What are the 4 types of cloud services? IaaS, PaaS, SaaS and serverless

The four types of cloud services are infrastructure as a service (IaaS), platform as a service (PaaS), software as a service (SaaS) and serverless computing, also called function as a service (FaaS). They differ in how much of the stack the provider runs for you: the higher the layer, the less you manage and the less you can customise.

Key takeaways

• NIST SP 800-145 defines three service models (IaaS, PaaS, SaaS). Serverless is commonly added as a fourth because it is billed and operated differently.
• IaaS gives you virtual machines and networks; PaaS gives you a managed runtime or database; SaaS gives you a finished application; serverless runs your code per event.
• Whatever the type, you always own your data, identities, access rules and configuration.
• Most real systems mix types, for example virtual machines on IaaS with a managed database on PaaS.
• Other "as a service" labels, such as CaaS, DBaaS and DRaaS, are subsets of these four, named by what they deliver.

What are the 4 types of cloud services?

The NIST definition of cloud computing (SP 800-145, September 2011) sets out three service models. Serverless arrived later and is now offered by every major provider, so most guides count four.

Infrastructure as a service (IaaS)

IaaS rents you the basic building blocks: virtual machines, block and object storage, and virtual networks. NIST describes it as the ability to "provision processing, storage, networks, and other fundamental computing resources" and run "arbitrary software, which can include operating systems and applications".

You choose the operating system, patch it, install your software and manage the firewall rules. The provider handles the physical servers and data centre.

• Good for: lift-and-shift migrations, legacy applications that need a specific OS, and workloads that need full control.
• Watch out for: you keep most of the operational work, including patching, backups and scaling rules.

Platform as a service (PaaS)

PaaS removes the operating system from your to-do list. You deploy code or a database schema; the provider runs the servers, runtime and middleware. In NIST's words, the consumer "does not manage or control the underlying cloud infrastructure" but controls the deployed applications.

• Good for: web applications, APIs and managed databases where you want less maintenance and faster releases.
• Watch out for: runtime and version limits, and provider-specific features that make a later move harder.

Software as a service (SaaS)

SaaS is a finished application you use through a browser or app. You configure it, add users and own the data, but you do not touch the code or the infrastructure. Email, CRM, HR and accounting systems are typical examples.

• Good for: standard business processes where a configurable product beats building your own.
• Watch out for: limited customisation, data export terms, and per-user pricing that grows with headcount.

Serverless computing (function as a service)

With serverless, you upload a function and define what triggers it, such as an HTTP request, a file upload or a queue message. The provider starts it, scales it and stops it. You pay only while it runs. AWS Lambda, for example, is priced on the number of requests and the duration your code runs, with a monthly free tier of one million requests.

Not every provider files serverless separately. Microsoft's own documentation, for example, lists Azure Functions under PaaS. That is why some sources talk about "three types" and others about "four".

• Good for: event-driven tasks, APIs with spiky traffic, scheduled jobs and glue code between services.
• Watch out for: execution time limits, cold starts, and costs that can exceed a small always-on server when traffic is constant and high.

How do the four types compare on control, speed and cost?

Each step up the stack trades control for speed. The table shows the typical pattern; individual services vary.

In practice, teams rarely pick one type. A typical web product runs its front end on a PaaS service, its background jobs as serverless functions, a legacy component on IaaS, and uses SaaS for email, CRM and ticketing. The question is not "which type?" but "which type for each component?".

Who is responsible for what?

Security and operations duties shift with each type. Microsoft's shared responsibility guidance sums it up: "For all cloud deployment types, you own your data and identities."

The table follows Microsoft's responsibility matrix; AWS and Google Cloud use the same principle. Serverless sits close to PaaS: the provider runs the OS and runtime, and you own the code, permissions and data.

What other "as a service" types are there?

Providers market many more labels. These as a service types are narrower slices of the four main ones, named after what they deliver. AWS gives a short overview of the main models on its types of cloud computing page.

How do you choose the right type?

Pick the highest layer that still meets your needs. Every layer you hand over is work you no longer do, but also control you give up.

1. Is there a SaaS product that fits? For email, CRM or payroll, buy rather than build.
2. Is the application yours to change? If yes, try PaaS or serverless first. You will spend less time on patching and scaling.
3. Does it need a specific OS, kernel or licence? Then IaaS is usually the realistic choice, at least for the first phase of a migration.
4. Is the traffic spiky or event-driven? Serverless fits well. For constant, high load, compare it with containers or VMs on price.
5. Who will run it at night? IaaS needs the most operational effort. If you do not have that team, plan for a managed cloud service or choose a higher layer.

Service types are separate from deployment models. You can run IaaS in a public, private or hybrid cloud. Our guide to cloud deployment models explains that side, and the IaaS vs PaaS comparison goes deeper on the two most common choices.

Example: mixing IaaS and PaaS in one platform

WorkBuster runs a SaaS recruitment platform used around the world. When it moved to AWS with Opsio, its data sat in a MySQL instance on a VMware hypervisor, and near-zero downtime was critical. The new design combines types. EC2 instances (IaaS) run behind an Application Load Balancer and an auto-scaling group, backed by a multi-AZ Amazon RDS for MySQL database (a managed, PaaS-style service). The whole setup is defined in AWS CloudFormation templates. Read the WorkBuster case study.

How Opsio helps

Opsio helps teams decide which parts of an application belong on IaaS, PaaS or serverless, then migrates and operates them. See our serverless services and AWS migration service.

Frequently asked questions

Are there 3 or 4 types of cloud services?

Both answers are common. NIST SP 800-145 defines three service models: IaaS, PaaS and SaaS. Many providers and guides add serverless as a fourth, while Microsoft files Azure Functions under PaaS.

What is the difference between IaaS, PaaS and SaaS?

IaaS gives you virtual infrastructure and you manage everything from the operating system up. PaaS also manages the OS and runtime, so you deploy only code and data. SaaS is a complete application you configure and use.

Is AWS IaaS, PaaS or SaaS?

AWS offers all of them. Amazon EC2 is IaaS, Amazon RDS and Elastic Beanstalk are PaaS, AWS Lambda is serverless, and AWS also sells some SaaS-style applications. The same is true for Azure and Google Cloud.

Which type of cloud service is cheapest?

No type is cheapest in every case. Serverless is often cheapest for low or spiky traffic, IaaS with commitment discounts for steady high load, and SaaS when it replaces software you would otherwise build and run. Include your team's operating time in the comparison.