English
Menu

IaaS vs PaaS vs SaaS: What Is Provided and What You Manage

IaaS, PaaS and SaaS classify cloud services by how much the provider supplies. IaaS (infrastructure as a service) provides infrastructure such as virtual machines, storage and networks, and the user manages everything from the operating system up. PaaS (platform as a service) has the provider supply the operating system, middleware and language runtimes as well, and the user brings their own applications and data. SaaS (software as a service) provides the application itself, which the user simply uses through a web browser or similar. Moving from IaaS toward SaaS reduces the operating effort but also narrows what the user can freely choose.

AspectIaaSPaaSSaaS
What the provider suppliesInfrastructure such as virtual machines, storage and networks (including the buildings, physical equipment and virtualization layer beneath)Everything in IaaS plus the OS, middleware and language runtimesEverything, up to the application
What the user managesThe OS, middleware, applications and data; OS updates and security patches are also the user's jobTheir own applications and data, and their settingsData, user accounts and permissions, and application settings
User flexibilityHigh: any OS or software can be chosen and installedMedium: build within the languages and runtimes the provider supportsLow: use the features and settings that are offered
Operating effortLarge: the user designs and carries out OS updates, monitoring, backups, scaling and so onSmall: the provider often handles runtime maintenance and scalingSmallest: the provider handles software updates and incident response
Typical usersInfrastructure engineers and organizations moving their own servers to the cloudApplication developersBusiness staff and general users of the application
Example pricing approachOften pay-as-you-go, by number of virtual machines and hours run, storage capacity, data transfer and so onOften charged by number of executions, run time or resources usedOften a monthly or yearly subscription per user
Split under the shared responsibility modelProvider up to physical facilities and the virtualization layer; user from the guest OS upProvider up to the OS and runtime; user for applications and dataProvider up to the application; data, accounts and access settings remain with the user
Typical examplesServices that rent out virtual machines (virtual servers), block storage, virtual networksServices that provide an application runtime, managed database servicesWeb mail, online word processing and spreadsheets, groupware, customer relationship management (CRM)

Figures are typical orders of magnitude and vary by process generation and product.

When to use which

IaaS
When you want to choose the OS and middleware yourself, move systems that ran on your own servers to the cloud largely as they are, or run software with an unusual configuration. In return, you also handle OS updates and security settings yourself.
PaaS
When you want to leave infrastructure management to the provider and concentrate on developing applications. You must build within the languages and runtimes the provider supports.
SaaS
When you want to start using common business functions such as email, document editing or customer management right away, without building software. The features are limited to what is offered.

FAQ

Which of IaaS, PaaS and SaaS does serverless (FaaS) belong to?

You provide only the function code and leave the runtime environment and scaling to the provider, so it is generally treated as a form close to PaaS. Services that provide a platform for running containers are sometimes called CaaS (container as a service) and placed between IaaS and PaaS. Such finer classifications differ between providers and sources.

With SaaS, is security entirely the provider's responsibility?

No. Under the shared responsibility model, the provider handles everything up to the application in SaaS, but the stored data, user accounts and passwords, multi-factor authentication settings and the scope of file sharing remain the user's responsibility. An incident in which files are accidentally made viewable by anyone is a problem on the user's side.

Where are IaaS, PaaS and SaaS defined?

The most commonly cited source is the definition of cloud computing published by the US National Institute of Standards and Technology (NIST) in 2011 (SP 800-145). It defines three service models for the cloud: SaaS, PaaS and IaaS.

How does IaaS differ from on-premises?

On-premises means buying your own equipment, placing it in your own facilities and managing everything from the building and power up. With IaaS, the management of the buildings, physical equipment and virtualization layer is left to the provider, and you rent only what you need when you need it. In return, usage charges continue for as long as you use it, and you are affected by the provider's outages.

Check your understanding

Among cloud services, which is the one in which the provider supplies infrastructure such as virtual machines, storage and networks, while the user installs and manages the OS, middleware and applications?

  1. ASaaS
  2. BIaaS
  3. CPaaS
Show answer and explanation

Answer: B. IaaS

Cloud services are classified by the range the provider supplies. IaaS (infrastructure as a service) supplies infrastructure such as virtual machines, storage and networks, and the user manages the OS and applications on top. PaaS (platform as a service) supplies everything up to the execution environment such as the OS and middleware, and SaaS (software as a service) supplies everything up to the application, so the user has correspondingly less to manage.

In an IaaS cloud service, which does the user generally manage?

  1. AThe data center buildings and the power and air-conditioning facilities
  2. BThe physical equipment such as servers and storage, and the virtualization platform
  3. CThe OS, middleware and applications running on the virtual machines
Show answer and explanation

Answer: C. The OS, middleware and applications running on the virtual machines

In IaaS (Infrastructure as a Service), the provider manages the buildings, facilities, physical equipment and virtualization platform, and the user manages everything from the OS on the virtual machines upward. In PaaS the provider also manages the OS and middleware and the user manages the applications and data, and in SaaS the provider manages up to the application and the user manages the data and usage settings. In this way, the scope of responsibility shared between the provider and the user changes with the service model.

A managed database service in the cloud (one in which the provider operates the database software) is used. Under the shared responsibility model, which of the following generally remains the user's responsibility?

  1. AApplying security fixes to the OS of the servers running the database and to the database software
  2. BProtecting the data center buildings and physical equipment such as servers from failures and intrusion
  3. CManaging the database user accounts and privileges, the network ranges allowed to connect, and the data stored
Show answer and explanation

Answer: C. Managing the database user accounts and privileges, the network ranges allowed to connect, and the data stored

Under the shared responsibility model, the cloud provider and the user share the responsibility for security and operations, and where the boundary lies depends on the type of service. With a managed database service, the provider takes care not only of the physical facilities but also of updating the OS and the database software. On the other hand, who may access which data, which networks may connect and what data is stored remain the user's responsibility in every type of service. An accident in which a misconfiguration exposes a database to the internet is a problem on the user's side.

  1. With serverless functions (FaaS), only the first call to a function that has not been called for a while sometimes responds hundreds of milliseconds to several seconds slower. Which of the following correctly explains this phenomenon?
  2. Cloud storage is used for three purposes: (1) attaching it to a virtual machine as a disk, creating a file system and storing database data files; (2) mounting it from several servers at the same time and using it as a shared directory; (3) reading and writing a large number of images by key (name) through an HTTP API and growing the capacity without deciding it in advance. Which of the following is the appropriate combination of storage types for (1) to (3)?
  3. Virtual machines that are charged only for the time used, at ¥40 per hour (a made-up price), are used. Normally 2 machines run throughout the month (30 days), and on 20 weekdays 4 more are added for 6 hours a day to match the load. Which of the following is the charge for the month?

Practice Cloud and Container Basics questions

Key terms explained

Shared responsibility model
The idea that, when using the cloud, the responsibility for security and operations is shared between the cloud provider and the user. The provider is responsible for data center buildings and physical equipment, and the user for the data stored, accounts and access settings, permissions for network connections and so on. The boundary in between changes with the type of service, such as IaaS, PaaS, SaaS or managed services. Many information leaks caused by misconfiguration occur within the scope of the user's responsibility.
Serverless computing
A way of running applications in which provisioning servers, managing their number and updating the OS are left to the cloud provider, so users need not think about them. The typical form is FaaS (Function as a Service): a function runs only when a request or event arrives, and charges depend on the number of executions, their duration and the memory used. Scaling with load is automatic, and almost nothing is charged when it is not used. On the other hand, there are constraints such as cold starts, where the first call after a period of inactivity is slow, and limits on execution time.
Hypervisor
Software that runs multiple virtual machines on one computer, allocating CPU, memory and devices to each guest OS and isolating them from one another. Also called a virtual machine monitor.
Autoscaling
A mechanism that automatically increases or decreases the number of servers or containers according to load indicators (CPU utilization, request rate, queue length and so on). Adding machines is called scaling out and removing them scaling in. The Kubernetes HorizontalPodAutoscaler computes the required number as ⌈current number × current value ÷ target value⌉. New instances take time to start working, so sudden load increases are handled with a target that leaves headroom, and a waiting period before scaling in is common so that the number does not change too often.
Object storage
Storage that keeps data as objects carrying a key (name) and metadata and reads and writes them whole through an HTTP API. Capacity can grow almost without limit without being decided in advance, and data is generally replicated across several devices or locations for high durability. It suits images, video, backups, logs and the files of static websites. It is not suited to rewriting parts of files as in a file system or to holding database data files; for those, block storage, which provides virtual disks, or file storage, which provides a shared file system, is used.
SLA (service level agreement)
An agreement between the provider and the user of an IT service that sets the quality levels, such as availability, response time, time to recover from failures and support hours, together with how they are measured and what happens if they are not met.

Related comparisons