One idea, three packages
Cloud providers do not all sell the same thing. Some rent you raw computing resources, some give you a ready place to run your own program, and some hand you finished software through a web browser. The three common labels for these are infrastructure as a service (IaaS), platform as a service (PaaS) and software as a service (SaaS).
The difference is mostly about who is responsible for what. The more the provider handles, the less you have to manage, but also the less you can customize.
The stack of layers
Any application sits on a stack. From the bottom up, there are roughly:
- buildings, power and networking
- physical servers and storage
- virtualization
- an operating system
- runtime tools and supporting software
- the application itself
- your data and settings
The three models differ in where the provider’s responsibility stops and yours begins. The bottom layers are the physical side described in cloud infrastructure.
IaaS: infrastructure as a service
With IaaS, the provider supplies the foundations: virtual servers, storage, and networking. You choose the operating system, install the software you want, configure it, and keep it updated.
Think of it as renting an empty, powered workshop. The building, electricity and basic equipment are handled, but you bring your own tools and do your own work.
Typical features:
- you rent virtual machines in sizes you choose
- you pay according to usage, often by the hour or second
- you have the most control, including operating system settings
- you are responsible for security patches and updates on what you install, which is where software updates become your job
IaaS suits teams that need flexibility, want to move existing software to the cloud with few changes, or have unusual requirements. The cost is time and expertise: more control means more to manage.
PaaS: platform as a service
With PaaS, the provider also looks after the operating system and the surrounding tools. You supply your application code, and the platform runs it, often scaling it up or down automatically.
This is like renting a fitted kitchen. The appliances are installed and maintained, and you just cook your own recipes.
Typical features:
- you deploy code without setting up servers
- the platform handles patching, scaling and load balancing
- managed databases and message queues are often available
- you accept the platform’s supported languages, rules and limits
PaaS speeds development because teams skip routine server chores. The trade-offs are less control and some degree of lock-in: an application built around one platform’s special features may be harder to move. Serverless computing can be seen as a further step in this direction, where even the idea of a running application server disappears from the customer’s view.
SaaS: software as a service
With SaaS, the provider runs the entire application, and you simply use it, usually through a browser or app. Web-based email, online office tools, customer relationship management systems and video meeting services are common examples.
This is like eating at a restaurant. Someone else buys ingredients, cooks and cleans up, and you choose from the menu.
Typical features:
- no installation or server management
- usually paid by subscription, often per user
- updates arrive automatically
- limited customization, mostly through settings and integrations (APIs can connect SaaS tools, as covered in API basics)
SaaS is the model most people encounter daily. Its main considerations are data and dependency. Your information lives with the vendor, so it is worth understanding export options, data backups, privacy practices and what happens if the service is discontinued.
Comparing who manages what
A rough summary, which can vary by provider:
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Buildings, hardware, network | Provider | Provider | Provider |
| Virtualization | Provider | Provider | Provider |
| Operating system | You | Provider | Provider |
| Runtime and tools | You | Provider | Provider |
| Application | You | You | Provider |
| Your data and access settings | You | You | You |
The last row is important. In every model, you stay responsible for your own data choices, such as who has access and how strong the passwords are. Providers and customers share security duties, and the split moves with the model. Many data breaches in cloud settings trace back to customer-side settings, such as storage left open by mistake, rather than failures of the provider’s hardware.
Other “as a service” labels
You may see more terms: function as a service, database as a service, or even “everything as a service.” They are variations on the same idea, offering a particular layer as a rented, managed product. They are not always sharply defined, and vendors use the labels loosely, so it is worth reading what is actually included.
How to choose
A few questions help:
- How much control do you need over the environment?
- Do you have staff who can manage servers securely?
- How quickly do you need to launch?
- How easy should it be to move to another provider later?
- What are the compliance or privacy requirements for your data?
Many organizations use all three at once, for example SaaS for email, PaaS for a customer app, and IaaS for a legacy system. Where those services run, whether in a provider’s facilities, a company’s own or a mix, is a separate question covered under hybrid cloud. Overall, these choices are central to how cloud computing is used in business.