IaaS, PaaS, SaaS on AWS

Cloud service models define the level of abstraction between the cloud provider and the customer. They determine what you manage and what the provider manages. The three primary models are IaaS, PaaS, and SaaS. Each model shifts responsibility from the customer to the provider, affecting cost, control, and flexibility.

IaaS provides virtualized computing resources over the internet. You get access to virtual machines (VMs), storage, and networks, and you manage the operating system, middleware, and applications. AWS IaaS services include Amazon EC2 (virtual servers), Amazon VPC (virtual networks), Amazon EBS (block storage), and Amazon S3 (object storage).

How it works: You launch an EC2 instance by selecting an Amazon Machine Image (AMI) that contains an OS (e.g., Amazon Linux, Windows Server). You choose instance type (CPU, memory), configure security groups (firewall rules), and optionally attach storage volumes. AWS provisions the virtual hardware, but you are responsible for OS patches, application installation, and security. You pay per hour or per second for compute capacity, plus storage and data transfer.

Key characteristics: - You have full control over the OS and applications. - You can scale resources up or down on demand. - You pay only for what you use (pay-as-you-go). - AWS manages the physical infrastructure, hypervisor, and network fabric.

When to use IaaS: - When you need complete control over the environment. - When migrating existing on-premises applications to the cloud (lift-and-shift). - When you require custom OS configurations or legacy software.

PaaS provides a managed platform to develop, run, and manage applications without worrying about the underlying infrastructure. You focus on code and data, while the provider handles OS, runtime, middleware, and scaling. AWS PaaS services include AWS Elastic Beanstalk, AWS Lambda (Functions as a Service, often considered PaaS or Serverless), and Amazon RDS (managed databases).

How it works: With Elastic Beanstalk, you upload your application code (e.g., a Java WAR file or a Python Flask app), and Elastic Beanstalk automatically provisions the necessary EC2 instances, load balancers, auto scaling, and monitoring. You retain control over configuration (e.g., instance type, environment variables) but do not manage the OS. AWS patches the underlying OS and platform components. You pay for the underlying resources (EC2, storage) plus a small management fee (none for Elastic Beanstalk itself).

Key characteristics: - You manage only your application and data. - The provider handles runtime, OS, scaling, and availability. - You can deploy applications quickly without infrastructure expertise. - Often includes built-in development tools (CI/CD pipelines).

When to use PaaS: - When you want to focus on application development rather than operations. - When you need fast deployment and scaling. - When you want to avoid OS patching and middleware management.

SaaS delivers fully functional software applications over the internet. The provider manages everything — infrastructure, platform, and application. You simply use the software via a web browser or API. AWS SaaS offerings include Amazon WorkDocs (document collaboration), Amazon Chime (meetings), and third-party SaaS products available on AWS Marketplace.

How it works: You sign up for a SaaS product (e.g., Salesforce, Slack, or Amazon WorkDocs). The provider hosts the application in their own AWS environment, handles all updates, security patches, and scalability. You pay a subscription fee (per user, per month) or usage-based pricing. You have no control over the underlying infrastructure; you only configure user settings and data permissions.

Key characteristics: - No installation or maintenance required. - Accessible from any device with an internet connection. - Pay-as-you-go subscription model. - Limited customization compared to IaaS/PaaS.

When to use SaaS: - When you need ready-to-use software for common business functions (email, CRM, collaboration). - When you want to minimize IT management overhead. - When you prefer predictable subscription costs.

In an on-premises data center, you manage everything: physical servers, networking, storage, OS, middleware, runtime, data, and applications. With IaaS, you offload physical hardware management but still manage the OS and above. With PaaS, you offload the OS and middleware, managing only data and applications. With SaaS, you offload everything except data and user access. This is often visualized as a stack of responsibility.

The shared responsibility model defines security and compliance obligations. AWS is responsible for the security OF the cloud (physical infrastructure, hypervisor, network). The customer is responsible for security IN the cloud (data, OS, applications, firewall rules). The exact division depends on the service model: - IaaS: Customer manages OS, applications, data, and network controls; AWS manages physical hardware, virtualization, and network connectivity. - PaaS: Customer manages data and application code; AWS manages OS, runtime, middleware, and scaling. - SaaS: Customer manages data and user access; AWS (or SaaS provider) manages everything else.

A startup with a monolithic application running on physical servers in a colocation facility wants to migrate to AWS. They choose IaaS because they need full control over the OS and legacy configurations. They use AWS Server Migration Service to replicate their on-premises servers to EC2 instances. They set up a VPC with public and private subnets, and use Elastic Load Balancing to distribute traffic. They manage OS patches via AWS Systems Manager Patch Manager. Costs: They initially run instances on-demand, then purchase Reserved Instances for a 40% discount. They save on hardware maintenance and can scale during peak traffic. Misconfiguration: They forget to set up proper security groups, leaving SSH open to 0.0.0.0/0, resulting in a brute-force attack. Lesson: Always follow the principle of least privilege.

An e-commerce company develops a microservices-based application. They use AWS Elastic Beanstalk for the frontend and backend services, and Amazon RDS for the database. Developers push code to a Git repository, and a CI/CD pipeline deploys to Elastic Beanstalk. Elastic Beanstalk automatically scales instances based on CPU utilization. They use AWS Lambda for image processing (thumbnails). Costs: They pay for EC2 instances (t3.medium) and RDS (db.t3.small). They benefit from not managing OS updates — Elastic Beanstalk applies them automatically. Misunderstanding: They initially chose a single-instance environment for production, causing downtime during deployments. They switched to load-balanced environments with rolling updates.

A consulting firm with 50 employees uses Amazon WorkDocs for document collaboration. They have no IT staff to manage servers. Employees access files from laptops, tablets, and phones. WorkDocs syncs files and provides version history. Administrators set storage limits and manage user permissions. Costs: $5/user/month = $250/month. No upfront hardware cost. Problem: An employee accidentally shared a confidential folder with the entire company. The admin quickly revoked access and enabled audit logging. Lesson: Even with SaaS, data governance requires proper configuration.