Cloud Service Models
Learning Objectives
- Define IaaS, PaaS, and SaaS and identify what the customer versus the provider manages in each
- Explain how the three models differ in control, flexibility, and operational responsibility
- Identify real-world examples of IaaS, PaaS, and SaaS products
- Evaluate which service model fits a given project scenario
- Compare the advantages and disadvantages of each model
- Recognize how emerging models like serverless and FaaS extend the IaaS/PaaS/SaaS spectrum
Quick Answer
Cloud service models describe how much of the technology stack a provider manages for you versus how much you manage yourself. IaaS (Infrastructure as a Service) rents raw virtual machines, storage, and networking — you install and manage the OS and everything above it (e.g., AWS EC2). PaaS (Platform as a Service) hands you a ready-made runtime so you only write and deploy application code (e.g., Heroku). SaaS (Software as a Service) is a finished application you simply use (e.g., Gmail, Salesforce). Moving from IaaS to PaaS to SaaS trades control for convenience: you manage less, but you can also customize less. Choosing the right model matters because it directly determines your team's workload, cost structure, and how fast you can ship.
The Control-Convenience Spectrum
Every layer of a computing stack — physical hardware, virtualization, operating system, runtime, application code, and data — has to be managed by someone. Cloud service models are really just different lines drawn across that stack: everything below the line is the provider's job, everything above it is yours.
Think of it like renting a place to live. IaaS is renting an empty plot of land with electricity and water hookups — you build the house yourself. PaaS is renting a furnished apartment — you bring your own belongings, but the building, plumbing, and appliances are already there. SaaS is checking into a hotel — you show up with a suitcase and everything is handled.
Why it matters: picking a service model is really a decision about where you want your team's effort to go. A startup with two engineers usually can't afford to manage servers and build product — PaaS or SaaS frees them to focus on the product. A company running a highly specialized, performance-tuned database might need the full control of IaaS.
Common misunderstanding: students often think IaaS, PaaS, and SaaS are three unrelated products rather than three points on the same spectrum. In reality, PaaS is typically built on top of IaaS (Heroku itself runs on AWS), and a single company often uses all three simultaneously — SaaS tools like Slack for communication, PaaS for their own web app, and IaaS for a custom data pipeline.
Infrastructure as a Service (IaaS)
Definition: IaaS provides virtualized computing infrastructure — servers, storage, and networking — over the internet, on demand, billed by usage. The customer manages the operating system and everything installed on top of it.
Explanation: Instead of buying a physical server, you request a virtual machine from a provider's console or API. Within minutes you have root access to a machine you can install any OS, runtime, or software on, exactly as if it were physical hardware sitting in your office — except it's actually one of thousands of virtual machines running on the provider's data center hardware.
Example: A developer launches an AWS EC2 instance, chooses Ubuntu as the OS, installs Node.js, configures a firewall rule, and deploys a custom web server — all steps a PaaS would normally hide.
Real-world example: A gaming company running a custom multiplayer server needs precise control over network configuration and OS-level performance tuning that a managed platform wouldn't expose, so it runs its game servers on AWS EC2 instances (IaaS) instead of a PaaS.
Why it matters: IaaS is the foundation everything else is built on. It gives maximum flexibility — you can run legacy software, unusual configurations, or specialized workloads that a more restrictive PaaS wouldn't support.
Common misunderstanding: students often assume IaaS means "no management burden because it's the cloud." In fact, IaaS transfers the least amount of operational work to the provider — you're still responsible for OS patching, security configuration, scaling logic, and backups. It removes hardware management, not software administration.
Examples of IaaS providers: Amazon Web Services (EC2), Microsoft Azure (Azure VMs), Google Cloud Platform (Compute Engine), IBM Cloud, Oracle Cloud.
Advantages: full control over the environment; ability to run virtually any software stack; pay-as-you-go pricing instead of buying hardware; can lift-and-shift existing on-premises applications with minimal changes.
Disadvantages: requires in-house system administration skill (OS patching, security hardening); more operational responsibility than PaaS or SaaS; slower to get an application running than PaaS since you build up from a bare VM.
Platform as a Service (PaaS)
Definition: PaaS provides a managed runtime environment for building, deploying, and running applications, so developers write code without provisioning or maintaining servers.
Explanation: A PaaS vendor pre-configures the operating system, language runtime, and supporting middleware. A developer pushes application code (often literally with git push), and the platform handles building, deploying, load balancing, and scaling it automatically.
Example: A developer pushes a Python Flask application to Heroku. Heroku detects the language, installs dependencies from requirements.txt, provisions a runtime container, and makes the app available at a public URL — without the developer ever touching a server or OS setting.
Real-world example: A small team building an internal HR tool uses Google App Engine so they can focus entirely on business logic; App Engine automatically scales instances up during payroll week and down afterward without anyone writing scaling scripts.
Why it matters: PaaS dramatically shortens the time between writing code and having it running in production, which is exactly the resource-constrained situation most small teams and startups are in.
Common misunderstanding: students often think PaaS is "IaaS but easier," implying it is strictly a subset of IaaS's capabilities. In reality, PaaS is a different trade-off, not a strictly worse one — it deliberately sacrifices low-level control in exchange for automatic scaling, patching, and deployment tooling that IaaS does not provide out of the box.
Examples of PaaS providers: Heroku, AWS Elastic Beanstalk, Google App Engine, Microsoft Azure App Service, IBM Cloud Foundry.
Advantages: faster development and deployment cycles; provider handles scaling, patching, and infrastructure reliability; access to built-in services like databases and messaging queues.
Disadvantages: less control over the underlying infrastructure; potential vendor lock-in if the application relies heavily on a provider's proprietary APIs; limited support for unusual or legacy runtime requirements.
Software as a Service (SaaS)
Definition: SaaS delivers a complete, ready-to-use software application over the internet, typically accessed through a browser, with the provider managing the entire stack beneath it.
Explanation: The provider hosts the application, manages all infrastructure and updates, and the customer simply logs in and uses it — usually via subscription. There is no code to write and no server to configure; the only "management" the customer does is configuring settings and managing their own data and users.
Example: A small business signs up for Salesforce, configures a sales pipeline with a few clicks, and starts tracking leads immediately — no installation, no servers, no code.
Real-world example: A university switches from running its own on-premises email servers to Google Workspace, eliminating the need for an in-house team to patch mail server software or manage storage capacity for every student's mailbox.
Why it matters: SaaS is what lets non-technical users and small organizations access powerful software without hiring engineers to build or maintain it — this is the layer most people interact with the cloud through every day, often without realizing it.
Common misunderstanding: students often believe SaaS is "less powerful" or "for non-developers only." Many SaaS products (Salesforce, Slack, Zoom) are mission-critical for large enterprises and offer deep customization through configuration and APIs — the defining trait is that the underlying infrastructure and code are entirely provider-managed, not that the software is simple.
Examples of SaaS applications: Salesforce CRM, Microsoft Office 365, Google Workspace, Dropbox, Zoom.
Advantages: minimal upfront cost; automatic updates and maintenance; accessible from any device with a browser; scales automatically with the vendor's infrastructure.
Disadvantages: dependent on internet connectivity; limited customization compared to building your own software; data resides on a third party's servers, which can raise compliance or security concerns for sensitive data.
Choosing Between IaaS, PaaS, and SaaS
The right model depends on several factors working together, not any single one in isolation:
- Application requirements — does the workload need a specialized OS, kernel module, or unusual hardware (favors IaaS), or is it a standard web app (favors PaaS)?
- Development team skills — a team without dedicated infrastructure engineers benefits more from PaaS or SaaS.
- Budget constraints — SaaS/PaaS reduce staffing costs but may cost more per unit of compute at scale than self-managed IaaS.
- Scalability needs — PaaS and SaaS typically autoscale out of the box; IaaS requires the customer to design that logic (or use auto-scaling groups).
- Security and compliance requirements — highly regulated data may require the fine-grained control only IaaS (or private cloud) provides.
| Criteria | SaaS | PaaS | IaaS |
|---|---|---|---|
| Control | Low | Medium | High |
| Customization | Limited | Moderate | Extensive |
| Typical cost pattern | Predictable subscription | Usage-based, moderate | Usage-based, can be lowest at scale with tuning |
| Complexity to operate | Simplest | Moderate | Most complex |
| Who manages the OS/runtime | Provider | Provider | Customer |
Real-World Applications
- Netflix uses AWS IaaS (EC2, S3) for its custom-built streaming infrastructure because its scale and performance requirements demand full control.
- A student building a portfolio website typically uses a PaaS like Vercel or Heroku to deploy quickly without learning server administration.
- A marketing team manages customer relationships entirely through Salesforce (SaaS) without any engineering involvement.
- Serverless computing (AWS Lambda, Google Cloud Functions) pushes the PaaS idea even further — customers upload individual functions and the provider manages everything, including scaling to zero when there's no traffic.
Key Terms
| Term | Definition |
|---|---|
| IaaS | Infrastructure as a Service — rented virtual machines, storage, and networking; customer manages OS upward |
| PaaS | Platform as a Service — a managed runtime for deploying application code without managing servers |
| SaaS | Software as a Service — a complete, ready-to-use application delivered over the internet |
| Vendor Lock-in | Difficulty switching providers because an application depends heavily on a provider's proprietary features |
| Serverless Computing | A model (often built on PaaS/FaaS) where the provider dynamically manages server allocation, including scaling to zero |
| FaaS | Function as a Service — a serverless model where customers deploy individual functions triggered by events |
| Middleware | Software that connects an application to its runtime environment, such as web servers or message brokers |
| Auto-scaling | Automatically adjusting the number of running instances to match current demand |
Common Mistakes
-
Misconception: "IaaS, PaaS, and SaaS are three completely separate technologies." Why it's wrong: They are layers of the same stack, and higher layers are usually built on lower ones — Heroku (PaaS) itself runs on AWS (IaaS). Correct understanding: The three models represent different points on a single control-versus-convenience spectrum, and organizations frequently use all three at once for different parts of their systems.
-
Misconception: "PaaS and SaaS remove all security responsibility from the customer." Why it's wrong: Even in SaaS, the customer is still responsible for configuring access controls, managing user permissions, and protecting their account credentials. Correct understanding: All three models follow a shared responsibility model — the provider secures more of the stack as you move toward SaaS, but the customer is never fully absolved of responsibility.
-
Misconception: "IaaS is always cheaper than PaaS because you're renting less." Why it's wrong: IaaS shifts management costs (system administrators, DevOps engineers, patching time) onto the customer, which often outweighs the lower sticker price for a small team. Correct understanding: Total cost must include engineering time, not just the cloud bill — PaaS or SaaS can be cheaper overall for teams without dedicated infrastructure staff.
Comparison and Connections
| Aspect | IaaS | PaaS | SaaS |
|---|---|---|---|
| What you manage | OS, runtime, middleware, app, data | App code and data | Data and user configuration only |
| What provider manages | Physical hardware, virtualization, network | + OS, runtime, middleware | + Application itself |
| Best for | Custom infrastructure, legacy migration | Rapid app development | Ready-made business functions |
| Example | AWS EC2 | Heroku | Salesforce |
| Analogy | Renting land | Renting a furnished apartment | Staying in a hotel |
Practice Questions
Recall
- Name the three cloud service models and one example provider for each. Answer guidance: IaaS — AWS EC2; PaaS — Heroku; SaaS — Salesforce.
- What does a customer manage in a PaaS model that they do not manage in a SaaS model? Answer guidance: In PaaS, the customer writes and manages the application code and data; in SaaS, the provider manages the application itself, and the customer only manages usage and configuration.
Understanding 3. Explain why PaaS is not simply "an easier version of IaaS" but a different trade-off. Answer guidance: PaaS gives up low-level infrastructure control in exchange for automatic scaling, patching, and deployment tooling — capabilities IaaS does not provide by default, not merely a restricted version of IaaS. 4. Why might a company use IaaS, PaaS, and SaaS all at the same time? Answer guidance: Different parts of the business have different needs — e.g., Slack (SaaS) for communication, a PaaS for the company's own web app, and IaaS for a custom, performance-tuned data pipeline.
Application 5. A two-person startup needs to launch a web app quickly and has no dedicated DevOps engineer. Which service model should they choose, and why? Answer guidance: PaaS — it removes the need to manage servers or scaling logic, letting the small team focus entirely on writing application code and shipping quickly. 6. A financial institution needs a highly customized database configuration with specific kernel-level tuning for compliance reasons. Which model fits best? Answer guidance: IaaS — it's the only model that grants the OS-level and kernel-level control required for that level of customization.
Analysis 7. Compare the security responsibility a customer holds in IaaS versus SaaS. Answer guidance: In IaaS, the customer is responsible for OS patching, network configuration, and application security in addition to their data; in SaaS, the customer is responsible mainly for access control and data governance, since the provider secures the application and infrastructure beneath it. 8. A team argues "PaaS is objectively better than IaaS because it does more for you." Evaluate this claim. Answer guidance: False in general — "more done for you" also means less control and potential vendor lock-in. PaaS is better only for workloads that fit its constraints; specialized or legacy workloads needing deep customization are often better served by IaaS.
FAQ
1. Is Heroku built on top of AWS, or is it a competitor to AWS? Heroku (a PaaS) actually runs on AWS infrastructure (IaaS) behind the scenes — they're complementary layers, not direct competitors.
2. Where does serverless computing (like AWS Lambda) fit in this model? Serverless/FaaS is often considered an evolution of PaaS — it goes even further by managing the underlying compute so precisely that the customer doesn't think about servers at all, only individual functions.
3. Can a single application use more than one service model? Yes. A common pattern is a frontend hosted on a PaaS, a database from a managed SaaS-like service, and a custom data-processing pipeline running on IaaS virtual machines.
4. Is IaaS a good starting point for a beginner learning cloud computing? It's a good place to learn fundamentals like networking and OS administration, but many beginners find it faster to start with a PaaS to get an application live, then explore IaaS once they want more control.
5. Does choosing SaaS mean you have no cloud security responsibilities at all? No. Even with SaaS, you're responsible for setting strong access controls, managing which users have which permissions, and protecting the data you put into the service.
Quick Revision
- Cloud service models describe where the line is drawn between what the provider manages and what the customer manages.
- IaaS: rents VMs, storage, and networking — customer manages OS upward (e.g., AWS EC2).
- PaaS: managed runtime for deploying code — customer manages only app and data (e.g., Heroku).
- SaaS: complete application, ready to use — customer manages only usage and data (e.g., Salesforce).
- Control decreases and provider responsibility increases moving from IaaS to PaaS to SaaS.
- PaaS is often built on top of IaaS; the three models are layers, not separate products.
- Organizations commonly use all three models simultaneously for different needs.
- Security is a shared responsibility in every model — never fully offloaded to the provider.
- Serverless/FaaS extends the PaaS idea further, abstracting away even the runtime environment.
- Choose based on team skills, budget, customization needs, and compliance requirements — not price alone.
Related Topics
Prerequisites: Introduction to Cloud Computing, basic understanding of servers and virtualization
Related Topics: Serverless Computing, DevOps and CI/CD, Virtualization and Containers
Next Topics: Cloud Security and Privacy, Cloud Storage Solutions