# What are the Cloud Service Models: IaaS, PaaS, and SaaS?

> The cloud service models describe how responsibility and control are divided between a cloud provider and customer.

- Canonical URL: https://yellowcube.eu/glossary/cloud-service-models-iaas-paas-and-saas/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Infrastructure as a Service (IaaS) supplies fundamental computing resources; Platform as a Service (PaaS) supplies an environment for deploying customer applications; and Software as a Service (SaaS) supplies provider-run applications that customers access through a client or program interface.

Under the National Institute of Standards and Technology definition, customers retain progressively less control of the underlying infrastructure from IaaS to PaaS to SaaS. Exact service boundaries vary by offering and contract, so security teams must map responsibilities for identities, data, configuration, code, operating systems, networks, monitoring, recovery, and incident handling rather than rely on the label.

### Key points

- **IaaS:** The provider operates physical infrastructure and virtualization, while the customer commonly manages guest systems, applications, identities, data, and much of the virtual-network configuration.
- **PaaS:** The provider also manages the application-hosting platform; the customer controls deployed applications, data, identities, and allowed platform configuration.
- **SaaS:** The provider runs the application and underlying stack; the customer retains responsibilities for users, data, permitted use, available tenant configuration, integrations, endpoints, and contractual requirements.
- **Important limitation:** Moving “up” the service stack does not automatically reduce total risk or transfer accountability. Provider failures, unsafe defaults, excessive customer permissions, insecure integrations, data handling, concentration, and unclear contracts can affect every model.

### Related terms

[Cloud security](<https://yellowcube.eu/glossary/cloud-security/>) · [Cloud-native security](<https://yellowcube.eu/glossary/cloud-native-security/>) · [SaaS security](<https://yellowcube.eu/glossary/saas-security/>) · [Virtualization security](<https://yellowcube.eu/glossary/virtualization-security/>) · [Hybrid cloud security](<https://yellowcube.eu/glossary/hybrid-cloud-security/>)

### Sources

[NIST SP 800-145, The NIST Definition of Cloud Computing](https://csrc.nist.gov/pubs/sp/800/145/final) · [NIST SP 500-292, NIST Cloud Computing Reference Architecture](https://www.nist.gov/publications/nist-cloud-computing-reference-architecture) · [NIST, Evaluation of Cloud Computing Services Based on SP 800-145](https://www.nist.gov/system/files/documents/2017/05/31/evaluation_of_cloud_computing_services_based_on_nist_800-145_20170427clean.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.