Cloud Providers L1-L7
Cloud Providers — 5 vendors and operators, each broken down by layer L1 to L7: what they sell at that layer, and which layer is their home turf.
Alicloud
Home turf: L3
L1 Physical
A cloud takes over essentially everything purchased at L1 in a data centre: cabling, optics, racks, power, cooling and timing equipment are neither visible nor procurable by the user. So this layer is not a product matrix.
L2 Data Link
The core content of this layer is what cloud does *not* have, and that is precisely where data centre migrations go wrong. A VPC is a layer-3 virtual network, and most traditional L2 capability is absent: broadcast and multicast are unsupported, VLANs cannot be extended in, there is no spanning tree or MLAG, and there is no user-configurable switch.
L3 Network
This is the main body of cloud networking and the richest layer in the Alibaba Cloud domain. Beyond VPC, routing and interconnect capabilities themselves, two constraints that run through the whole domain must be made clear here.
L4 Transport
This layer forms a clear contrast with the four vendor domains: apart from Cisco, none of them has an ADC line and L4 distribution relies on ECMP plus third parties, whereas cloud load balancing is a managed service — provisioned on demand, automatically scaled and operations-free, the substantive cloud advantage at this layer.
L5 Session
The session layer in cloud is nothing like it is on network equipment: network devices care about TACACS+ and device logins, while cloud cares about the access control system — every operation on a cloud resource is an API call subject to authentication, making RAM (Resource Access Management) the hub of this layer.
L6 Presentation
This layer is a turning point in the whole reference: the four vendor domains (Cisco, Arista, Juniper, Palo Alto) all present the same hard constraint here — no KMS product line, essentially no ShangMi support, and absence from the domestic substitution catalogue, putting them out of scope for projects under Chinese commercial cryptography compliance; Alibab…
L7 Application
This layer forms another meaningful contrast: WAF, CDN and DNS security are exactly the three product categories that Arista, Juniper and Palo Alto all lack (each of their L7 gap sections states plainly that these must come from Cloudflare, F5 or Akamai), whereas in cloud they are native managed services, available on demand and billed by usage.
Cross-layer: Management & Operations
Cross-layer management in cloud differs from the hardware domains in two fundamental ways, and those are the focus here. First, cost governance carries entirely different weight: hardware is a one-off purchase plus annual maintenance with a largely predictable budget, while cloud is pay-as-you-go with self-service provisioning, so anyone with permission can…
AWS
Home turf: L3
L1 Physical
As in the Alibaba Cloud domain, AWS takes over everything purchased at L1 in a data centre, so this layer is not a product matrix. Three things remain real: Region and Availability Zone placement (determining physical distance, latency and fault domains), purchasing physical Direct Connect ports with carrier installation, and the network performance ceilings…
L2 Data Link
As in the Alibaba Cloud domain, the core of this layer is what cloud does not have. A VPC is a layer-3 virtual network: no broadcast or multicast, no VLAN extension, no spanning tree or stacking, and no user-configurable switch. L2-dependent designs break — keepalived's multicast default, broadcast-based service discovery, PXE network boot.
L3 Network
This is the main body of AWS networking. Most concepts correspond to the Alibaba Cloud domain, so the focus here is on the differences that change architecture and cost. Three matter most: the security group connection tracking mechanism — security groups are stateful and each connection consumes a tracking entry whose limit varies by instance type, so hitti…
L4 Transport
AWS has one form factor at this layer that Alibaba Cloud lacks and that deserves emphasis: the Gateway Load Balancer (GWLB), purpose-built for inserting third-party security appliances (firewalls, IDS, deep packet inspection) into the traffic path, using GENEVE encapsulation to steer traffic transparently to an appliance fleet with health checking and horizo…
L5 Session
This is the highest-value layer in the AWS domain because IAM policy evaluation is considerably more complex than Alibaba Cloud RAM and is the most common source of confusion on AWS.
L6 Presentation
This layer forms a reverse contrast with the Alibaba Cloud domain: that domain's L6 was a turning point for the whole reference because it filled the ShangMi and compliance gap shared by four foreign vendors, whereas AWS sits with those four vendors on this point — no ShangMi (SM2/SM3/SM4) support and absence from the Chinese domestic substitution catalogue…
L7 Application
AWS products at this layer broadly correspond to Alibaba Cloud (WAF, CDN, DNS, API gateway), so the focus is on three practical differences. First, a key cost difference: transfer out from CloudFront to the internet is cheaper than transfer directly from instances, and origin fetch traffic is free — which makes routing outbound traffic through the CDN both a…
Cross-layer: Management & Operations
The AWS cross-layer focus matches the Alibaba Cloud domain (cost governance and multi-account organization), with three differences worth emphasis. First, service control policies (SCPs) connect directly to the policy evaluation at L5 — they are the organizational expression of the 'can only narrow, never widen' rule and the only hard mechanism preventing me…
Azure
Home turf: L3 / L5
L1 Physical
Like the AWS and Alibaba Cloud domains, Azure takes over everything that would otherwise need procuring at the physical layer in a data centre, so this layer isn't a product matrix.
L2 Data Link
Like the AWS and Alibaba Cloud domains, the core point is 'what doesn't exist in the cloud': a VNet is a layer-3 virtual network, with no support for broadcast or multicast, no way to extend a VLAN, and no spanning tree or stacking.
L3 Network
This is Azure networking's main layer, with concepts largely corresponding to the AWS and Alibaba Cloud domains, so the focus here is on three real differences. First, the network security group's connection-tracking mechanism: stateful like a security group, but attachable at both the subnet and network-interface levels simultaneously, with rules at both le…
L4 Transport
Azure's product split at this layer has a point that's easy to confuse with AWS: Load Balancer (layer 4) and Application Gateway (layer 7) are two separate products, unlike AWS covering the same product family with two SKUs (ALB/NLB) — if you only need layer-4 load balancing but buy Application Gateway, you take on unnecessary complexity and cost; conversely…
L5 Session
This is this domain's highest-information-value layer, because Microsoft Entra ID's (formerly Azure Active Directory) tenant model is a fundamentally different identity system from AWS IAM's account model — and it's the place most prone to a mental-model mismatch when migrating between clouds.
L6 Presentation
Like this page's AWS domain, this layer stands in stark contrast to this page's domestic-vendor domains: Azure, like Cisco, Arista, Juniper, Palo Alto and AWS, has no Chinese SM (SM2/SM3/SM4) support and is not on the domestic Xinchuang catalogue — for domestic projects with commercial-cryptography compliance or localization requirements, Azure is not an opt…
L7 Application
The most confusing point about Azure at this layer is that it splits into three separate products what AWS Route 53 handles as one: Azure DNS (pure DNS zone hosting), Traffic Manager (traffic routing at the DNS-resolution level — for example, returning different resolution results by geography or priority, but not itself proxying traffic), and Front Door (a…
Cross-layer: Management & Operations
Azure's cross-layer focus matches the AWS and Alibaba Cloud domains (cost governance and multi-account/multi-subscription organization), but two differences are worth highlighting. First, the resource group, an Azure-specific organizational unit with no direct counterpart in either AWS or Alibaba Cloud: every resource under a subscription must belong to some…
GCP
Home turf: L2 / L7
L1 Physical
Like the AWS, Alibaba Cloud and Azure domains, GCP takes over everything that would otherwise need procuring at the physical layer in a data centre, so this layer isn't a product matrix. What remains real is Region and Availability Zone placement, the physical procurement of an Interconnect port, and the network performance ceiling tied to a given VM size.
L2 Data Link
This is this domain's first star layer, and the point of most fundamental architectural difference from AWS, Alibaba Cloud and Azure: a GCP VPC is a genuinely global resource, not a regional one.
L3 Network
This layer needs to clarify two GCP-specific structures. First, Shared VPC: a 'host project' holds the VPC network, and multiple 'service projects'' resources can directly use the host project's subnets, decoupling network management from business-resource management across different teams — not quite the same as AWS's VPC sharing (via RAM) or Azure's single…
L4 Transport
Similar in spirit to the product split this page's Azure domain emphasizes, GCP likewise designs layer-4 load balancing (Passthrough Network Load Balancer) and layer-7 load balancing (covered under L7's global load balancing) as separate products, but with a different emphasis: GCP's layer-4 passthrough load balancer is fundamentally a regional resource — th…
L5 Session
The core of this layer is Identity-Aware Proxy (IAP) — the productized external form of Google's internal BeyondCorp zero-trust philosophy. BeyondCorp is an approach Google began practising internally years ago, whose core claim is that a device shouldn't be trusted by default just because it's on the corporate internal network — access control should be bas…
L6 Presentation
Like this page's AWS and Azure domains, this layer stands in stark contrast to this page's domestic-vendor domains: GCP, like Cisco, Arista, Juniper, Palo Alto, AWS and Azure, has no Chinese SM (SM2/SM3/SM4) support and is not on the domestic Xinchuang catalogue — for domestic projects with commercial-cryptography compliance or localization requirements, GCP…
L7 Application
This is this domain's second star layer, and a natural extension of the global VPC architecture (see L2) into the application layer: the Global External Application Load Balancer covers backends across multiple regions with a single global anchor IP — this anchor IP is broadcast via anycast from Google edge nodes worldwide, a client's request is automaticall…
Cross-layer: Management & Operations
The Azure domain uses the Resource Group as a first-class organizational unit and Management Group plus Policy for organization-level governance; GCP's corresponding structure at this layer — the resource hierarchy itself (Organization → Folder → Project) — was already covered at L3, so what's genuinely worth expanding on for cross-layer governance here is t…
OCI
Home turf: L1 / L3
L1 Physical
Like the other cloud domains on this page, OCI takes over everything that would otherwise need procuring at the physical layer in a data centre, so this layer isn't a product matrix.
L2 Data Link
This layer needs to clarify an easily overlooked OCI design: it provides two parallel firewall mechanisms at once — Security Lists (bound to a subnet) and Network Security Groups (NSGs, bound to a resource) — both take effect simultaneously, and the actual allowed rule set is their combination.
L3 Network
This is this domain's main networking layer. A VCN is a regional resource (like AWS VPC and Azure VNet, not a global resource like GCP's VPC), and cross-region connectivity requires remote VCN peering through the Dynamic Routing Gateway (DRG) — DRG v2 can serve as a single hub for multiple VCNs, FastConnect circuits, site-to-site VPNs and cross-region peerin…
L4 Transport
Similar in spirit to the product split the Azure domain emphasizes, OCI likewise designs layer-7 load balancing (Load Balancer) and layer-4 passthrough load balancing (Network Load Balancer) as separate products, but there's a genuine billing difference worth calling out separately: the Network Load Balancer itself carries no instance-hour charge or data-pro…
L5 Session
The point most worth expanding on separately at this layer is IAM's sentence-style policy syntax: an OCI permission policy isn't written as a JSON document — it's written as a sentence close to natural language, such as 'Allow group Administrators to manage all-resources in tenancy' — different from AWS's, Azure's and GCP's structured-JSON or dedicated polic…
L6 Presentation
Like this page's AWS, Azure and GCP domains, this layer stands in stark contrast to this page's domestic-vendor domains: OCI, like the other four, has no Chinese SM (SM2/SM3/SM4) support and is not on the domestic Xinchuang catalogue — for domestic projects with commercial-cryptography compliance or localization requirements, OCI is not an option.
L7 Application
This layer needs to first state honestly a contrast with this page's GCP domain: GCP's global external load balancer covers multi-region backends behind a single global anchor IP (see the GCP domain's L7), while OCI's Load Balancer (layer 7), like its VCN, is a regional resource with no cross-region single-entry-point capability — if a business needs global…
Cross-layer: Management & Operations
The core of this layer is the Compartment: unlike an AWS account, an Azure subscription or a GCP project, a compartment is a purely logical partition within the same tenancy — clear resource isolation and permission boundaries can be achieved without creating a separate account/tenancy for a different team or environment.