Cloud Computing Fundamentals
Infrastructure as a Service (IaaS)
The service model that hands you raw compute, storage, and networking and leaves the operating system, runtime, and application on your side of the line, with AWS EC2, Azure Virtual Machines, and Google Compute Engine as the products that deliver it.
- Define Infrastructure as a Service (IaaS) using the NIST framework
- Identify which layers of the stack IaaS leaves for the customer versus the provider
- Name IaaS products from major providers and what each one delivers
- Explain why virtualized infrastructure still leaves real operational work on the customer
The layer a hypervisor hands you
You already know a hypervisor can slice one physical server into dozens of isolated virtual machines, and that a real cloud service lets you request one of those machines yourself, on demand, with no ticket and no wait. What you have not seen yet is what a provider actually sells you once that machine exists, and how much of the stack above it lands in your lap instead of theirs. Infrastructure as a Service is the model that hands you the most: raw compute, storage, and networking, with the operating system and everything above it left for you to install, configure, and patch.
The NIST definition, in practice
NIST's definition of IaaS is precise about the split: the consumer can "provision processing, storage, networks, and other fundamental computing resources" and "deploy and run arbitrary software, which can include operating systems and applications." The consumer does not manage the underlying cloud infrastructure, but has control over operating systems, storage, and deployed applications, and possibly limited control of select networking components, such as host firewalls.
That last clause matters. You do not touch the physical switch or the hypervisor, but you do configure the firewall rules that decide which traffic reaches your own virtual machine. IaaS gives you a box, full control of everything inside it, and a narrow window into the network path that reaches it.
Who manages what
| Layer | Who manages it in IaaS |
|---|---|
| Networking (physical) | Provider |
| Servers and storage hardware | Provider |
| Virtualization (the hypervisor) | Provider |
| Operating system | You |
| Runtime and middleware | You |
| Application code | You |
| Data | You |
| Host firewall rules | You (limited networking control) |
Compare that to the 5 characteristics from the previous topic: resource pooling and rapid elasticity are what let the provider hand you that virtual machine in seconds. IaaS is where those characteristics get packaged into an actual product you can buy.
Real products that deliver IaaS
- Virtual machines: AWS EC2 (Elastic Compute Cloud), Azure Virtual Machines, Google Compute Engine
- Block and object storage: AWS EBS and S3, Azure Managed Disks and Blob Storage, Google Persistent Disk and Cloud Storage
- Virtual networking: AWS VPC, Azure Virtual Network, Google VPC
Every one of these gives you a resource you provision, configure, and are responsible for keeping patched and running. None of them ships an application. They ship the pieces you build one from.
Worked example: what launching a VM actually commits you to
Launch an EC2 instance and AWS asks 2 questions first: which OS image (an AMI, for example Amazon Linux 2023) and which instance type. Pick a t3.micro, 2 vCPUs and 1 GiB of memory, and AWS's on-demand rate in US East (N. Virginia) is $0.0104 an hour, about $7.59 for a 730-hour month, with storage and data transfer billed separately.
That price buys you a running Linux box and nothing else. Nobody at AWS installs a web server on it, applies its security patches, or configures its firewall. You do all 3, the same way you would on a physical machine, except you never touched a data center, ordered hardware, or waited for a shipment.
The misconception: "it's in the cloud" does not mean "it's someone else's problem"
It is tempting to hear "cloud" and assume the provider now handles security and maintenance for you. IaaS does not work that way. The provider took the procurement, power, cooling, and physical maintenance off your plate, the exact burden the first lesson in this course described. It did not take the operating system off your plate. An unpatched IaaS virtual machine is just as vulnerable as an unpatched physical server sitting in your own building; the vulnerability is still yours to close.
Where this leaves you
IaaS gives you the most control of the 3 service models, and, in exchange, the most responsibility: everything from the operating system up is yours to run. The next lesson covers what happens when a provider takes the operating system and runtime off your plate too, and what you get, and give up, in return.