Cloud services come in three basic types: infrastructure, platform and software, each "as a service." The abbreviations IaaS, PaaS and SaaS show up constantly in the Azure world. This lesson explains what is behind them and how the shared responsibility from lesson 1.1 is distributed across them.

Infrastructure as a Service (IaaS)

IaaS is the most flexible category and gives you the most control. The provider is responsible for the hardware, the network connection to the internet and physical security. For everything else you are responsible, above all for:

  • installing, setting up and maintaining the operating system,
  • the network setup,
  • setting up databases and storage.

You are essentially renting hardware in a cloud datacenter. What you do with it is up to you. You carry the greatest responsibility in operations and, in return, have the greatest freedom.

Typical use cases:

  • Lift-and-shift migration: You build resources in the cloud that resemble your previous datacenter and move your workloads there.
  • Test and development: You need to quickly recreate proven configurations for development and test environments. With IaaS you start and stop environments quickly and keep full control.

Platform as a Service (PaaS)

PaaS is a middle way between renting space in the datacenter (IaaS) and paying for a ready-made, provisioned solution (SaaS). The provider maintains the physical infrastructure, physical security and the internet connection. On top of that come the operating systems, the middleware, the development tools and the analytics services of a cloud solution. You don't have to worry about licenses or about patches for operating systems and databases.

You concentrate on your application code, your data and your access control. Depending on the configuration of the service, you share some network and application security settings with the provider.

Typical use cases:

  • Development framework: PaaS offers a scaffold on which developers build or customize cloud applications. Features such as scalability, high availability and multitenancy are already built in, so less programming work is needed.
  • Analytics and business intelligence: Tools as a service help to analyze data, find patterns and predict results.

Software as a Service (SaaS)

SaaS is the most complete model from a product point of view: You rent or use a fully developed application. Email, financial software, messaging and connectivity software are typical examples. SaaS is the least flexible, but the easiest to put into operation and requires the least technical knowledge.

The provider manages almost the entire application stack: infrastructure, platform and maintenance of the application. You take care mainly of your data, the settings for identity and access, and the access of your devices. That gives customers the lowest operating effort.

Typical use cases:

  • email and messaging,
  • office and productivity applications,
  • financial and expense management.

The comparison

The further you go from IaaS through PaaS to SaaS, the more the provider takes over and the less control you have.

IaaS PaaS SaaS
Provider hardware, network connection, physical security in addition operating systems, middleware, development tools almost the entire application stack
You operating system, network, database, storage, applications application code, data, access data, identity and access, device access
Control greatest medium least
Operating effort greatest medium least
Use cases lift-and-shift, test and development development framework, analytics email, productivity, finance

One thing stays the same in all three cases: Your data, your devices and your accounts and identities are always your responsibility, as in lesson 1.1. And the physical datacenter always belongs to the provider.

An example: The made-up tax firm "Weber & Partner" uses a cloud mailbox, firm software that it runs itself on rented virtual machines, and a platform on which a developer builds a client portal. The mailbox is SaaS, the firm software on the machines runs as IaaS, and the client portal on the platform is PaaS.

How to recognize the service type

A simple question helps with classification: What do I have to maintain myself? If you have to install and patch operating systems, it is IaaS. If you maintain only your own code and your data, it is PaaS. If you use the application as it is and manage only users, access and data, it is SaaS.

The service type says nothing about "good" or "bad." It only describes how control and effort are distributed. Anyone who needs maximum control chooses IaaS and accepts the maintenance effort. Anyone who wants as little operations as possible chooses PaaS or SaaS and gives up control in return. That fits the benefit of the cloud from lesson 1.2: On the topic of security, you can choose the service type to match your needs.

Exercise 1

Assign these five situations to IaaS, PaaS or SaaS and say in each case what you are still responsible for yourself:

  1. The travel agency chain "Nordlicht" uses a ready-made online program for expense reports.
  2. The company "Haller Maschinenbau" moves its servers from the basement to the cloud, with the same operating systems and settings as before.
  3. A team wants to develop a web application without patching operating systems, and needs a ready-made development scaffold with scaling for it.
  4. The agency "Pixelwerk" wants to spin test environments up and tear them down quickly, with full control over every machine.
  5. A school uses a cloud service for email and messaging.

Solution 1
  1. SaaS. A ready-made application for financial and expense management. You are responsible for your data, access and devices.
  2. IaaS. This is a lift-and-shift migration. You are responsible for the operating system, network setup, database, storage and the applications, the provider only for hardware, connection and physical security.
  3. PaaS. A development framework. The provider maintains operating systems and middleware, you take care of application code, data and access.
  4. IaaS. Test and development with full control. The price for it is that you maintain the operating system, patches and software yourself.
  5. SaaS. Email and messaging are classic SaaS examples. The school manages users, access and data.

Memory aid: The more you get to decide yourself, the more you also have to maintain yourself.

Further reading