IaaS vs PaaS vs SaaS: Where Each Cloud Provider Fits
IaaS, PaaS, and SaaS define how much of the stack you run versus the provider. See where AWS, Google Cloud, Azure, DigitalOcean, Hetzner, and Google Workspace fit, and how to choose a layer.
IaaS, PaaS, and SaaS describe how much of the stack a provider runs for you and how much you run yourself. The labels are old, but they still predict what you will be billed for, what you are responsible for securing, and what kind of account you need. This guide defines each model, shows where AWS, Google Cloud, Azure, DigitalOcean, and Hetzner fit, and explains how to pick the right layer for a given workload.
The three service models in one table
Think of an application as a stack: physical hardware, virtualisation, operating system, runtime, middleware, application code, and data. Each service model draws the line of responsibility at a different height.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Hardware, network, virtualisation | Provider | Provider | Provider |
| Operating system and patching | You | Provider | Provider |
| Runtime and middleware | You | Provider | Provider |
| Application code | You | You | Provider |
| Data and user access | You | You | You (configuration only) |
| Typical billing unit | Hour or second of compute, GB of storage | Request, instance hour, or vCPU-second | Per user per month |
The lower the line, the more control and the more operational work you take on. The higher the line, the less you can customise but the less you have to maintain.
IaaS: infrastructure as a service
IaaS gives you raw building blocks: virtual machines, block storage, object storage, virtual networks, load balancers, and public IP addresses. You choose the operating system image, install what you need, and are responsible for updates, backups, firewall rules, and scaling.
Every provider in the marketplace offers IaaS, and for several it is the whole product. Amazon EC2, Google Compute Engine, and Azure Virtual Machines are the hyperscaler versions. DigitalOcean Droplets, Hetzner Cloud servers, Linode instances, Vultr Cloud Compute, UpCloud cloud servers, Kamatera cloud servers, OVHcloud VPS and Public Cloud instances, and BinaryLane cloud servers are the developer cloud equivalents. Oracle Cloud calls them compute instances, Alibaba Cloud calls them ECS instances, and IBM Cloud offers virtual servers.
The billing model is time-based. You pay for the instance size (a combination of vCPUs, memory, and disk) for as long as it exists, plus storage and outbound data transfer. This is why vCPU quotas and server-count limits matter so much on IaaS accounts: they cap how much compute you can launch at once.
IaaS is the right layer when you need a specific operating system, kernel features, custom networking, software that is not supported on managed platforms, or the lowest possible cost per unit of compute at steady load. It is the wrong layer when your team has no one to patch servers and respond to incidents.
PaaS: platform as a service
PaaS takes the operating system and runtime off your plate. You hand over code, a container image, or a function, and the platform builds, runs, scales, and patches the environment around it. You still own the application logic, the data model, and access control.
The hyperscalers have several PaaS shapes. AWS offers Elastic Beanstalk for classic web apps, App Runner for containers, and Lambda for functions. Google Cloud offers App Engine, Cloud Run for containers, and Cloud Functions. Azure offers App Service, Container Apps, and Azure Functions. Managed databases are also PaaS: Amazon RDS, Cloud SQL, and Azure Database for PostgreSQL run the database engine and its backups so you only design the schema. DigitalOcean App Platform and Managed Databases bring the same idea to the developer cloud tier.
Managed Kubernetes (EKS, GKE, AKS, DigitalOcean Kubernetes, Linode Kubernetes Engine) sits between IaaS and PaaS. The provider runs the control plane, but you still size the worker nodes, which means node vCPU quotas still apply.
SaaS: software as a service
SaaS is finished software delivered over the internet. You do not deploy anything; you sign in, configure, and use it. Billing is almost always per user (or per seat) per month, sometimes with usage add-ons.
Google Workspace is the clearest example in the marketplace. It bundles Gmail on your own domain, Drive, Docs, Meet, and Calendar behind the Admin console, where an administrator creates users, sets policies, and manages licences. Microsoft 365 is the comparable Microsoft product. Nothing about Workspace requires you to run a server, which is exactly the point: you are paying for outcomes rather than infrastructure.
Many cloud-adjacent tools are SaaS as well: hosted source control, monitoring dashboards, and email delivery consoles. Even Amazon SES, which is an API-driven sending service, behaves more like SaaS than IaaS from the account holder’s point of view. You manage identities, domains, and quotas rather than machines.
The trade-off with SaaS is customisation. You get the features the vendor built, on the vendor’s release schedule, with data stored in the vendor’s chosen regions. For email, documents, and collaboration that is almost always the right trade.
Where each provider fits
Providers are not locked to one model. The hyperscalers sell all three layers and let you mix them in a single account or project. The developer clouds concentrate on IaaS with a growing set of managed services. A short map:
- AWS, Google Cloud, Azure, Oracle Cloud, IBM Cloud, Alibaba Cloud: full IaaS, a broad PaaS catalogue (functions, containers, managed databases, managed Kubernetes), plus SaaS-style services such as email sending, identity, and AI model APIs.
- DigitalOcean, Linode, Vultr: IaaS first, with managed Kubernetes, managed databases, object storage, and in DigitalOcean’s case an app platform.
- Hetzner, OVHcloud, UpCloud, Kamatera, BinaryLane: primarily IaaS: cloud servers, block and object storage, private networking, load balancers, and dedicated hardware where the provider offers it.
- Google Workspace: pure SaaS for email and collaboration.
Choosing the layer for a workload
Start from the highest layer that can do the job and move down only when you hit a real constraint. A marketing site or an internal tool usually belongs on PaaS. A database with unusual tuning needs, a game server, a mail relay, or a GPU training job usually needs IaaS. Email and documents belong on SaaS. Mixed applications commonly run their web tier on PaaS and their stateful pieces on IaaS or managed databases.
The account you need follows from the layer. IaaS-heavy work needs vCPU and server-count headroom. PaaS-heavy work needs the relevant service enabled and, on trial accounts, a billing upgrade so that services outside the free tier are unlocked. SaaS needs licences, not compute.
Where to go next
For a provider that spans all three models, the listed vCPU tiers, credit variants, and AI-enabled options are on the Buy AWS Accounts page. For SaaS email and collaboration on your own domain, see the Buy Google Workspace Account page.
Related reading in the Cloud Library:
- What is a cloud account? Organizations, projects, billing, and access
- What is a vCPU? Understanding cloud compute sizing
- Serverless functions compared: Lambda, Cloud Functions, and Azure Functions
- Hosting a SaaS: VPS provider or hyperscaler?
Browse every guide in the Cloud Library, or compare two IaaS-first providers on the Hetzner vs DigitalOcean page.