Cloud Service Models - SaaS PaaS IaaS - Which One is for You?

Last week I was analyzing Google Analytics data of Techno-Pulse and found a few search keywords related to Cloud Service Models. It seems readers are looking for useful information on service models which can help them make decisions.  Though I’ve partially covered this topic in many posts, I’ll cover it here in a way that might help readers better understand and decide which cloud service model they should opt for.

Cloud Service Models simply mean what type of services can be provided to customers. Different models cater to different kinds of requirements, and can achieve different business objectives. A simple search and you may find internet hits with dozens of Cloud * as a Service, where * can be replaced by any one of the following:

Desktop, Security, Data, Software, Platform, Infrastructure, IT, Testing, Hardware, Computing, Database, Storage etc.

All this is a bit confusing. As cloud computing is still evolving, the providers are free to innovate and offer various services, and there are no hard and fast rules governing these service offerings. So, let me simplify and put forward the most accepted type of Service Models, as defined by NIST (National institute of Standards and Technology, U.S. Department of Commerce)

NIST identifies 3 Cloud Service Models in its Special Publication 800-146. This document has been prepared for use by Federal agencies. It may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright. For attributions check Reference Section of this article.

SPI Service Models

• SaaS (Software as a Service)
• PaaS (Platform as a Service)
• IaaS (Infrastructure as a Service)

NIST further defines these services in detail, the summary of which is provided below, with my own interpretation.

SaaS

Here the consumer is free of any worries and hassles related to the service. The Service Provider has very high administrative control on the application and is responsible for update, deployment, maintenance and security. The provider exercises final authority over the application. For example, Gmail is a SaaS where Google is the provider and we are consumers. We have very limited administrative and user level control over it, although there is a limited range of actions, such as enabling priority inbox, signatures, undo send mail, etc, that the consumer can initiate through settings.

The following figure illustrates the relative levels of control between the provider and the subscriber – SaaS Component Stack and Scope of Control  - borrowed from the NIST document.

Who are SaaS Subscribers?

Apart from organizations and enterprises, SaaS subscribers/users can also be individuals like you and me. In most of the cases the usage fee is calculated based on the number of users. For example, Google Apps is free up to 10 email accounts, but it charges $5 per user per month for – Google Apps for Business (more than 10 users)

When/Why should you opt for a SaaS?

When you want to focus on your business rather than wasting your time in replacing broken pieces of hardware, managing IT infrastructure, and the most critical of them all - hiring and retaining your IT staff etc.

Which SaaS should you opt for?

• Best use of SaaS is in productivity and collaboration apps in the cloud like Google Apps, Online Project Management like DeskAway, Zoho Mail, Chat, Docs, Project, Sheet, Writer etc.
• CRM apps – Impel CRM, Salesforce.com, Microsoft Dynamics.
• Cloud based Storage and Sharing services like Dropbox, Skydrive (windows live), Amazon S3, Google Docs, Box.net, Mozy.
• SMEs/SMBs can opt for EazeWork (for HR, PayRoll and Sales)

Read More

• SaaS with examples
• 30+ Google Cloud Services for Personal Use

PaaS

In plain English, PaaS is a platform where software can be developed, tested and deployed, meaning the entire life cycle of a software can be operated on a PaaS. This service model is dedicated to application developers, testers, deployers and administrators. This service provides everything you need to develop a cloud SaaS application.

The following figure shows PaaS Component Stack and Scope of Control as defined by NIST:

A PaaS typically includes the development environment, programming languages, compilers, testing tools and deployment mechanism. In some cases, like Google Apps Engine (GAE), the developers may download development environment and use them locally in the developer’s infrastructure, or the developer may access tools in the provider’s infrastructure through a browser.

Who are PaaS Subscribers?

ISV (Independent Software Vendors), IT Service providers or even individual developers who want to develop SaaS.

When/Why should you opt for a PaaS?

You focus only on developing the application, everything else will be taken care of by the platform.

Which PaaS should you opt for?

• GAE is more popular with individual Java, Python developers.
• Microsoft Windows Azure is targeting its pool of enterprise class users. ASP.Net (C#, VB.Net) developers will find easy to adopt it.
• Amazon has also moved one stack up to offer its PaaS – Beanstalk (one more option for Java developers)
• A few of the India based PaaS providers like OrangeScape and Wolf frameworks are making waves for their 5G visual PaaS. OrangeScape apps can run on all the major cloud platforms - Google App Engine, Microsoft Azure, IBM SmartCloud, Amazon EC2 or data center- without having to rewrite applications.
• Engine Yard and Heroku are leading cloud PaaS for Ruby on Rails (RoR). Heroku (acquired by saleforce.com) is also a preferred PaaS for Facebook apps creation.
• PHP developers can choose between PHP Fog and CloudControl.
• For a multi-language application platform explore DotCloud.
• India based Ozonetel Systems offers KooKoo PaaS for cloud telephony service.

Read More

• Cloud PaaS with Examples

IaaS

Do you require virtual computers, cloud storage, network infrastructure components such as firewalls and configuration services? IaaS is what you should opt for. The System Administrators are the subscriber of this service. Usage fees are calculated per CPU hour, data GB stored per hour, network bandwidth consumed, network infrastructure used per hour, value added services used, e.g., monitoring, auto-scaling etc.

The following figure shows IaaS Component Stack and Scope of Control as defined by NIST:

Who are IaaS Subscribers?

Are you aware of Farmville and Mafia Wars? Yes, these are the most popular Facebook games created by Zynga.com. It has more than 230 million monthly users run more than 12000 servers on Amazon AWS. When they launch a new game, they start with a few servers and then ramp up their capacity in real time.

To prevent the DDOS attack on its servers, the controversial Wikileaks was hosted on Amazon AWS. Now it seems it has moved back to a Swedish host.

Most important among the lot are SaaS and PaaS Players who are hosted with IaaS providers.

India based online ticketing service redBus. For details read the Case study What  IRCTC can learn from redBus cloud implementation.

When/Why should you opt for an IaaS?

Very useful for startup companies who don’t know how successful their newly launched application/website will be.

You have the choice of multiple Operating System, Platforms, Databases and Content Delivery Network (CDN) – all in one place.

Note - Due to economic reasons currently it may not be advisable to host a static website with less than 10,000 visits/month on an IaaS. This may cost you around $18/month on Amazon AWS (Source:  An AWS presentation, Jan 2011)

Which IaaS should you opt for?

Amzon is the pioneer of IaaS. Other leading providers are Rackspace, GoGrid, Joyent, Rightscale and Terremark (bought by Verizon)

For India based IaaS – explore the following providers:

• NetMagic Solutions
• InstaCompute (from Tata Communications)

Read More

• Cloud IaaS with Examples

Are you still thinking which service model is right for you? Feel free to share your query in the comment section.

References

NIST Cloud Computing Synopsis and Recommendations - Special Publication 800-146

---

2026 Update: Cloud Service Models Have Expanded

The three NIST service models above remain the definitive framework for understanding cloud computing. But since this post was first written, the cloud industry has introduced new service categories that sit alongside — and sometimes on top of — SaaS, PaaS, and IaaS. Here is what's new in 2026.

AI-as-a-Service (AIaaS): The Fourth Service Model

Artificial intelligence has become its own cloud service category in 2026. AI-as-a-Service allows businesses to consume pre-trained AI capabilities — text generation, image recognition, speech-to-text, translation, code generation, and more — through simple API calls, without building or hosting any AI infrastructure themselves.

Examples include OpenAI API (GPT-4o, o3), Google Gemini API, AWS Bedrock (access to multiple foundation models), and Azure OpenAI Service. You pay per API call or per token processed. The barrier to adding AI to a product or workflow has dropped to near zero — a developer can integrate a state-of-the-art language model in under an hour.

AIaaS sits across all three original layers: it can be consumed at the SaaS level (an AI writing assistant built on top of GPT-4o), the PaaS level (a custom application using the Gemini API), or the IaaS level (renting GPU instances to run your own models). For most businesses in 2026, AIaaS is the fastest and most cost-effective entry point into AI capabilities.

Function-as-a-Service (FaaS): Serverless Evolves from PaaS

FaaS — delivered by AWS Lambda, Azure Functions, and Google Cloud Functions — extends the PaaS model to its logical conclusion. With traditional PaaS, you still define an application runtime and think about scaling. With FaaS, you upload a single function and the cloud provider handles everything: provisioning, scaling from zero to millions of executions, availability, and billing. You pay only for the milliseconds your code actually runs — there is no idle cost.

FaaS has become the dominant model for event-driven workloads, webhooks, scheduled tasks, and API backends in 2026. For many new applications, the question is no longer "which cloud provider" but "serverless or containerised?"

Containers-as-a-Service (CaaS): Filling the Gap Between IaaS and PaaS

Containers have become the standard unit of software packaging and deployment. CaaS — delivered by Google Kubernetes Engine (GKE), Amazon EKS, and Azure AKS — gives developers full control over containerised applications without managing the underlying virtual machines. You define your containers and how they should run; the cloud provider manages the Kubernetes cluster infrastructure beneath them.

CaaS sits between IaaS (full infrastructure control) and PaaS (managed application platform), offering a middle ground that enterprise engineering teams have widely adopted. Most large-scale web applications and microservices architectures run on CaaS platforms in 2026.

How SaaS Has Evolved: AI Is Now the Core Value

SaaS has undergone a fundamental transformation since 2011. The defining characteristic of SaaS in 2026 is no longer "software delivered over the internet" — it is "AI-enhanced software delivered over the internet." Every major SaaS product now embeds AI assistants, automated workflows, and predictive features as first-class capabilities.

Microsoft 365 Copilot generates documents, summarises emails, and creates presentations. Salesforce Einstein predicts sales outcomes and suggests next actions. HubSpot AI writes marketing copy and scores leads. Notion AI drafts and summarises content. GitHub Copilot writes code. When evaluating SaaS tools today, the quality of the embedded AI matters as much as the core feature set — often more.

How IaaS Has Evolved: Specialised Compute Options

The core IaaS value proposition — virtualised compute, storage, and networking on demand — is unchanged. What has changed is the diversity of hardware available. Beyond standard virtual machines, IaaS providers now offer:

GPU instances for AI training and inference workloads (NVIDIA H100 and A100 clusters available on-demand from all three major providers). Arm-based instances — AWS Graviton4, Azure Cobalt 100, and Google Axion — deliver 30–40% better price-performance than x86 for general workloads. Spot and preemptible instances offer up to 90% cost reduction for fault-tolerant and batch workloads, and have matured to the point where they are used reliably in production pipelines. Bare-metal instances provide dedicated hardware for workloads requiring direct hardware access or strict performance isolation.

Choosing the Right Model in 2026: An Updated Decision Framework

The original guidance from this post still holds: the more control you need over infrastructure, the further down the stack you go (toward IaaS); the less you want to manage, the further up you go (toward SaaS). The 2026 addition to this framework is that AIaaS and FaaS now sit at the extreme "managed" end — they require the least operational knowledge and scale the most automatically.

For businesses starting a new project in 2026, the recommended starting question is: "Can I solve this with an existing SaaS product or an API call before I consider building anything?" If yes, SaaS or AIaaS is almost always the fastest and most cost-effective path. Build on PaaS, CaaS, or IaaS only when you have specific requirements — custom logic, performance constraints, data control — that SaaS cannot meet.