A Comparative Security Analysis of Storage-Integrated Web Applications in Heterogeneous Cloud Environments

Cloud computing has become a cornerstone of modern IT infrastructure, offering flexible and cost-efficient resources. However, security challenges in storage-integrated web applications remain a significant concern, especially in multi-cloud and heterogeneous deployments. This paper presents a comparative analysis of three major cloud providers—Amazon AWS, Microsoft Azure, and Alibaba Cloud—focusing on both homogeneous deployments (e.g., AWS VM with AWS S3) and heterogeneous deployments (e.g., AWS VM with Azure Blob). Using OWASP ZAP for automated penetration testing and network packet capture for forensic analysis, we systematically evaluate vulnerabilities in transport-layer security, authentication tokens, and web application configurations. The results highlight provider-specific weaknesses: AWS S3 often exposes insecure HTTP and plaintext transmission, Azure Blob suffers from misconfigured security headers and CSP-related issues, and Alibaba OSS demonstrates recurring problems in token management. Importantly, heterogeneous deployments do not inherently guarantee stronger security; some combinations reduce risks while introducing new weaknesses. Based on our findings, we identify VM–storage pairings such as EC2–Blob, Azure VM–S3, and ECS–Blob as comparatively more secure configurations. This work contributes a unified framework for analyzing multi-cloud vulnerabilities, advancing both academic understanding and practical defense strategies for securing cloud-based storage-integrated web applications.