1.1.1. Service Models: IaaS, PaaS, and SaaS
💡 First Principle: The three cloud service models — IaaS, PaaS, and SaaS — aren't different products, they're different altitudes of the same stack. The higher the altitude, the less you manage and the less you control.
Infrastructure as a Service (IaaS) rents you the lowest layer: virtual machines, block storage, and networking, with the operating system and everything above it left entirely to you. Compute Engine is Google's IaaS offering — you choose the machine type, install the OS image, patch it, and configure the firewall rules around it, exactly as you would with a physical server, minus the physical server.
Platform as a Service (PaaS) moves up a layer: Google manages the operating system, runtime, and scaling, and you're responsible only for your application code and its configuration. App Engine, Cloud Run, and Cloud Run functions all live here — you push code (or a container) and Google handles provisioning, patching, and scaling the infrastructure underneath it.
Software as a Service (SaaS) is the top of the stack: a complete, ready-to-use application where you don't manage infrastructure or code, only your own data and user configuration. Google Workspace (Gmail, Docs, Sheets) is Google's flagship SaaS offering.
| Model | You Manage | Google Manages | GCP Example |
|---|---|---|---|
| IaaS | OS, runtime, app, data, scaling | Physical hardware, hypervisor | Compute Engine |
| PaaS | App code, data | OS, runtime, patching, scaling | App Engine, Cloud Run |
| SaaS | Your data, user settings | Everything else | Google Workspace |
The ACE exam lives mostly at the IaaS/PaaS boundary — a huge share of "which compute option should I choose" questions are really asking you to judge how much operational responsibility a scenario is willing to take on in exchange for control.
⚠️ Exam Trap: Don't assume "more managed" always means "better." A scenario that needs custom kernel modules, specific licensing, or fine-grained network control points toward Compute Engine (IaaS), even though it's more operational work — the exam rewards matching the model to the constraint, not defaulting to the most automated option.
Reflection Question: A team needs to run a legacy application that requires a specific, unsupported OS kernel version. Which service model does that constraint push you toward, and why does it rule out the higher layers?
