Cloud cheat sheet: Azure vs AWS vs GCP

16.1 How to read this cheat sheet Added

Four ideas make every row easier to read: who is responsible for what, how each cloud names its locations, how you pay, and how each cloud decides who can do what.

1. Shared responsibility

The cloud always secures the buildings, hardware and hypervisor. The more managed the service, the more the cloud takes on. You always own your data, your identities and access rules, and your configuration.

2. Regions and zones

3. Pricing models

4. Identity model

16.2 Compute: VMs, app platforms & functions Added

Where your code runs. Pick by how much of the server you want to manage, from a full VM down to a single function.

16.3 Containers & Kubernetes Added

Package the app and its runtime as an image, then let a managed platform run, scale and heal it. Choose serverless containers first and Kubernetes when you need its control.

16.4 Storage: object, block, file & archive Added

Where bytes live. Object storage for files and data lakes, block storage as a VM's disk, file shares for apps that need a drive letter, and archive for records you must keep but rarely read.

Corrected from the PDF: "File Storage" is Azure Files and "File Store" is Filestore. GCP block storage now includes Hyperdisk as well as Persistent Disk.

// Same job, three clouds: each SDK finds credentials without a key in code
// Azure: DefaultAzureCredential tries env vars, workload/managed identity, then your dev login
var blobs = new BlobServiceClient(new Uri("https://stbank.blob.core.windows.net"),
    new DefaultAzureCredential());
await blobs.GetBlobContainerClient("statements")
    .UploadBlobAsync("2026-10/acc-42.pdf", BinaryData.FromBytes(pdf));

// AWS: the default credential chain finds env vars, profile/SSO, or the IAM role
var s3 = new AmazonS3Client(RegionEndpoint.APSoutheast2);
await s3.PutObjectAsync(new PutObjectRequest
    { BucketName = "bank-statements", Key = "2026-10/acc-42.pdf", InputStream = new MemoryStream(pdf) });

// GCP: Application Default Credentials (attached service account, or gcloud login on dev)
var gcs = await StorageClient.CreateAsync();
await gcs.UploadObjectAsync("bank-statements", "2026-10/acc-42.pdf", "application/pdf", new MemoryStream(pdf));

16.5 Networking, DNS, load balancing & edge Added

How traffic reaches your app and how your services talk privately: private networks, DNS, load balancers, CDN and WAF at the edge, and links back to the data centre.

16.6 Databases Added

Managed databases: the cloud handles patching, backups and failover. Choose by data shape and access pattern, not by brand.

Corrected from the PDF: it maps DynamoDB and Cosmos DB to Firebase Realtime Database. For server-side apps the closer match is Firestore (documents) or Bigtable (wide-column). Realtime Database is mainly a mobile/web sync store.

16.7 Analytics, big data & data integration Added

Move data from operational systems into a lake and a warehouse, process it in batch or as a stream, and serve it to dashboards and models.

Corrected from the PDF: it puts Kinesis, "Streaming Analytics" and Dataflow in one row. Ingestion (Kinesis Data Streams · Event Hubs · Pub/Sub) and processing (Managed Service for Apache Flink · Stream Analytics · Dataflow) are separate jobs, so they get separate rows here.

16.8 Messaging, events & workflows Added

Let services talk without waiting on each other: queues for work, topics for fan-out, event routers for "something happened", and workflow engines for multi-step processes. Section 10 covers the patterns.

Corrected from the PDF: it lines up SNS, Service Bus and Firebase Cloud Messaging, and SQS, Storage Queues and Pub/Sub. FCM is mobile push, and Pub/Sub is a pub/sub service. The closest GCP match for a plain work queue is Cloud Tasks or a Pub/Sub pull subscription.

16.9 AI & machine learning Added

Train and serve your own models, call hosted foundation models, run agents, and add prebuilt AI (documents, speech, vision) through an API. This category changes names the fastest.

16.10 Identity, keys & security Added

Who can do what, how code proves who it is without passwords, where keys and secrets live, and how you spot threats and audit changes.

Corrected from the PDF: it maps AWS IAM to Azure Active Directory and GCP Cloud Identity. Azure AD is now Microsoft Entra ID, and those are directories for people. The permission systems are Azure RBAC, AWS IAM and Cloud IAM.

// Read one secret on each cloud, with no password in code or config
// Azure Key Vault
var kv = new SecretClient(new Uri("https://kv-bank.vault.azure.net/"), new DefaultAzureCredential());
string azurePwd = (await kv.GetSecretAsync("db-password")).Value.Value;

// AWS Secrets Manager (credentials from the IAM role via the default chain)
using var sm = new AmazonSecretsManagerClient();
var resp = await sm.GetSecretValueAsync(new GetSecretValueRequest { SecretId = "db-password" });
string awsPwd = resp.SecretString;

// Google Secret Manager (Application Default Credentials)
var gsm = await SecretManagerServiceClient.CreateAsync();
var ver = await gsm.AccessSecretVersionAsync(new SecretVersionName("bank-prod", "db-password", "latest"));
string gcpPwd = ver.Payload.Data.ToStringUtf8();

16.11 Monitoring, management & infrastructure as code Added

See what's happening (metrics, logs, traces, alerts), build environments from code, enforce rules, and keep the bill under control.

Corrected from the PDF: its "Resource Manager" (Azure) is the control plane that every tool talks to; the templates you write are Bicep / ARM. Its GCP entry, Deployment Manager, has been retired (below).

16.12 DevOps & developer tools Added

Where code lives, how it's built and tested, where packages and images are stored, and how releases reach production. Many teams use GitHub on every cloud; these are the native options. Section 15 covers the practices.

16.13 Choosing a cloud (or multi-cloud) Added

Most organisations pick one primary cloud, add a second for specific strengths or regulation, and keep some systems on-prem. Choose on skills, services, compliance and commercials, then build a landing zone before the first workload.

Decision factors

Landing zones: the foundation before workloads

Multi-cloud vs hybrid

16.14 FinOps and cloud cost optimisation Added

FinOps makes engineering, finance and product share ownership of cloud spend, so cost becomes an engineering metric measured per unit of business value.

How it works

Order of attack

Native cost tools (checked Oct 2026)

FOCUS (FinOps Open Cost and Usage Specification) is one schema for billing data from every cloud, so multi-cloud showback doesn't need custom mapping.

Trade-offs

// Month-to-date actual cost per "app" tag, for a showback report
var arm = new ArmClient(new DefaultAzureCredential());   // needs Cost Management Reader
var scope = new ResourceIdentifier($"/subscriptions/{subscriptionId}");

var dataset = new QueryDataset();
dataset.Aggregation["totalCost"] = new QueryAggregation("PreTaxCost", FunctionType.Sum);
dataset.Grouping.Add(new QueryGrouping(QueryColumnType.TagKey, "app"));

var query = new QueryDefinition(ExportType.ActualCost, TimeframeType.MonthToDate, dataset);
QueryResult result = (await arm.UsageQueryAsync(scope, query)).Value;

// Column names are in result.Columns; divide by payments processed for unit cost
foreach (var row in result.Rows)
    Console.WriteLine(string.Join(" | ", row));