I would say otherwise. Some basic things that come to mind - db snapshots that works - S3 - Cloud Trail - know who and when access a server and what commands th

I would say otherwise. Some basic things that come to mind - db snapshots that works - S3 - Cloud Trail - know who and when access a server and what commands they enter in their SSH session. - Session Manager - being able to control permissions in a single place. - S3 + Athena + QuickSight - easy reporting at scale - the list goes on and on As soon as you have decent amount of data which you care about AWS became dirt cheap compared to on-perm when user right. Look at the list above and imagine how much effort you would have to put on an ongoing basis to support this.