Service Models: IaaS, PaaS and SaaS

The same word “cloud” can describe very different management layers

After defining cloud characteristics, we need a different question: what capability are we actually consuming? NIST identifies three primary service models: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). This is not a ranking from best to worst. It describes the level of abstraction the provider offers and the layers that remain under customer management. One organization may use SaaS for email, PaaS for a web application and IaaS for a workload that needs a customized operating system. Those choices can coexist because they solve different requirements.

IaaS: more control also means more operational work

With IaaS, the customer receives foundational computing capability on which operating systems and applications can be deployed. That flexibility is useful when a team needs an operating-system configuration, low-level component or network pattern that a higher-level service cannot provide. Control brings work with it. If the guest operating system is under customer management, the customer must plan patching, hardening, monitoring and appropriate configuration backup. This does not mean the customer manages the physical hosts or data center. Those underlying layers have moved to the provider.

PaaS: focus on the application instead of the operating system

With PaaS, the customer deploys an application to a managed platform. The team generally does not manage the virtual-machine operating system on which the provider runs the platform, so effort shifts away from server maintenance toward application code, data and configuration. That can accelerate development and reduce the operational load for some layers, but it can also restrict customization compared with IaaS. If an application requires a special operating-system driver or deep kernel modification, a selected PaaS offering may not fit. The trade-off is the amount of control you need versus the number of layers you want the provider to operate.

SaaS: use the application instead of building its layers

With SaaS, the consumer uses a ready-made application. A general example is a collaboration tool or customer-relationship application delivered as a service. The customer does not manage the servers, operating system or core application code, but responsibility does not disappear. The customer still decides who has an account, what permissions users receive, what data is placed in the service and how available settings are configured. This becomes the focus of lesson four: moving to a higher-level service reduces technical layers managed by the customer, but it does not automatically transfer ownership of data, identity and usage decisions to the provider.

A preliminary decision can start with three questions. First, do we need a ready-made application or must we build custom software? Second, if we build it, do we need control of the operating system? Third, which operating skills do we possess and want to retain? Cost, reliability, security, data and integration questions then follow. This is not an automatic formula with one answer, but it prevents choosing IaaS merely because a team is familiar with servers, or SaaS merely because its name sounds simpler, without connecting the choice to actual requirements.

Summary: IaaS, PaaS and SaaS represent different levels of managed capability. IaaS provides deeper control with greater customer operating responsibility; PaaS lets the customer focus more on application and data than on the OS; SaaS provides a ready-made application while leaving the customer responsible for appropriate use, identity, data and available settings. Select the model from business and technical requirements rather than from the popularity of the label.