IaaS, PaaS, and SaaS
Learn the three cloud service models, what you manage in each, and how to tell which one a product actually is.
By the end of this lesson you can
- Define IaaS, PaaS, and SaaS and give examples of each
- Identify what the customer manages versus the provider in each model
- Choose the appropriate model for a given need
- Explain the shared responsibility model for security
Lesson Notes
Read through the key concepts before you try the challenge.
Three models, one question: how much do you manage?
You review vendor proposals at Lakeside Medical Associates.
Three vendors all describe their product as 'cloud-based.' One provides virtual servers the practice must configure and patch. One provides a platform for building an application. One provides a finished scheduling application accessed in a browser. Calling all three 'the cloud' obscures the only thing that matters: who is responsible for what.
Your task: Distinguish the three service models by what the customer is left managing.
The three models form a stack. At each level upward, the provider manages more and you manage less — gaining convenience and losing control. There is no best model; there is only the right amount of responsibility for what you are trying to do.
| Layer | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Application | You | You | You | Provider |
| Data | You | You | You | You |
| Runtime | You | You | Provider | Provider |
| Operating system | You | You | Provider | Provider |
| Virtualization | You | Provider | Provider | Provider |
| Servers and storage | You | Provider | Provider | Provider |
| Networking | You | Provider | Provider | Provider |
Key terms
- IaaS — Infrastructure as a Service
- Rented virtual machines, storage, and networking. You install and maintain everything above the hardware. Examples: Amazon EC2, Azure Virtual Machines.
- PaaS — Platform as a Service
- A managed environment for running applications you write, without managing the servers or operating system. Examples: Azure App Service, Google App Engine.
- SaaS — Software as a Service
- A finished application you simply use. Examples: Google Workspace, Microsoft 365, most EHR systems.
A useful analogy is transport. IaaS is leasing a car — you drive, fuel, and maintain it. PaaS is a rental with servicing included — you drive, someone else maintains. SaaS is a taxi — you state a destination and someone else handles everything. The analogy also captures the trade: the taxi is easiest and gives you the least control over the route.
A practice uses a browser-based scheduling application. The vendor manages the servers, the operating system, and the application itself. What remains the practice's responsibility?
Challenge
Apply what you've learned in this lesson.
Classify real products and reason about responsibility.
- Classify each as IaaS, PaaS, or SaaS: Google Docs, Amazon EC2, Microsoft 365, Azure App Service, Dropbox, a hosted EHR.
- For the three vendor proposals in the scenario, identify each model and say what the practice would need to staff for in each case.
- Draw the responsibility table for a SaaS EHR, marking each layer as practice or vendor.
- List four things a practice must do to secure a SaaS application, given that the vendor secures the infrastructure.
Finished this lesson?
Progress is saved in this browser only. It is not a grade — official progress lives in Brightspace.