SaaS, PaaS and IaaS
Three ways to rent computing, depending on how much of the work you hand over.
Cloud computing is usually sold in three layers, depending on how much the provider takes care of. With IaaS (infrastructure as a service) you rent the raw pieces: virtual machines, disks and networks, like Amazon EC2. The provider runs the data center and the hardware; you install and look after the operating system, the software and everything on top.
With PaaS (platform as a service) you hand over more. You bring your code and the platform runs it: it provides the operating system, the runtime and often the database, and handles patching and scaling. Heroku, Google App Engine and AWS Elastic Beanstalk are classic examples. With SaaS (software as a service) you rent a finished application and just use it in the browser: Gmail, Slack, Salesforce, Microsoft 365.
The trade-off is always the same: the more the provider manages, the less you can customize and the less work you do yourself. Many services sit between the labels; serverless functions, for example, are often described as a step beyond PaaS. Security responsibility is split the same way: in IaaS you patch your own servers, in SaaS you mostly manage who has access.
Keep in mind
- IaaS: rent virtual machines, storage and networks; you manage the rest.
- PaaS: bring your code; the platform runs and scales it.
- SaaS: use a finished app, usually in the browser, on a subscription.
- More managed means less work and less control, including on security.
Go deeper
- Types of cloud computing (AWS)
- The NIST definition of cloud computing
- Software as a service on Wikipedia
