Cloud basics: IaaS, PaaS, SaaS and the shared responsibility model
The cloud is rented computing. Learn the service models, how regions work and which security jobs stay with you.
Cloud computing means renting computing resources (servers, storage, databases, networks) over the internet, paying for what you use, instead of buying and running your own hardware. You can create a server in minutes and delete it when done.
The service models
Think of it as how much of the stack the provider manages for you.
- IaaS (infrastructure as a service): you get virtual machines, disks and networks. You manage the operating system, runtime and app. Examples: AWS EC2, Google Compute Engine, Azure VMs, DigitalOcean droplets.
- PaaS (platform as a service): you deploy code or containers, and the provider runs the servers, OS and scaling. Examples: Heroku-style platforms, Google App Engine, Azure App Service.
- SaaS (software as a service): a finished application you just use, such as Gmail or Slack.
- Serverless / FaaS: you upload small functions that run on demand, and you pay per execution. The provider handles servers entirely.
More control means more responsibility. Less control means less work, and sometimes less flexibility or more lock-in.
Regions and availability zones
- A region is a geographic area, such as Singapore or Frankfurt. Pick one close to your users, and check any data residency rules.
- An availability zone (AZ) is one or more separate data centres inside a region, with independent power and networking.
- Spreading across two or more AZs protects you from a single data centre failure. Spreading across regions protects you from a whole-region problem, at higher cost and complexity.
The usual building blocks
- Compute: virtual machines, containers, functions.
- Storage: block disks, file storage, object storage.
- Databases: managed relational and NoSQL databases.
- Networking: private networks, load balancers, DNS, CDN.
- Identity and access management (IAM): who can do what.
- Monitoring and logging.
How pricing works
- On-demand: pay by the second or hour, no commitment.
- Reserved or committed use: a discount for committing to usage over one or more years.
- Spot or preemptible: cheap spare capacity that the provider can take back, good for interruptible jobs.
- Hidden costs: data egress (traffic leaving the cloud), NAT gateways, cross-zone traffic, unused disks and idle load balancers.
Set budgets and billing alerts on day one. A forgotten resource or a leaked key can run up a large bill.
The shared responsibility model
The provider secures the cloud (physical data centres, hardware, the virtualisation layer). You secure what you put in the cloud.
| IaaS | PaaS | SaaS | |
|---|---|---|---|
| Physical and hardware | Provider | Provider | Provider |
| Operating system patches | You | Provider | Provider |
| Application code | You | You | Provider |
| Configuration and access control | You | You | You |
| Your data and accounts | You | You | You |
In every model, your data, identities and configuration are your job. Most cloud breaches come from customer mistakes: public storage buckets, over-powerful access keys, open ports and missing multi-factor authentication, not from the provider being hacked.
Starting safely
- Protect the root account with MFA and do not use it day to day.
- Create separate users or roles with least privilege.
- Turn on audit logs.
- Set budgets and alerts.
- Use infrastructure as code so setups are repeatable and reviewable.
- Avoid deep lock-in where it is cheap to avoid, such as using standard containers and databases.
Choosing a model
Start with the highest level that meets your needs: a PaaS or managed database saves a lot of operating work for a small team. Move down to IaaS when you need control, specific software or lower cost at scale.
Takeaway: the cloud rents you resources at different levels of management, regions and zones decide resilience, watch costs from the start, and remember that securing your data, access and configuration is always your responsibility.
Networking & Cloud series, Part 2 (cloud fundamentals): 1 of 5.
