Cloud Computing Models

Learning Objectives

• Define cloud computing and list its five essential characteristics.
• Explain and differentiate IaaS, PaaS, and SaaS, with examples of each.
• Describe how cloud computing supports the scalability and fault tolerance goals of distributed systems.
• Identify key security considerations that come with adopting cloud services.
• Apply cloud service model choices to real application scenarios.
• Evaluate the trade-offs between control, cost, and convenience across the three service models.

Quick Answer

Cloud computing models describe the different levels at which a provider hands you computing resources over the internet: raw infrastructure (IaaS), a ready-to-use development platform (PaaS), or a finished application (SaaS). Rather than buying and maintaining physical servers, you rent exactly the resources you need and pay based on usage. This matters because it turns huge upfront capital costs into flexible operating costs, lets applications scale up or down automatically as demand changes, and lets small teams operate infrastructure that once required a data center and a dedicated operations staff. Understanding the differences between IaaS, PaaS, and SaaS is essential for choosing how much control versus convenience your project needs.

What Are Cloud Computing Models?

Cloud computing models define how computing resources — servers, storage, databases, networking, and software — are delivered to users over the internet, on demand, without users having to manage the underlying physical hardware themselves.

The five characteristics that define genuine cloud computing (NIST definition):

• On-demand self-service — you provision resources yourself, without calling a human at the provider.
• Broad network access — resources are available over the internet from many kinds of devices.
• Resource pooling — the provider serves many customers from shared physical infrastructure, allocating capacity dynamically.
• Rapid elasticity — capacity can scale up or down quickly, often automatically.
• Measured service — usage is metered, so you pay for what you actually consume.

Why it matters: These five characteristics are what separate "cloud computing" from simply "renting a server." A rented dedicated server that you provision manually and pay a flat monthly fee for lacks elasticity and measured service — real cloud computing must let you scale on demand and pay proportionally.

Common misunderstanding: Students often think "the cloud" means data is stored in some vague, borderless place. In reality, your data sits on specific physical servers in specific data centers owned by the provider — "the cloud" is a convenient abstraction over very real, very located hardware.

Infrastructure as a Service (IaaS)

Definition: IaaS provides virtualized computing infrastructure — virtual machines, storage, and networking — over the internet, leaving the operating system, runtime, and application entirely under the customer's control.

Explanation: IaaS is the "lowest level" of cloud service: you get raw compute and storage, and you're responsible for everything above it — installing an OS, configuring software, patching security updates, and managing scaling policies yourself (or with additional tools).

Example: A company rents a virtual machine to host its own custom-configured web server and database, rather than buying physical hardware.

Real-world example: Amazon EC2 lets a business launch virtual servers within minutes, choosing exactly the CPU, memory, and storage specifications it needs, and pay only for the hours those servers run.

Why it matters: IaaS gives maximum flexibility and control — useful when an application has unusual requirements or when a team wants to manage its own software stack precisely.

Common misunderstanding: People sometimes think IaaS means "less work than owning hardware, full stop." IaaS removes hardware procurement and maintenance, but you still fully own operating system updates, security patching, and scaling logic — it is not hands-off.

Advantages: Full flexibility and customization; scalable; often cost-effective for long-running, specialized workloads. Disadvantages: Requires significant management overhead; misconfiguration can create real security risks.

Platform as a Service (PaaS)

Definition: PaaS provides a complete platform — including the operating system, runtime, and supporting tools — for developing, running, and managing applications, so developers only need to write and deploy their code.

Explanation: PaaS sits one level up from IaaS: the provider manages the operating system, patching, and much of the infrastructure automatically, so developers can focus purely on application logic rather than server administration.

Example: A developer pushes application code to a PaaS platform, which automatically handles provisioning servers, installing the required runtime, and deploying the app — no manual server setup required.

Real-world example: Heroku lets a developer deploy a web app with a single command, automatically managing the underlying servers, load balancing, and scaling.

Why it matters: PaaS dramatically speeds up development by removing infrastructure concerns, which is why startups and small teams often prototype and launch products on PaaS platforms.

Common misunderstanding: Students sometimes think PaaS gives the same control as IaaS but with extra convenience. In fact, PaaS deliberately limits low-level control (you usually can't customize the OS or underlying server configuration) in exchange for speed and simplicity — the trade-off is real, not just a bonus.

Advantages: Simplified development environment; faster deployment cycles; reduced operational overhead. Disadvantages: Less control over the underlying infrastructure; risk of vendor lock-in since apps are often built against a provider's specific platform APIs.

Software as a Service (SaaS)

Definition: SaaS delivers a complete, ready-to-use software application over the internet, typically accessed through a web browser, with the provider managing everything underneath — infrastructure, platform, and the application itself.

Explanation: SaaS is the "top layer" of cloud service: the customer doesn't manage or even see the infrastructure or platform at all — they simply use the software, usually via subscription.

Example: Instead of installing office software on every employee's computer and manually updating it, a company subscribes to a web-based suite that everyone accesses through a browser.

Real-world example: Salesforce provides a complete customer relationship management application accessed entirely through a browser, with the provider handling all servers, updates, and maintenance.

Why it matters: SaaS removes essentially all infrastructure and maintenance burden from the customer, which is why it's the dominant model for common business software like email, CRM, and office productivity tools.

Common misunderstanding: Students sometimes assume SaaS applications can be customized as freely as self-hosted software. SaaS trades customization for convenience — most SaaS products only allow configuration within limits the provider has built in.

Advantages: Accessible from anywhere with a browser; automatic updates and maintenance; low upfront cost. Disadvantages: Limited customization; complete dependence on the provider's uptime and internet connectivity.

Visualizing the Service Model Stack

How Cloud Models Support Distributed Systems

Cloud computing didn't invent the ideas behind distributed systems — it packages them as a convenient, on-demand service. Specifically, cloud platforms provide:

• Scalability: Resources scale up or down automatically as demand shifts, without the customer buying or provisioning hardware in advance.
• Fault tolerance: Redundancy across multiple servers, data centers, and geographic regions is built into most cloud offerings by default.
• Geographical distribution: Applications and data can be hosted close to users worldwide, reducing latency.
• Cost-effectiveness: Pay-as-you-go pricing avoids large upfront capital expenditure on hardware that may sit idle.

Real-world example: An e-commerce site built on a PaaS automatically launches extra application instances during a holiday sale, spreading traffic across them, then scales back down once the sale ends — combining elasticity with fault tolerance.

Security Considerations

Moving to the cloud shifts some responsibilities to the provider but keeps others firmly with the customer — this split is often called the "shared responsibility model."

• Data isolation: Multiple customers share the same physical infrastructure, so proper isolation between tenants' data is critical.
• Access controls: Strong authentication and authorization prevent unauthorized access to cloud resources.
• Encryption: Data should be encrypted both in transit and at rest.
• Compliance: Organizations must ensure their cloud usage meets relevant regulatory standards (e.g., data residency laws).

Real-world example: A company storing customer records in a managed cloud database enables server-side encryption so that all stored data is automatically encrypted, and only authorized application roles can decrypt it.

Common Mistakes

Misconception	Why It's Wrong	Correct Understanding
"IaaS, PaaS, and SaaS differ only by price."	The real difference is the division of responsibility for managing the OS, runtime, and application, not just the cost.	Each layer trades control for convenience: IaaS gives maximum control, SaaS gives maximum convenience, and PaaS sits between them.
"Cloud computing means the provider is responsible for all security."	Cloud security follows a shared responsibility model — providers secure the underlying infrastructure, but customers are still responsible for configuring access controls, encrypting data, and managing their own application-level security.	Always check which security responsibilities fall on your organization versus the provider for your specific service model.
"Moving to the cloud is always cheaper than owning hardware."	Pay-as-you-go pricing can become more expensive than owned hardware for large, steady, predictable workloads, since you're paying a margin for the provider's convenience and elasticity.	Cloud economics favor variable or unpredictable workloads; steady, large-scale workloads sometimes cost less on owned infrastructure.

Comparison and Connections

Model	Who Manages What	Customer Controls	Example
IaaS	Provider: hardware, virtualization	OS, runtime, applications, data	Amazon EC2
PaaS	Provider: hardware, OS, runtime	Application code, data	Heroku, Google App Engine
SaaS	Provider: everything except usage/config	Application settings, data entered	Salesforce, Microsoft 365

Key Terms

Term	Definition
IaaS	Infrastructure as a Service — rented virtualized hardware (compute, storage, network).
PaaS	Platform as a Service — a managed platform for building and deploying applications.
SaaS	Software as a Service — a complete application delivered over the internet.
Elasticity	The ability of a cloud system to automatically scale resources up or down based on demand.
Resource pooling	Serving multiple customers from a shared pool of physical infrastructure.
Shared responsibility model	The division of security duties between a cloud provider and its customers.
Vendor lock-in	Difficulty switching providers because an application is built around a specific provider's platform or APIs.

Practice Questions

Recall

1. List the five essential characteristics of cloud computing as defined by NIST. Answer guidance: On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.
2. Name one example provider for each of IaaS, PaaS, and SaaS. Answer guidance: IaaS — Amazon EC2/AWS; PaaS — Heroku or Google App Engine; SaaS — Salesforce or Microsoft 365.

Understanding

3. Explain why PaaS reduces development time compared to IaaS. Answer guidance: PaaS manages the operating system, runtime, and infrastructure automatically, so developers only write and deploy application code instead of configuring servers themselves.
4. Why does SaaS typically offer the least customization of the three models? Answer guidance: The provider manages the entire application, including its features and configuration options; customers can only adjust settings the provider has explicitly built in, unlike IaaS/PaaS where you control your own code.

Application

5. A startup wants to launch a web app quickly with a small team and no dedicated infrastructure staff. Which cloud model should they choose, and why? Answer guidance: PaaS — it removes the need to manage servers or OS-level configuration, letting a small team focus entirely on writing application code and deploying fast.
6. A financial institution needs full control over its operating system configuration for strict regulatory compliance. Which model fits best? Answer guidance: IaaS — it gives full control over the OS and software stack, which is necessary to meet specific compliance and configuration requirements that PaaS or SaaS would not allow.

Analysis

7. Compare the security responsibilities a customer holds under IaaS versus SaaS. Answer guidance: Under IaaS, the customer is responsible for OS patching, application security, and access control on top of provider-managed hardware; under SaaS, the customer's responsibility narrows mainly to access control and data governance, since the provider manages the OS, platform, and application itself.
8. A company is deciding between building on owned hardware and moving to a pay-as-you-go cloud model for a workload with very steady, predictable, 24/7 demand. Evaluate the trade-off. Answer guidance: For steady, predictable, high-utilization workloads, owned or reserved hardware can be cheaper long-term since cloud pay-as-you-go pricing includes a margin for elasticity and convenience that isn't being used; cloud makes more economic sense for variable or unpredictable demand.

FAQ

What's the simplest way to remember the difference between IaaS, PaaS, and SaaS? Think of it as renting a house at different levels of readiness: IaaS is renting an empty plot of land with utilities connected, PaaS is renting a furnished house you can rearrange, and SaaS is staying in a fully serviced hotel room.

Can a single application use more than one cloud service model? Yes — many applications run their core app on a PaaS while using specific IaaS resources for specialized workloads, and integrate with SaaS tools like email or analytics platforms, combining models where each fits best.

Is "serverless" computing a fourth cloud model? Serverless (Functions as a Service) is often considered an evolution beyond PaaS — you don't manage servers at all, even implicitly, and you're billed per function execution rather than for running servers continuously. It's frequently taught as an extension of the IaaS-PaaS-SaaS spectrum rather than a wholly separate category.

Why do companies worry about vendor lock-in with PaaS but less with IaaS? PaaS platforms often require code and configuration written specifically against their platform's APIs and conventions, making migration to a different provider harder. IaaS, since you control the OS and software stack yourself, is generally more portable between providers.

Does using the cloud eliminate the need to think about fault tolerance? No — cloud providers offer the building blocks (multiple availability zones, managed replication, auto-scaling) but you still must design your application to use them correctly, such as deploying across multiple zones and handling retries for failed requests.

Quick Revision

• Cloud computing models define how resources are delivered: on-demand, self-service, elastic, and metered.
• IaaS: rents virtual infrastructure; customer manages OS and above. Example: Amazon EC2.
• PaaS: rents a development platform; customer manages only application code. Example: Heroku.
• SaaS: delivers a complete application; customer manages only usage/config. Example: Salesforce.
• Control decreases and convenience increases as you move from IaaS to PaaS to SaaS.
• Cloud computing packages distributed systems techniques (replication, load balancing) as an on-demand service.
• The shared responsibility model splits security duties between provider and customer.
• Cloud pricing is usage-based, which favors variable workloads over steady, predictable ones.
• Vendor lock-in risk is higher with PaaS/SaaS than with IaaS.
• Serverless (FaaS) extends the abstraction even further beyond PaaS.

Related Topics

Prerequisites: Distributed Systems Fundamentals, Distributed Computing Paradigms.

Related Topics: Fault Tolerance and Scalability, Virtualization concepts.

Next Topics: Fault Tolerance and Scalability.