Three ways to rent the same technology
Any computer system is built in layers. At the bottom are the physical machines and network. Above them are virtual machines, then an operating system, then runtime tools, then the application, and finally the data a person actually works with. Cloud providers offer to run some of these layers for you. The three main service models differ in how many layers the provider takes on.
- Infrastructure as a Service (IaaS): the provider supplies the basic building blocks, such as virtual machines, storage and networks.
- Platform as a Service (PaaS): the provider also supplies the operating system and tools needed to build and run applications.
- Software as a Service (SaaS): the provider supplies a complete, ready-to-use application.
More provider management generally means less work and less control for the customer.
An analogy: getting a meal
Imagine wanting a pizza. In a kitchen-rental arrangement you get the space and the oven and bring your own ingredients and skills; that resembles IaaS. In a take-and-bake arrangement, the dough, sauce and toppings are prepared and you just bake it; that is like PaaS. Ordering it delivered and ready to eat is like SaaS. Each step hands over more of the work in exchange for fewer choices.
Infrastructure as a Service
With IaaS, you rent virtual servers, storage and networking, and you choose and manage everything above that.
You manage: the operating system, security updates for it, the software you install, your applications, configuration and data. The provider manages: the data center, physical hardware and the virtualization layer.
Typical uses: hosting a custom application, running legacy software that needs a particular setup, building a test environment, or storing large amounts of data. Advantages: high flexibility and control; almost anything you could run on your own server can run here, which makes it a common landing spot in a cloud migration. Drawbacks: significant technical skill and ongoing work, including keeping software updated.
Platform as a Service
PaaS gives developers an environment in which to build, run and manage applications without handling the underlying servers or operating system. The provider handles the operating system, the runtime and often scaling.
You manage: your application code, its settings and its data. The provider manages: the infrastructure, the operating system and the platform tools.
Typical uses: web and mobile application back ends, managed databases, and tools for developing and deploying software. Serverless computing is often placed in this category or alongside it, as it takes the same idea further by also hiding capacity management. Advantages: faster development, less maintenance, built-in scaling. Drawbacks: fewer choices about the environment, and a greater chance of depending on one provider’s specific tools, which feeds into vendor lock-in concerns.
Software as a Service
SaaS delivers finished software through a web browser or app. Customers do not install or maintain it; they sign in and use it. Familiar examples of the category include web email, online office tools, customer-contact systems, accounting and collaboration platforms.
You manage: user accounts, settings, the content or data you enter, and who is given access. The provider manages: everything else, including the application, its updates and the infrastructure beneath it.
Typical uses: everyday business tools such as communication, document editing and record-keeping. Advantages: quick to start, no installation, updates are handled for you, often billed per user. Drawbacks: limited customization, dependence on the provider’s availability and decisions, and the need to confirm how the provider handles your data, including where it is stored and how it can be exported.
Who manages what
| Layer | On your own servers | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Application data | You | You | You | You |
| Application | You | You | You | Provider |
| Runtime and tools | You | You | Provider | Provider |
| Operating system | You | You | Provider | Provider |
| Virtualization and hardware | You | Provider | Provider | Provider |
| Data center | You | Provider | Provider | Provider |
The details vary by provider and service, so this is a general picture. One thing stays with the customer in all rows: the data and who may access it. That is a key point of the shared responsibility model.
Where the lines blur
The labels are guides, not strict categories. Some services sit between models. Newer terms such as “Function as a Service” or “Database as a Service” describe particular pieces of the stack. Providers may also bundle services from several layers, and an organization can use all three at once: SaaS for email, PaaS for a customer-facing app and IaaS for an older system.
Choosing a level
Questions that help include:
- Do we need control over the operating system or specialized software?
- Do we have staff able to maintain servers and apply updates?
- How quickly do we need to start?
- How important is the ability to move to another provider?
- How will the pricing behave as usage grows? Cloud pricing differs across models, from hourly resource rates to per-user subscriptions.
- Does the service meet our requirements for security and data location?
Many organizations choose the highest-level service that still meets their needs, reserving lower-level control for cases where it is truly required.
A note on advice
This article is general information. Technical, security and financial choices differ by organization, so consult qualified professionals.