Cloud Computing Basics — IaaS, PaaS, SaaS

Cloud computing is renting someone else's computers. That sounds reductive, but it captures the fundamental shift: instead of buying servers, racking them, and depreciating them over five years (capex), you pay for what you use by the hour or second (opex). The reason this model won isn't just cost — it's elasticity. You can go from one server to a thousand in minutes, and back down to one when the traffic subsides. No procurement cycle, no capacity planning guesswork, no hardware gathering dust in a closet.

The Service Model Spectrum

Think of cloud services as a spectrum of how much you manage versus how much the provider manages.

On-prem: you own everything — the building, the power, the network, the hardware, the OS, the runtime, the application. IaaS (Infrastructure as a Service): the provider handles the physical stuff and virtualization; you manage the OS upward. PaaS (Platform as a Service): the provider also handles the OS, runtime, and scaling; you deploy your code. SaaS (Software as a Service): the provider runs the entire application; you just use it.

There's also FaaS (Function as a Service) — sometimes called serverless — which sits between PaaS and SaaS. You write individual functions, the provider handles literally everything else including scaling to zero when idle. Think AWS Lambda, Google Cloud Functions, Azure Functions.

The Shared Responsibility Model

This spectrum creates a security contract. The provider secures what they manage; you secure what you manage. In IaaS, if someone compromises your VM because you left SSH open to the internet with a weak password, that's on you. In SaaS, if someone breaches Gmail's infrastructure, that's on Google — but if your users fall for phishing because you didn't enable MFA, that's on you.

The shared responsibility line shifts with each service model. The higher up the stack you go, the less you manage and the less you can misconfigure. This is why PaaS and serverless are genuinely more secure for most teams — there's simply less surface area to get wrong.

AWS Implementation

IaaS: EC2 instances — virtual machines you fully control. You pick the AMI (OS image), instance type, storage, and networking. You patch it, you secure it.

PaaS: Elastic Beanstalk wraps EC2, load balancers, and auto scaling behind a deploy-your-code interface. App Runner is simpler still — point it at a container image or source repo and it handles the rest. Lambda is the FaaS option.

SaaS: AWS sells SaaS too (WorkMail, Chime), but you're more likely consuming third-party SaaS that runs on AWS.

GCP Implementation

IaaS: Compute Engine — same concept as EC2. You choose machine types, images, and disks.

PaaS: App Engine (the original PaaS, predating most of AWS) handles deployment and scaling with minimal config. Cloud Run takes any container and runs it serverlessly — you pay per request. Cloud Functions is the FaaS equivalent.

SaaS: Google Workspace (Gmail, Docs, Drive) is one of the world's largest SaaS platforms.

Azure Implementation

IaaS: Azure Virtual Machines — Microsoft's VM offering with strong Windows Server and SQL Server integration.

PaaS: App Service deploys web apps from code or containers with built-in CI/CD. Container Apps is Azure's answer to Cloud Run — serverless containers with KEDA-based autoscaling. Azure Functions is the FaaS play.

SaaS: Microsoft 365 (Office, Teams, SharePoint) is the flagship. Azure AD (now Entra ID) is SaaS for identity.

Side-by-Side Comparison

Aspect	AWS	GCP	Azure
IaaS (VMs)	EC2	Compute Engine	Azure VMs
PaaS (code deploy)	Elastic Beanstalk, App Runner	App Engine, Cloud Run	App Service, Container Apps
FaaS	Lambda	Cloud Functions	Azure Functions
SaaS	WorkMail, Chime	Workspace	Microsoft 365
Market position	Largest, broadest service catalog	Strong in data/ML, developer experience	Enterprise/hybrid, Microsoft ecosystem
Free tier	12-month + always-free tier	90-day $300 credit + always-free	12-month + always-free tier

The Three Providers' Character

Each provider has a personality. AWS is the broadest — it has a service for everything, sometimes three. The tradeoff is complexity and a console that makes you feel like you're piloting a spaceship. GCP tends toward cleaner APIs and stronger defaults (their VPC is global, their IAM is simpler), but has a smaller service catalog and a reputation for killing products. Azure dominates enterprises already running Microsoft — Active Directory integration, SQL Server licensing benefits, and hybrid cloud via Azure Arc.

Pricing Model Basics

All three providers charge similarly: compute by the second/hour, storage by the GB/month, network egress by the GB (ingress is free), and API calls by the request. The trap is that cloud pricing is designed to be easy to start and hard to predict. You'll encounter on-demand pricing (pay as you go), reserved/committed use discounts (commit to 1-3 years for 30-60% off), and spot/preemptible instances (use spare capacity for 60-90% off, but you can be interrupted).

The single most important pricing insight: storage is cheap, compute is moderate, and egress will surprise you. Budget for it.

Key Takeaways

• Cloud's advantage is elasticity and opex over capex — you trade control for speed and flexibility
• The IaaS/PaaS/SaaS spectrum determines what you manage versus what the provider manages, and therefore what you're responsible for securing
• FaaS/serverless pushes the management line furthest toward the provider, reducing operational burden and security surface area
• AWS is broadest, GCP is cleanest, Azure is strongest in Microsoft-heavy enterprises — but all three are converging on similar capabilities
• Pricing follows a common pattern across providers: compute hours, storage GB, and egress GB — with egress being the most common surprise
• The shared responsibility model is not theoretical; misconfigured cloud resources are the leading cause of breaches

Next up, we'll look at the physical infrastructure underneath all of this — regions and availability zones.