Cloud as a Service: IaaS, PaaS and SaaS by example – who is responsible for what and when it pays off

WebDisk Blog · category: Cloud computing · reading time: ~8 minutes

In short:- IaaS, PaaS and SaaS are three variants of the same agreement: the higher the model, the fewer obligations on your side – and the less control over the details.- The cloud operates under a shared responsibility model: the provider is responsible for the infrastructure, but data, permissions and user accounts are always on your side. There is a breakdown in the middle of this article.- The public cloud replaces investment in hardware (CAPEX) with fees for usage (OPEX). That can be a major advantage – but it is not automatic savings. We say honestly when it pays off and when it does not.

"We're moving to the cloud" – this sentence is heard in most companies today, but it often means one thing to the board, another to the finance department and something else again to IT. Provider offerings do not make it easier: IaaS, PaaS, SaaS, pay-as-you-go, shared and dedicated environments… Yet behind every one of these terms lies a specific agreement: who maintains what, who pays for what – and who is responsible when something goes wrong.

This article puts the concepts in order. We explain the three basic cloud service models with examples, present the shared responsibility model in a breakdown, explain how CAPEX differs from OPEX – and say honestly when the public cloud is a good choice and when it is not. At the end we return to the title in its literal sense: at WebDisk, "cloud as a service" also means the ability to run your own cloud under your own brand.

The text is written for both sides of this conversation: it gives decision-makers a framework for negotiating with any provider, and technical readers a map they can forward to the rest of the company.

What does "as a service" mean? You buy the outcome, not the hardware

A hundred years ago large factories had their own power generators. Today they buy electricity from the grid: they pay for consumption, and the power plant is run by someone who does it professionally. The "as a service" model transfers that logic to IT: instead of buying servers, storage arrays and licences, you buy a working service – computing power, a platform for applications or a ready-made program – and you pay for what you actually use.

This is made possible by the provider's large, shared pool of resources, which you use self-service and on demand: you launch a new virtual machine in minutes rather than the weeks needed to purchase and install a physical server; you add and release resources in step with actual demand.

Two terms that will keep coming up here: a public cloud is an environment in which one provider's infrastructure is used by many customers, logically separated from one another; a private cloud is an environment dedicated to a single organisation. Both can operate under the same service model – what differs is who gets to use them.

What is the difference between IaaS, PaaS and SaaS?

The three basic models are easiest to picture as floors: on each successive one the provider takes over more obligations, and you give up part of the control.

IaaS (Infrastructure as a Service). The provider gives you the building blocks: virtual machines, disks, networks and firewalls. What you build on top of them – the operating system, databases, applications – is your decision and your responsibility. This is the lowest floor and at the same time the greatest degree of control: you choose the systems, versions and architecture yourself. An example from our offering: **WebDisk Cloud, a public computing cloud based on the open-source Apache CloudStack software, in which you create virtual machines, VPC networks (isolated private networks) and firewall rules from the panel. A simpler variant of the same model is **WebDisk VM, that is, ready-made VPS servers.

PaaS (Platform as a Service). One floor up: the provider maintains not only the infrastructure but also the platform your code runs on – the runtime environment, the database, orchestration. You deploy the application and manage the data; patching systems and platform availability are the provider's problem. A typical example is a managed Kubernetes cluster (open-source container orchestration software) – in our offering **WebDisk K8s** – or a managed database.

SaaS (Software as a Service). The top floor: a ready application, usually available through a browser. You manage nothing beyond your own data, users and settings. This is how WebDisk Files (secure file storage and sharing for companies), WebDisk Send (fast transfer of large files) and WebDisk Next – Nextcloud maintained by us, an open-source collaboration platform – operate.

A simple rule for choosing: the higher the model, the sooner you start working and the less you need to know – but the less you can change.

Who is responsible for what in the cloud? The shared responsibility model

The most common misunderstanding about the cloud goes like this: "since I pay the provider, they are responsible for everything". They are not – and no honest provider will promise that. The cloud operates under a shared responsibility model: the boundary runs in a different place depending on the service model, but it always exists.

• Building, power, physical hardware – Own server room: You · IaaS: provider · PaaS: provider · SaaS: provider
• Virtualisation and network – Own server room: You · IaaS: provider · PaaS: provider · SaaS: provider
• Operating system and its patching – Own server room: You · IaaS: You · PaaS: provider · SaaS: provider
• Runtime environment, database – Own server room: You · IaaS: You · PaaS: provider · SaaS: provider
• Application and its configuration – Own server room: You · IaaS: You · PaaS: You · SaaS: provider
• Data, backups, permissions – Own server room: You · IaaS: You · PaaS: You · SaaS: You
• User accounts, passwords, MFA – Own server room: You · IaaS: You · PaaS: You · SaaS: You

The last two items matter most. A disk failure in the provider's server room is their problem – a well-designed platform will make sure you never even notice it. But a file deleted by an employee, badly assigned folder permissions or a password compromised because MFA (multi-factor authentication) was not enabled are events on your side of the agreement – in every model, SaaS included. That is why, even with a ready-made application, it is worth taking care of file versioning and a backup of your data – we wrote about this at greater length in the article Cloud backup – the foundation of modern IT security. Knowing this breakdown is not a formality: according to industry analyses – including Gartner forecasts – the vast majority of high-profile "cloud leaks" begin not with a break-in at the provider, but with misconfiguration or compromised credentials on the customer's side.

How does CAPEX differ from OPEX and why does it change decisions?

CAPEX (capital expenditure) is the model of your own server room: a large up-front outlay on hardware that you then depreciate over years – regardless of whether it is used at 20 or at 90 per cent. OPEX (operational expenditure) is the cloud model: no investment at the start, with fees that rise and fall along with actual usage.

The OPEX model has three practical advantages: a low barrier to entry (a new project does not freeze capital in hardware that may turn out to be unnecessary), cost that scales with the business (a server bought "for the peak" before the holidays sits partly idle for the rest of the year – in the cloud you simply give the capacity back) and liquidity: regular fees instead of infrequent large outlays.

Now, in fairness, the other side: OPEX is not automatically cheaper. With a stable, high and predictable load, your own or long-term leased hardware, calculated over a horizon of several years, can work out better than paying for flexibility you do not use. The calculation has to be made for your own load profile – we wrote about what makes up the price of the public cloud and how to calculate it in the article Public cloud at a reasonable price. The second trap is organisational: resources are easy to launch and just as easy to forget about – without a periodic review of usage, the bill grows quietly.

When the public cloud makes sense – and when, honestly, it does not

The public cloud is a strong choice when:

• the load is variable or hard to predict – seasonality, campaigns, projects of unknown scale: you pay for the peak only while it lasts;
• time to start matters – you launch a test, development or new-project environment in minutes, with no procurement process;
• you do not want to tie up capital – a new company or a new line of business can start without investing in a server room;
• you need a secondary location – disaster recovery without permanently maintaining a second server room.

There are also signals that other options are worth considering – your own resources, a private cloud or a mixed model:

• constant, high and predictable load – the flexibility you pay for goes unused;
• unusual hardware or licensing requirements – specialised accelerators or licences tied to a physical processor;
• hard requirements regarding data location and jurisdiction – some of them are solved by choosing a provider with infrastructure in Poland, but certain regulatory regimes require a dedicated environment;
• very low latency to local systems – for example production control, where every millisecond of the round trip to the server room counts.

A separate risk is vendor lock-in: the more deeply you use one platform's unique services, the more expensive the move becomes. It is limited by widely supported interfaces – such as the S3 protocol, the de facto standard for object storage – and by open-source software in the virtualisation layer. We described how to assess this risk before signing a contract in the article Vendor lock – dependency on a public cloud provider. In practice many companies end up with a hybrid model: a stable base on fixed resources, variable peaks and new projects in the public cloud. This is not indecisiveness – it is often the cheapest sensible compromise.

Cloud as a service, literally: your own cloud under your own brand

At WebDisk the title phrase also has a second, literal meaning. Our public computing cloud WebDisk Cloud is available not only to end users, but also in the Cloud as a Service model: as your own computing cloud, running under your domain and with your visual identity, managed through the cloud portal we provide.

Such an environment can take the form of a private cloud – available exclusively to your organisation or your customers, with no option to register from outside – or a public cloud, open to anyone who registers through a publicly available portal. The choice is yours. This is a scenario for companies that want to provide cloud services or make them available to their customers under their own brand, but do not want to build and maintain a server room – in other words, the "as a service" mechanism shifted one level up: infrastructure as a service for a service provider.

The resource layer is flexible here: from a pool of virtual resources (processors, memory, disk space) that can be changed as the business grows, to solutions tailored to larger requirements. The scope, the billing model, the deployment and technical support are all agreed individually, depending on scale. Whichever variant you choose, the environment uses the platform's shared services – among them object storage compatible with the S3 protocol and internet connectivity.

Frequently asked questions

What in practice is the difference between a public and a private cloud?

Who gets to use it, not the technology. A private cloud gives greater isolation and control, usually at a higher unit price; a public one gives flexibility and a low barrier to entry.

Is my data safe in the public cloud?

Customer separation, encryption and platform safeguards are the provider's responsibility – it is worth asking them for specifics, not generalities. Part of the responsibility, however, always remains on your side: permissions, passwords, MFA, backups of your data. We wrote about how we secure the WebDisk platform in the article on the open source security stack at WebDisk.

Who is responsible for data and backups in the cloud – me or the provider?

You – in every model, SaaS included. The provider is responsible for the infrastructure and platform availability, but data, backups, permissions and user accounts always remain on the customer's side. That is why, even with a ready-made application, it is worth taking care of file versioning and a backup of your data.

Is the cloud always cheaper than your own servers?

No – and treat anyone who claims otherwise with suspicion. The cloud wins with variable load, a short horizon and no capital to start; your own or long-term leased hardware can be cheaper with constant, high utilisation.

Where to start: IaaS, PaaS or SaaS?

With the question of what your team wants – and is able – to manage. A ready-made application – SaaS. Your own code without administering systems – PaaS. Full control over the environment or moving existing machines – IaaS.

Can I offer cloud services under my own brand without my own server room?

That is exactly the scenario covered by the Cloud as a Service model described above: your own cloud portal under your domain, with your visual identity, on infrastructure maintained by us. The scope and deployment schedule are agreed individually – let's talk about the details.

Summary

IaaS, PaaS and SaaS are not marketing fluff but three different agreements on the division of duties – and the shared responsibility breakdown says more about everyday costs and security than many a sales presentation. The public cloud is an excellent tool where flexibility and time to start matter, and it does not have to be the cheapest where the load is constant and predictable – an honest provider will tell you that outright.

Want to see the IaaS model in practice? Get to know WebDisk Cloud and create an account in the panel. And if you are considering your own cloud under your own brand – write to us, we will discuss the details.