What Is Cloud Computing? – IaaS, PaaS, SaaS, and the Shared Responsibility Model
"We are moving to the cloud." "Our data is in the cloud." You have heard these phrases countless times. But what is the cloud, really? In this post, we will define cloud computing, explain the three main service models (IaaS, PaaS, SaaS), the deployment types (public, private, hybrid), and the most important concept in cloud security: the shared responsibility model.
1. The Five Essential Characteristics of Cloud Computing
|
Characteristic |
Meaning |
Example |
|
On-demand self-service |
Provision resources without talking to a human. |
Log into AWS and launch a virtual server in 30 seconds. |
|
Broad network access |
Resources accessible over the internet from any device. |
Access your cloud files from your phone on a train. |
|
Resource pooling |
Computing resources shared among many customers (multi-tenant). |
Your data may be on the same physical server as another company's data, but logically separated. |
|
Rapid elasticity |
Resources can scale up or down quickly. |
A news site gets a traffic surge during a breaking story – cloud automatically adds more servers. |
|
Measured service |
Pay only for what you use (metered billing). |
Pay per gigabyte of storage, per hour of compute. |
Key insight: Cloud computing is not a physical location. It is a delivery model for computing resources with these five properties.
2. The Three Service Models
A. Infrastructure as a Service (IaaS)
You rent virtual servers, storage, and networking. You install your own operating system and applications. The provider manages the physical hardware and data center.
Examples: Amazon EC2, Google Compute Engine, Microsoft Azure Virtual Machines, DigitalOcean Droplets. Best for: Companies that want full control but do not want to buy hardware.
B. Platform as a Service (PaaS)
You deploy your applications without managing the underlying OS or runtime. The provider handles servers, operating systems, patches, and scaling.
Examples: Google App Engine, AWS Elastic Beanstalk, Heroku, Microsoft Azure App Service. Best for: Developers who just want to write code without worrying about server administration.
C. Software as a Service (SaaS)
You use a fully functional application over the internet. The provider manages everything.
Examples: Google Workspace (Gmail, Docs), Microsoft 365, Salesforce, Dropbox, Zoom. Best for: End users who just need the software.
Analogy – Transportation as a Service:
- IaaS: You buy a car. You drive, maintain, fuel, insure it.
- PaaS: You rent a car with a driver. You tell the driver where to go, but they handle driving.
- SaaS: You take a taxi. You just ride; someone else does everything.
3. Deployment Models
|
Model |
Description |
Who uses it? |
|
Public cloud |
Services over the public internet, shared among many customers. |
Most companies, individuals. Examples: AWS, Azure, Google Cloud. |
|
Private cloud |
Cloud infrastructure dedicated to a single organization. |
Government, financial institutions, healthcare (strict compliance). |
|
Hybrid cloud |
Combination of public and private clouds. |
Companies that keep sensitive data on-prem but use public cloud for burst capacity. |
|
Multi-cloud |
Using multiple public cloud providers. |
Large enterprises avoiding vendor lock-in. |
4. The Shared Responsibility Model – Critical for Security
Many people assume that if data is in the cloud, the provider is responsible for all security. That is false.
|
Responsibility |
On-Premises |
IaaS |
PaaS |
SaaS |
|
Physical security of data center |
You |
Provider |
Provider |
Provider |
|
Operating system |
You |
You |
Provider |
Provider |
|
Application code |
You |
You |
You |
Provider (you configure) |
|
Data (encryption, backups) |
You |
You |
You |
You (mostly) |
|
Access management (users, passwords) |
You |
You |
You |
You |
Real-world example: A company stores sensitive customer data in an AWS S3 bucket but left the bucket publicly readable (misconfigured permissions). The breach is the company's fault, not AWS's. This has happened many times. Always encrypt your data and configure access controls properly.
5. Why Move to the Cloud?
|
Traditional On-Premises |
Cloud |
|
Buy servers months in advance |
Provision in minutes |
|
Pay for peak capacity (idle most of the time) |
Pay only for what you use (auto-scaling) |
|
Hardware maintenance, power, cooling |
Provider handles physical infrastructure |
|
Capital expenditure (CapEx) – large upfront costs |
Operational expenditure (OpEx) – pay as you go |
Summary
|
Term |
Definition |
|
IaaS |
Rent virtual servers, storage, networking – manage OS and above. |
|
PaaS |
Deploy code without managing OS – provider handles runtime. |
|
SaaS |
Use fully functional applications over the internet. |
|
Public cloud |
Shared infrastructure, open to anyone. |
|
Private cloud |
Dedicated infrastructure for one organization. |
|
Shared responsibility model |
Security is split between provider and customer; customers are responsible for data, access, and configuration. |
Review Questions
- You want to run a custom machine learning model on a GPU and need to install specific libraries. Which cloud service model (IaaS/PaaS/SaaS) is most appropriate?
- A company leaves an S3 bucket open to the public. Who is responsible for the data breach – AWS or the company? Why?
- Give one scenario where on-premises hosting might be cheaper than cloud.