Cloud Service Delivery Models: Architectural Breakdown of IaaS, PaaS, and SaaS

Cloud computing has fundamentally altered the economics and architecture of modern enterprise information technology [1]. Rather than purchasing physical server hardware, leasing data center floor space, and provisioning multi-year telecom transit contracts, organizations can instantiate global compute and storage resources on demand via software APIs [1, 2].

However, the term "cloud" encompasses radically different operational and technical tiers [1]. An organization provisioning raw virtual machines in an AWS Virtual Private Cloud operates under completely different security, maintenance, and administrative boundaries than one deploying serverless application code or utilizing a hosted corporate email suite [1, 3]. To provide rigorous definitions, the National Institute of Standards and Technology established NIST SP 800-145: The NIST Definition of Cloud Computing [1]. In this technical guide, we dissect the three standardized service delivery models—Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)—and evaluate the critical Shared Responsibility Model [1, 2, 3].

1. The Five Essential Characteristics of Cloud Computing

Under NIST SP 800-145, a service is classified as true cloud computing only if it delivers five foundational characteristics [1]:

1. On-Demand Self-Service: Consumers can provision compute, storage, and network interfaces unilaterally through an automated console or API without requiring human interaction with the service provider [1].
2. Broad Network Access: Capabilities are accessible over the network through standard protocols across heterogeneous client platforms (workstations, mobile devices, IoT gateways) [1].
3. Resource Pooling: The provider's physical computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned according to demand [1, 3].
4. Rapid Elasticity: Capabilities can be elastically provisioned and released—often automatically—to scale rapidly outward and inward with demand spikes [1].
5. Measured Service: Resource usage is monitored, controlled, and metered transparently for both the provider and consumer (e.g., pay-per-second compute billing or per-gigabyte storage rates) [1].

2. Deconstructing the Three Service Delivery Models

The service models represent progressively higher layers of abstraction away from underlying hardware [1, 2]:

+-------------------------------------------------------------+
|               The Cloud Stack Abstraction Layers            |
+-------------------------------------------------------------+

      [ On-Premises ]        [ IaaS ]          [ PaaS ]          [ SaaS ]
+-------------------------+-------------+------------------+------------------+
| Applications            | Customer    | Customer         | Cloud Provider   |
| Data                    | Customer    | Customer         | Cloud Provider   |
| Runtime & Middleware    | Customer    | Cloud Provider   | Cloud Provider   |
| Operating System (OS)   | Customer    | Cloud Provider   | Cloud Provider   |
| Virtualization Hypervisor| Customer   | Cloud Provider   | Cloud Provider   |
| Physical Servers        | Customer    | Cloud Provider   | Cloud Provider   |
| Storage & Network Cables| Customer    | Cloud Provider   | Cloud Provider   |
| Physical Facility / DC  | Customer    | Cloud Provider   | Cloud Provider   |
+-------------------------+-------------+------------------+------------------+

1. Infrastructure as a Service (IaaS)

The consumer is provisioned raw processing, storage, and network components [1]:

• What the provider manages: Physical facility, redundant power, cooling, physical servers, storage arrays, and the virtualization hypervisor (e.g., KVM, VMware ESXi) [1].
• What the consumer manages: Operating system installation (Linux/Windows), kernel patching, security firewall rules, middleware runtimes, application code, and data backups [1, 2].
• Examples: Amazon EC2, Google Compute Engine, Microsoft Azure Virtual Machines, self-hosted OpenStack clusters.

2. Platform as a Service (PaaS)

The consumer deploys application code directly onto the provider's managed execution environment without managing the underlying operating system [1]:

• What the provider manages: Everything in IaaS plus OS patching, runtime environments (e.g., Node.js, PHP, Python, Java), database clustering, and automatic scaling engines [1, 2].
• What the consumer manages: Application source code, database schema design, and access control configurations [1].
• Examples: AWS Elastic Beanstalk, Heroku, Google App Engine, managed Kubernetes (GKE, EKS).

3. Software as a Service (SaaS)

The consumer accesses a complete, turnkey application hosted entirely on the provider's infrastructure [1]:

• What the provider manages: The entire technology stack from physical silicon up to the application software, UI bug fixes, and continuous automated backups [1, 3].
• What the consumer manages: User account provisioning, role-based access permissions, and corporate data security policies [1, 3].
• Examples: Google Workspace, Microsoft 365, Salesforce, Zendesk.

3. The Shared Responsibility Model: Security and Governance

A catastrophic operational failure occurs when organizations assume that migrating an application to the cloud relieves them of cybersecurity responsibilities [1, 3]:

Under the Shared Responsibility Model, security responsibilities are bifurcated [3]:

• Security OF the Cloud (Provider Responsibility): Physical facility access control, redundant diesel generators, hardware maintenance, hypervisor zero-day patching, and core transit infrastructure [1, 3].
• Security IN the Cloud (Customer Responsibility): Customer data encryption, identity and access management (IAM), firewall security group configurations, operating system patch cycles, and application vulnerability remediation [1, 3].

If an enterprise deploys an unpatched Linux virtual machine with weak SSH passwords and an open firewall port on an IaaS cloud, an external compromise is 100% the customer's operational failure, even if the underlying cloud infrastructure maintains a perfect 99.999% uptime SLA [1, 3].

Service Delivery Models Technical Comparison

Practical Strategic Recommendations

When architecting corporate cloud migrations:

1. Match Workloads to the Appropriate Model: Deploy SaaS for commoditized operational tools (email, CRM); utilize PaaS for internal custom software and web applications; reserve IaaS for specialized network appliances and legacy enterprise databases [1, 2].
2. Audit IAM Permissions (Principle of Least Privilege): Ensure cloud access is governed by role-based access control (RBAC), multi-factor authentication, and temporary short-lived credentials rather than permanent root keys [3].
3. Implement Encryption Across All Tiers: Encrypt data both in transit (TLS 1.3) and at rest (AES-256) across all cloud storage buckets and virtual disks using customer-managed encryption keys [1, 3].

For specialized cloud migration planning, server infrastructure management, and secure web application deployment, explore our services on our Web & Software Development page.

Key Takeaways

• NIST SP 800-145 defines cloud computing via five essential characteristics and three service delivery models.
• IaaS provides raw virtualized compute and storage, requiring customers to manage the OS and middleware.
• PaaS abstracts the operating system, allowing software engineers to focus exclusively on application code and data.
• SaaS delivers turnkey software, placing all infrastructure and maintenance responsibilities on the vendor.
• The Shared Responsibility Model dictates that customers remain strictly responsible for security IN the cloud.

Need help with this? Contact us.

Sources

[1] National Institute of Standards and Technology (NIST), "NIST SP 800-145: The NIST Definition of Cloud Computing", 2011. URL: https://csrc.nist.gov/pubs/sp/800/145/final (The foundational federal standard establishing cloud service delivery models, characteristics, and deployment frameworks).

[2] National Institute of Standards and Technology (NIST), "NIST SP 800-146: Cloud Computing Synopsis and Recommendations", 2012. URL: https://csrc.nist.gov/pubs/sp/800/146/final (Technical guidance on cloud architecture, operational boundaries, and deployment trade-offs).

[3] National Institute of Standards and Technology (NIST), "NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing", 2011. URL: https://csrc.nist.gov/pubs/sp/800/144/final (Federal standard on multi-tenant cloud security, data governance, and shared responsibility frameworks).

Last reviewed: October 2026