentation describes them as logical abstractions of physical resources and doesn't describe a per-project mapping.
⚠ Where the analogy breaks
"Zone 1" in two Azure subscriptions, or "us-east-1a" in two older AWS accounts, doesn't guarantee the same datacenter. If an architecture crosses subscriptions or accounts and depends on per-zone latency or isolation, align by the physical ID.
Virtual network scopeNetworking
Whether the network and its subnets are global, regional or zonal, and what that means for multi-region and multi-zone design.
Azure
The VNet is regional and its subnets span every zone in the region. Multi-region = one VNet per region, connected.
AWS
The VPC is regional and spans every AZ in the region, but each subnet lives in a single AZ. High availability = one subnet per AZ.
GCP
The VPC is global (with its routes and firewall rules) and subnets are regional. A single network can cover several regions.
⚠ Where the analogy breaks
The same word "VPC" means different things in AWS (regional, zonal subnets) and GCP (global, regional subnets). The Azure subnet is closer to GCP's than to AWS's.
Resource identifiersOperations
The format of a resource's full ID, the one that shows up in policies, logs and cross-resource references.
Azure
A hierarchical path /subscriptions/{id}/resourceGroups/{rg}/providers/{namespace}/{type}/{name}.
AWS
arn:partition:service:region:account:resource. Some services omit the region, the account or both (S3 buckets, for example).
GCP
//service.googleapis.com/projects/{project}/… with the service as prefix, e.g. //compute.googleapis.com/projects/p/zones/z/instances/vm.
⚠ Where the analogy breaks
The Azure ID includes the resource group, so moving a resource to another resource group changes its ID. In GCP the project is identified by ID (chosen, permanent) or by number (assigned): some APIs and principals use the number.