IaaS vs PaaS vs SaaS
Also known as: cloud service models, IaaS PaaS SaaS
IaaS, PaaS, and SaaS describe three levels of cloud services.
Infrastructure as a Service (IaaS) rents virtual servers, storage, and networks, and you manage everything on top. Platform as a Service (PaaS) also handles operating systems and runtimes, so developers just deploy code. Software as a Service (SaaS) delivers finished apps, such as Microsoft 365 or Salesforce, that you simply use. While the labels are handy, many modern services blend them, and your security responsibilities change at each level.
IaaS vs PaaS vs SaaS, explained at three levels
At home
Think of pizza. IaaS is renting a kitchen, PaaS is buying a pizza kit, and SaaS is ordering delivery. The more you pay for, the less you do yourself.
At work
Choosing the right cloud model balances control, effort, and cost for each business need.
At home
Most cloud services people use, such as Gmail, Dropbox, and Netflix, are SaaS. IaaS and PaaS are mostly used by developers and IT teams.
At work
IaaS examples include AWS EC2 and Azure Virtual Machines. PaaS examples include Azure App Service, Heroku, and Google App Engine. SaaS examples include Microsoft 365, Salesforce, and QuickBooks Online.
At home
With SaaS, your data lives in someone else's system. In my opinion, check whether you can export it before committing.
At work
Map shared responsibility for each model: with IaaS you patch operating systems, with PaaS you secure code and configuration, and with SaaS you manage identities, access, and data settings.
Real-world examples
At home
Lena uses SaaS apps for school, but for a coding class she deployed a website to a PaaS service without managing any servers.
At work
Carlos is IT director at a Montreal manufacturer. He moved email to SaaS, a custom app to PaaS, and a legacy system to IaaS virtual machines.
How it compares
| feature | IaaS | PaaS | SaaS |
|---|---|---|---|
| You manage | OS, apps, data | Apps and data | Data and users |
| Provider manages | Hardware, networking | Hardware, OS, runtime | Everything else |
| Examples | AWS EC2, Azure VMs | Heroku, App Service | Microsoft 365, Salesforce |
| Control | Most | Medium | Least |
Moving from IaaS to SaaS trades control for convenience.
For analysts
For each system in a cloud strategy, I'd document which model fits and who owns security tasks. It prevents gaps where everyone assumes someone else is responsible.
History & origin
Hosted software, through 'application service providers' in the late 1990s, preceded SaaS, which Salesforce popularized from 1999. Amazon's EC2 in 2006 defined IaaS, and Google App Engine in 2008 and Heroku, founded in 2007, popularized PaaS. The US National Institute of Standards and Technology formalized the three models in its 2011 cloud definition. Since then, newer categories such as serverless functions and containers as a service have blurred the boundaries. In my view, the three models are best used as a way to ask 'who manages what?' rather than as strict categories.