ProLicense conducted an independent OpenJDK comparison of Azul Platform Core and Amazon Corretto
In a detailed study, Oracle audit consultancy ProLicense conducted an OpenJDK comparison between two OpenJDK distributions, Azul Platform Core and Amazon Corretto. Considering performance, security, flexibility, and other attributes, ProLicense experts chose Core as the better choice for most companies.
According to research from Azul and other companies, organizations that pay for Oracle Java have accelerated their search for alternative Java providers since Oracle changed its pricing model in January 2023. In Azul’s 2024 Oracle Usage, Pricing and Migration Survey & Report, 86% of companies using Oracle Java are currently migrating or planning to migrate to an alternate Java provider. The question is which OpenJDK distribution to switch to. To try and sift through the evidence for the answer, German Oracle licensing and advisory consultancy ProLicense compared Azul Platform Core to Amazon Corretto in a detailed three-part analysis.
As ProLicense points out in part one of its study, selecting the right Java vendor can impact the performance, security and maintainability of Java applications. Companies must find a solution that both meets the requirements of their specific workloads and is scalable in the long term.
In the independent, unsolicited study, ProLicense selected Azul Platform Core for its security, flexibility, and other attributes. “In a detailed analysis of the two leading commercial OpenJDK distributions, Azul Platform Core and Amazon Corretto, Azul Platform Core has proven to be the preferred choice for companies looking for a secure, flexible Java runtime environment,” wrote Markus Oberg of ProLicense.
| Features | Azul Platform Core | Amazon Corretto |
|---|---|---|
| Java version support | Very broad, from older to the latest LTS versions | Focus on current LTS versions |
| Platform diversity | Very broad, many operating systems and architectures | Focus on common platforms |
| Security | Proactive security approach, additional security services | Strong security through AWS infrastructure |
| Support | Comprehensive support with fast response time | Support primarily for AWS customers |
| Additional offers | Azul Platform Prime, Azul Intelligence Cloud | Tight integration in AWS cloud |
General OpenJDK comparison
According to ProLicense, Azul Platform Core proved to be the more comprehensive solution based on several advantages:
- Industry-leading commercial support: Azul offers comprehensive commercial support that covers all major public clouds as well as on-premises environments. Companies can run their Java applications securely regardless of their cloud strategy/architecture strategy.
- Additional services for greater security: Azul offers a range of services that other OpenJDK distributions don’t, including security-only updates.
- Flexibility and independence: Azul Platform Core is compatible with all cloud platforms, giving companies flexibility to deploy their Java applications in different environments.
- Experienced experts: Azul’s team of Java-only engineers average 20+ years of experience.
- Independence: Azul does not belong to any of the major software vendors and operates independently.
The study does credit Corretto as a solid solution for companies that are already heavily invested in AWS, based on seamless integration into the AWS environment and attractive costs. However, Corretto has a limited range of functions compared to Core, and support is primarily focused on AWS-specific workloads.
Comparing Java security options
“Companies place great value on a stable and secure IT environment,” wrote Christian Grave, licensing expert and managing director of ProLicense. “This also applies to the Java distribution used.”
The study lists the following attributes about Azul Platform Core:
- Fast security updates: Azul provides customers with both security-only updates called Critical Patch Updates (CPUs) and full updates called Patch Set Updates (PSUs) in a timely manner. Azul is the only company other than Oracle to offer CPUs, which are ready for rapid deployment to production with low risk of regression.
- Consistent quality: Azul has many years of experience and the largest Java development team outside Oracle, which ensures reliable compliance with SLAs for security updates.
- Backward compatibility: Azul strives to backport all fixes from each quarterly update to all supported Java versions, ensuring stability and security of older applications.
- No regressions: The CPUs have never caused regressions, which indicates the high quality and stability of their updates.
The analysis observed the following about Corretto:
- Best-effort approach: Corretto makes its best effort to provide PSUs but does not guarantee the availability and timeframe.
- Common issues after updates: Corretto’s quarterly PSU updates regularly require additional, unscheduled bug fixes to address issues introduced by new builds, possibly causing business disruption and consuming customer resources.
“From a security perspective, Azul seems to have the advantage,” Grave wrote in the report. The report notes the consistent delivery of timely security updates, backporting security fixes and the absence of regressions speak for greater stability and reliability.
Java versions and platform diversity
Azul Platform Core supports versions from Java 6 and 7 to the latest Long-Term Support (LTS) versions and beyond: 8, 11, 17, 21, 23+. Core customers use their existing applications securely while benefiting from the latest Java features. Amazon Corretto, on the other hand, focuses on the more recent LTS versions but does not offer support for older versions.
Since many companies still use older versions, ProLicense recommends all companies to ask themselves whether this can trigger security issues.
According to the Oracle Usage, Pricing and Migration report, 10% of companies that use Java still use Java 6 and 13% still use Java 7 (participants could select more than one answer).
Azul Platform Core supports a wide range of operating systems (Linux, Windows, macOS, Solaris, QNX, AIX) and architectures (ARM, x86, MIPS, PPC, SPARC), making it a flexible choice for heterogeneous IT environments. Amazon Corretto focuses on the most common platforms, but the choice of configurations is smaller. “In contrast, Azul offers maximum flexibility for customers,” the report states.
Azul has its own security team and also offers patent and non-contamination indemnification protection against possible patent infringements. Azul thus protects the customer from financial damage in this environment too.
Although Amazon Corretto benefits from AWS’s strong security infrastructure and Corretto customers receive regular Patch Set Updates, Corretto does not offer any explicit patent or indemnification protection.
Introducing Azul Intelligence Cloud
Azul Intelligence Cloud is Azul’s newest product, and it includes two main services, Code Inventory and Vulnerability Detection to boost DevOps productivity and reduce tech debt:
- Code Inventory provides an aggregate view of when code was run across an enterprise’s Java workloads to identify unused and dead code for removal. Doing so helps lower code maintenance effort, reduce technical debt, and make major Java upgrades easier.
- Azul Vulnerability Detection uses information the JVM already has to continuously detect vulnerable code that actually runs, eliminating false positives and generating accurate results unattainable by traditional application security tools.
The study says Amazon Corretto benefits from close integration with the AWS cloud, but Amazon does not offer additional offerings like Azul Intelligence Cloud.
Conclusion
“We see Amazon Corretto as more of a basic solution for smaller companies that already use AWS,” Oberg wrote in the conclusion.
Grave adds, “We see Azul’s offerings as being ahead, particularly in terms of security and stability. For larger companies and especially operators of critical infrastructures, Azul has a lot more to offer.”
We were very pleased to find an independent, unsolicited comparison by an expert in the field. You can read the full analysis from ProLicense starting with Part One.
Learn more about how Azul Platform Core compares to other JDK distributions in our JDK Comparison Matrix.
JDK Comparison
