2.3.1. Cloud Service and Deployment Models
Service Models define who manages what:
| Model | You Manage | Provider Manages | When to Choose |
|---|---|---|---|
| IaaS | OS, Apps, Data | Hardware, virtualization, network | Need OS control, custom software |
| PaaS | Apps, Data | OS, runtime, hardware | Focus on code, not infrastructure |
| SaaS | Data (sometimes) | Everything | Use pre-built applications |
Beyond the big three: FaaS/serverless (e.g., AWS Lambda, Azure Functions) goes a step past PaaS—you supply only functions, and the provider manages the OS, runtime, and scaling. At the other extreme, bare-metal servers and colocation (renting rack space, power, and cooling for your own hardware) leave the operating system entirely to you.
Shared responsibility: Security follows the same split. In every model the provider secures the physical data centers and hardware. In IaaS the customer still secures the OS (including patching), applications, data, and the firewall rules or security groups they configure; moving up to PaaS and then SaaS shifts more of that to the provider.
Deployment Models define who can access:
| Model | Description | Use Case |
|---|---|---|
| Public | Shared infrastructure, multi-tenant | Cost efficiency, scalability, agility |
| Private | Dedicated infrastructure, single tenant | Security, compliance, control |
| Hybrid | Mix of public and private | Flexibility, burst capacity, migration |
| Community | Shared among organizations with common needs | Healthcare consortiums, government |
⚠️ Exam Trap: Private cloud doesn't mean on-premises. A private cloud can be hosted by a provider but dedicated to one organization. The distinguishing factor is single-tenancy—infrastructure dedicated exclusively to one customer.
