What Is Cloud Computing? How the Cloud Actually Works
Cloud computing means renting large numbers of computers owned by another company and using them over the internet. Those computers sit in special buildings called data centers. Many everyday services, such as photo storage and webmail, run in the cloud. Keeping them safe is a job the provider and the user share.
What you'll learn
- Where data that is "in the cloud" actually lives
- Why companies use the cloud, and what to watch for, such as costs and outages
- The difference between IaaS, PaaS and SaaS, and how virtualization works
- What is inside a data center, and the number that shows how efficiently it uses electricity
- The "shared responsibility model," which splits security between the provider and the user
Prerequisites: none. If you have saved photos on a phone or used webmail, that is enough.
In everyday life
When you switch to a new phone, your old photos are often still there. That is because they are stored not only on the phone, but also somewhere across the internet. Webmail, video streaming, and documents and spreadsheets you edit in a browser work the same way. In each case, the data and the computing live on distant computers, not in your hands.
Handing your data or your computing to distant computers like this is called "the cloud." Its full name is "cloud computing."
The cloud is "someone else's computers"
Saving something "to the cloud" does not mean the data floats in the air. There is a computer that hands out data or does calculations when asked. This is called a "server." What the cloud really is: servers owned by a cloud provider.
Your phone and the server are connected through the internet. "How Is Data Sent Over the Internet?" explains how the data travels.
Providers keep many servers together in special buildings. These buildings supply power, cooling and network lines for huge numbers of machines. Such a building is called a "data center." Users don't usually think about which machine inside it they are using.
In 2011, the US National Institute of Standards and Technology (NIST) published a definition of the cloud. It lists five essential characteristics. Here they are grouped into three and put in plain words.
- You sign up yourself over the network, whenever you want, and can start using it right away
- Many users share large facilities, and each can quickly scale their usage up or down
- Usage is measured automatically and is visible to the user (it is the basis for billing)
Why companies use the cloud
Before the cloud spread, companies usually bought their own servers and ran them in a room in their offices. This setup is called "on-premises." The money for the machines has to be spent up front, and it takes time before they arrive and run. The company also replaces parts and swaps out old machines itself.
With the cloud, renting a server takes a few minutes in a web page. You basically pay for the time you use and the amount you store. Even when you don't know whether a new service will take off, you can start small and grow as you go.
Another advantage is that you can change the number of servers to match the number of users. For example, a ticket site that gets swamped only on release day can add servers for just those hours. Adding and removing servers automatically, based on how busy things are, is called autoscaling.
Costs, and the risks of relying on a provider
The cloud is not always cheaper. As long as you rent, the charges keep coming every month. If you run many servers nonstop for years, buying your own can be cheaper. Some services also charge a transfer fee when you move your data out.
You also depend on the provider and the network. If your internet connection drops, you cannot use data that isn't on your device. If the provider has an outage, you cannot fix it yourself; you can only wait. Each provider works differently, so moving to another provider can take effort.
On October 19–20, 2025, Amazon's cloud, AWS, had a major outage in its Northern Virginia region in the US. The system that looks up a server's number from its name is called the Domain Name System (DNS). According to AWS's post-event summary, the cause was a hidden bug in a database service. The bug was in the system that automatically manages that service's DNS records. A record became empty, so new connections to that database failed. The impact spread to other services that relied on it. From the first problem to the time AWS declared the outage over took about 14.5 hours.
A company's own servers break down too. The difference is that one provider's outage hits many companies' services at once. Within one region, a provider builds several groups of buildings with separate power, cooling and network lines. Each group is called an availability zone, and important systems are spread across more than one. But as the example above shows, an outage can affect a whole region. So companies also plan for a backup in another region.
IaaS, PaaS and SaaS: how much do you rent?
Cloud services fall into three broad types, based on how much the provider supplies. This is the same split used in the NIST definition. The "aaS" at the end of each name stands for "as a Service."
The first letter says what is being rented. I stands for infrastructure, P for platform and S for software. Here, the platform means the OS plus the software an app needs to run. An OS, such as Windows or Linux, is the basic software that manages the whole computer.
| Type | What the provider supplies | Examples |
|---|---|---|
| IaaS | Infrastructure such as servers, storage and networks. The user manages everything from the OS up | Renting out virtual servers |
| PaaS | Everything up to the OS and the environment that runs programs. The user adds their own app | App hosting platforms, database services |
| SaaS | The app itself. The user just uses it, for example in a browser | Webmail, online document editors |
A table comparing the three by freedom of choice and operating effort is in "IaaS vs PaaS vs SaaS." There is also a style where you run only short programs and hardly think about managing servers. This is called serverless computing.
Virtualization: splitting one machine into many
Data center servers are powerful, and one task alone often cannot use them fully. So software is used to split one machine into several "apparent computers." This is called "virtualization."
Each of these pieces is called a "virtual machine." Each virtual machine has its own OS and looks to the user like a separate computer. Virtual machines from different companies may sit side by side on the same physical machine.
Special software hands out the machine's resources to the virtual machines. It also walls them off so they cannot look inside one another. This software is called a hypervisor. Creating a virtual machine needs no new hardware, so you can use it shortly after signing up. When you are done, you delete it, and its share of resources goes to other users.
There is also a lighter way to split things up. Instead of running a whole OS for each piece, apps share the core of one OS and are walled off from each other. Each walled-off piece is called a container. Containers are light and start fast, but their walls are generally not as strong as a virtual machine's. "Virtual Machine vs Container" sums up the differences in a table.
What is inside a data center?
Inside a data center, rows of tall shelves stand side by side. Each shelf is called a "rack," and it holds many thin, box-shaped servers stacked on top of each other. There are also devices that store data (storage) and network equipment that links the machines to each other and to outside lines.
Equipment that keeps everything running matters too. In case of a power cut, there are batteries that can supply power instantly, plus emergency generators. Servers give off heat when they run, so without constant cooling they stop or break. Besides large air-conditioning systems, some data centers cool machines by running cold liquid close to them.
One number shows how efficiently a data center uses electricity. It is called power usage effectiveness (PUE). It is the power used by the whole building, divided by the power used by IT equipment such as servers. With no waste at all in cooling or power conversion, it would be 1.0. The closer to 1, the more efficient.
In a 2024 worldwide survey by the research firm Uptime Institute, the average PUE was 1.56. It is the yearly value of the largest facility each respondent runs. That means for every 1 unit of power the IT equipment uses, 0.56 more goes to cooling and so on. Big providers publish lower values. For example, Google reports 1.09 across its large-scale data centers in 2024. But measuring methods and climates differ, so the numbers can't be compared directly.
AI and GPUs run in the cloud too
AI is a hot topic in today's data centers. Training and running AI requires huge amounts of the same kind of calculation. So it uses chips called GPUs, which can do many calculations at the same time. "Why Are GPUs Used for AI?" explains why.
Training a large AI model takes huge numbers of expensive GPUs, and few companies can buy them all. So cloud providers set up servers with GPUs and rent them out by the hour.
As AI spreads, the electricity used by data centers is growing too. This electricity is measured in TWh (terawatt-hours); 1 TWh is 1 billion kWh. A 2025 report by the International Energy Agency (IEA) put the world's data center power use in 2024 at about 415 TWh. That is about 1.5% of the world total. The IEA expects it to reach about 945 TWh in 2030, more than double.
Security is shared: the shared responsibility model
In the cloud, the provider and the user split the job of keeping things secure. This idea is called the shared responsibility model. AWS puts it this way: the provider is responsible for security "of" the cloud, and the user for security "in" the cloud.
The provider takes care of the buildings, the machines and the virtualization layer. That includes controlling who enters the building, repairing machines and fixing the underlying software. The user takes care of their own accounts, the settings for who may do what, and the data they store. With IaaS, updating the OS on virtual machines is also the user's job.
Microsoft says that in every model, the data and identities (accounts) belong to the user, and so does the duty to protect them. Google also describes a more active approach, in which the provider supports users, for example by offering secure setting templates.
Incidents often start with a mistake in the user's own settings. In a 2020 document, the US National Security Agency (NSA) named misconfigured cloud resources as the most common weakness. For example, someone sets a file storage area to "anyone can view," and outsiders read its contents.
Passwords are targets too. If you use one that is easy to guess, or reuse one that leaked elsewhere, attackers get in, however solid the provider's systems are. "How Are Passwords Cracked?" explains how to prevent this. Checking who you are with a second method, such as your phone, on top of a password is called multi-factor authentication. In the cloud, it is a basic must.
Common myths
Myth: The cloud is somewhere up in the sky, with no fixed location
In fact, data is stored on machines in a real building, in a real country. Most providers let users choose the region where their data is kept. The laws that apply can change with the country where data is kept, so companies check and choose the location. The myth comes easily from the name "cloud" and from how you can use it without thinking about location.
Myth: Data in the cloud is backed up automatically, so it is safe
In fact, providers often copy data onto several devices in case a machine fails. But that does not protect you when you delete or overwrite something yourself. With services that keep your device and the cloud in sync, deleting a file on your device can delete it from the cloud too. Account takeovers and ransomware (programs that lock up your data and demand a ransom) can also cause damage. Keep a copy of important data somewhere else as well.
Myth: Moving to the cloud always saves money
In fact, it tends to be cheaper when usage goes up and down a lot, or when you want to start small. But if you use the same amount for years, running your own can be cheaper. Servers you forget to shut down are billed too. When comparing, look at the total cost, including electricity and the time of the people who manage it.
By the numbers
| Item | Figure | Notes |
|---|---|---|
| Data center PUE (survey average) | 1.56 | Uptime Institute worldwide survey (2024) |
| PUE across Google's large-scale data centers | 1.09 | Google's published figure (2024, annual) |
| World data center electricity use | About 415 TWh | About 1.5% of the world's electricity (IEA, 2024) |
| Same, projected for 2030 | About 945 TWh | More than double 2024 (IEA base case) |
| AWS outage, October 2025 | About 14.5 hours | From the first problem to the end of the outage (AWS post-event summary) |
| Cloud infrastructure market share (April–June 2026) | Amazon 28%, Microsoft 20%, Google 15% | Synergy Research Group estimate |
The market shares are estimates based on revenue from IaaS, PaaS and similar services combined. The top three hold just over 60% together. The figures change every quarter, and they also differ by research firm.
Learn more
- Try the math: the availability calculator (how much downtime drops when you split a service across two servers)
- Terms for the next step: object storage (cloud storage for things like photos), SLA (the provider's commitment on availability and similar levels), single point of failure (a part whose failure stops everything)
- More about containers: Docker (a tool for building and running containers), Kubernetes (a platform for managing many containers together)
- Start from the foundation: the basic software that runs even inside virtual machines, in "What Is an Operating System?"