IaaS, PaaS, SaaS and the Shared Responsibility Model

What is the cloud?

Before the cloud, launching an application meant buying servers, installing them in an air-conditioned room, planning capacity for the year’s peak and replacing them all every five years. Cloud computing reverses the logic: you rent computing resources from a provider, over the Internet, when you need them.

The reference definition (published by NIST, the US standards institute) lists five characteristics:

1. On-demand self-service: you create a server or a database in a few minutes, without human intervention from the provider.
2. Broad network access: everything is controlled over the Internet (web console, command line, API).
3. Resource pooling: physical resources are shared among many customers, isolated from one another.
4. Elasticity: capacity increases or decreases quickly, sometimes automatically.
5. Measured service: consumption is measured and billed by usage (hour, second, gigabyte, request).

Three service models

Imagine a stack of layers: building and electricity, physical servers, network, virtualization, operating system, runtime environment, application, data. The question is: who manages what?

Model	You manage	The provider manages	Examples
IaaS (Infrastructure as a Service)	operating system, patches, software, application, data	hardware, physical network, virtualization	virtual machines (Amazon EC2, Azure Virtual Machines, Google Compute Engine)
PaaS (Platform as a Service)	application code, configuration, data	everything else, including OS and runtime environment	application hosting (AWS Elastic Beanstalk, Azure App Service, Google App Engine), managed databases
SaaS (Software as a Service)	settings, users, data	the entire application	email, office suite, online CRM

Serverless (functions such as AWS Lambda, Azure Functions, Cloud Run functions) takes PaaS further: you deploy a function, it runs on each event, and you only pay for executions. No server to size, but with constraints (maximum duration, cold start).

The choice is a trade-off: IaaS gives control (any software, any configuration) but also the burden (security updates, backups). PaaS and SaaS free up time but impose their rules.

Shared responsibility

In the cloud, security is shared: the provider is responsible for the security of the cloud (data centers, hardware, hypervisor), the customer for security in the cloud. The boundary depends on the model:

• in IaaS, applying the VM’s operating system patches is your job;
• in PaaS, the provider updates the platform, but the application configuration and permissions remain yours;
• in SaaS, the provider manages all the software, but who has access to what remains your decision.

Three elements are always the customer’s responsibility: its data (classification, backup, encryption as needed), its identities and access permissions, and the configuration of what it deploys. Most cloud data leaks, in fact, come from customer-side misconfiguration (storage made public, weak password), not from a provider flaw.

Public, private, hybrid

• Public cloud: the provider’s infrastructure, pooled among customers (AWS, Microsoft Azure, Google Cloud, and other providers, including European ones).
• Private cloud: infrastructure dedicated to a single organization, in-house or at a hosting provider.
• Hybrid cloud: a combination of the two, for example sensitive data on-premises and elastic compute in the public cloud. We speak of multicloud when using several public providers.

Key takeaways

• Cloud = on-demand, elastic resources, billed by usage.
• IaaS, PaaS, SaaS: the higher you go, the less you manage, the less you control.
• Data, identities and configuration always remain your responsibility.