5 Cloud Service Models
Compare IaaS, PaaS, and SaaS by what providers manage, what customers remain responsible for, and the trade-offs involved in choosing each model.
How cloud service models differ
Cloud service models describe which parts of a computing solution are managed by the provider and which remain the customer's responsibility. The three standard models are , , and .
Moving from IaaS toward SaaS generally means that the customer manages less infrastructure and has less direct control. These models describe what the provider manages; they are distinct from deployment models such as public, private, or hybrid cloud.
Management responsibilities and security
The provider manages the physical data center, hardware, and underlying cloud infrastructure in all three models. Responsibility for other layers shifts between provider and customer:
Operating system and runtime: In IaaS, the customer usually manages the guest operating system, while the provider manages physical hosts and virtualization. In PaaS and SaaS, the provider manages the operating system and runtime.
Application: The customer manages the application in IaaS and PaaS. The provider operates it in SaaS.
Data, user access, and configuration: Customers retain important responsibilities in every model, including managing users and data.
This is a general guide, not a substitute for service-specific responsibility documentation. Security is shared: providers secure the cloud infrastructure they operate, while customers remain responsible for protecting their workloads and configuring the services they use. The precise boundary varies by product.
provides fundamental computing resources, such as virtual machines, storage, and networking. The provider operates the physical infrastructure and virtualization layer; the customer configures and manages the virtual environment, including its operating system, applications, and many security settings.
For example, a company might rent virtual machines, install its preferred operating system, and deploy a custom website. IaaS can suit organizations that need substantial control, want to migrate systems designed for traditional servers, or have specialized software requirements. Its flexibility comes with more customer administration, patching, and configuration than PaaS or SaaS.
provides a managed environment for building, testing, and running applications. The provider manages the infrastructure and much of the platform, such as the operating system and runtime, while the customer manages the application and its data.
For example, developers can deploy application code to a managed web-hosting platform without maintaining the underlying servers or operating system. PaaS can suit teams that want to focus on writing and releasing software instead of operating servers. It can speed development and reduce maintenance, but gives customers less control over the underlying environment and may make moving an application to another platform harder.
delivers a ready-to-use application, commonly accessed through a web browser or app. The provider operates the application and its underlying platform and infrastructure, while customers still need to manage appropriate settings, user access, and their use of data.
For example, an organization might use hosted email or a document-collaboration application instead of installing and maintaining its own mail or collaboration servers. SaaS can suit organizations whose needs are met by an existing application and whose users want minimal setup. It reduces operational work, but usually offers less customization and control over features, updates, and the service environment.
Choosing and combining models
Choose among the models by balancing control, operational responsibility, and convenience. IaaS gives customers the most infrastructure control of the three; PaaS shifts more platform management to the provider; SaaS shifts application operation as well.
An organization can use all three models for different needs—for example, IaaS for a legacy system, PaaS for a new application, and SaaS for email. In every model, check the responsibility boundaries of the specific service rather than assuming the provider handles every security task.