Every multi-cloud estate eventually copies a firewall rule from one provider to another and assumes the copy means the same thing. It rarely does.

A rule that reads "allow the app tier to reach the database on 5432" can be tight in one cloud and surprisingly open in another — not because anyone typed the wrong port, but because the four major clouds disagree on defaults, statefulness, identity, and what happens when no rule matches. The translation error is silent. Tests from inside the allowed path pass, and the extra exposure only shows up in an audit, a scan, or an incident.

The same sentence means four different things

Start with the building blocks, because they do not line up one-to-one.

AWS security groups are stateful and allow-only. Return traffic for an allowed connection is permitted automatically, there is no explicit deny, and a workload with no matching allow simply cannot connect.…