Cloud Computing Explained: IaaS, PaaS and SaaS
Cloud computing means renting computing power, storage and services over the internet instead of owning the hardware that provides them.
In this guide
A cloud provider runs large data centres and sells access to them in small, elastic units. You get a server in minutes instead of a procurement cycle, and you can release it when the traffic drops.
The trade is control for convenience. Someone else owns the hardware, the network and often the platform, and you pay for that with a monthly bill and a set of shared responsibilities.
The three service models
Infrastructure as a service gives you virtual machines, storage and networks. You manage the operating system and everything above it. Platform as a service gives you a runtime and managed services, so you deploy code and let the provider patch the platform. Software as a service gives you a finished product such as email or a CRM.
The model you choose decides how much of the stack you operate. Most real systems mix all three: SaaS for collaboration, PaaS for application hosting, IaaS for workloads that need full control.
- IaaS: maximum control, maximum operational work.
- PaaS: fastest path from code to running service.
- SaaS: no operations, least customisation.
- Serverless: per-request execution with almost no infrastructure to manage.
Public, private and hybrid
Public cloud shares infrastructure across customers with strong logical isolation. Private cloud keeps a dedicated environment, usually for regulatory or latency reasons. Hybrid connects both so sensitive data can stay on premises while elastic workloads run elsewhere.
Multi-cloud spreads risk and avoids lock-in but multiplies operational complexity. It works best when there is a clear reason, such as a specific regional requirement or a service only one provider offers.
How cloud economics actually work
Pricing is metered: compute by the second, storage by the gigabyte-month, and data transfer by the gigabyte. The last one surprises people, because moving data out of a provider is often the most expensive line item and the hardest to negotiate.
Elasticity rewards discipline. Idle resources still bill, oversized instances still bill, and forgotten snapshots still bill. Tagging resources, setting budgets and reviewing spend monthly usually saves more than any architectural rewrite.
Security is shared, not outsourced
Providers secure the physical facilities, hardware and hypervisor. You secure identity, configuration, data and access. Misconfigured storage and stolen credentials cause most cloud incidents, not provider breaches.
Start with strong identity: multi-factor authentication, least-privilege roles and short-lived credentials. Then encrypt data at rest and in transit, log administrative actions, and test backups by actually restoring them.
Key facts at a glance
Frequently asked questions
Is the cloud always cheaper?
No. It is cheaper when demand is variable and you can shut resources down. Steady, high-utilisation workloads are often cheaper on owned or dedicated hardware.
What does vendor lock-in really mean?
It means the cost of leaving rises because your code depends on proprietary services, data formats or identity systems. Managed services are worth it when the lock-in is a deliberate, priced trade-off.
Who is responsible for cloud security?
Both parties. The provider secures the infrastructure; you secure your configuration, identities, applications and data.