IaaS (Infrastructure as a Service) is a cloud service model in which a provider delivers virtualized compute, storage and networking on demand over the internet, billed by usage, while the customer controls and manages the operating system, middleware, applications and data. Among the cloud fundamentals, it is the lowest-level service model of the three classic ones, below PaaS and SaaS, and the closest to running one’s own servers without owning the hardware.
The widely used NIST definition of cloud computing describes IaaS as the capability to provision processing, storage, networks and other fundamental computing resources on which the consumer can run arbitrary software. The consumer does not manage the underlying physical infrastructure, but has control over operating systems, storage and deployed applications, and possibly limited control over networking components such as host firewalls.
How IaaS works
An IaaS provider runs large pools of physical servers, disks and network equipment in its data centers and partitions them with a hypervisor into virtual machines, virtual disks and software-defined networks. Customers request these resources through a web console, a command-line tool or an API, and the platform allocates them within seconds to minutes.
Because every resource is exposed through an API, infrastructure can be described as code with tools such as Terraform or provider-native templates. This infrastructure as code approach makes environments reproducible and enables automatic scaling, where instances are added or removed according to load.
| Resource | Typical form | Key parameters |
|---|---|---|
| Compute | Virtual machines or bare-metal instances | vCPU count, memory, CPU generation, GPU |
| Block storage | Virtual disks attached to an instance | Capacity, IOPS, throughput, latency |
| Object storage | Buckets of files accessed over HTTP | Storage class, durability, retrieval cost |
| Networking | Virtual networks, subnets, load balancers, public IP addresses | Bandwidth, routing, firewall rules |
| Identity and access | Users, roles and policies for the account | Permissions, multi-factor authentication |
IaaS compared with PaaS and SaaS
The three service models differ in where the provider’s responsibility ends and the customer’s begins. IaaS gives the most control and the most operational work; SaaS gives the least of both.
| Layer | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical data center and hardware | Provider | Provider | Provider |
| Virtualization | Provider | Provider | Provider |
| Operating system and patching | Customer | Provider | Provider |
| Runtime and middleware | Customer | Provider | Provider |
| Application code | Customer | Customer | Provider |
| Data and access control | Customer | Customer | Customer |
This division is known as the shared responsibility model. A frequent misunderstanding is that moving to IaaS transfers security to the provider; in fact, operating system patches, firewall rules, encryption settings and account permissions remain entirely the customer’s job.
Pricing models and cost behavior
IaaS replaces up-front hardware purchases with operating expenses billed per second, hour or gigabyte. That flexibility is valuable for variable workloads, but steady workloads running around the clock can cost more than owned hardware unless they use committed-use discounts.
| Option | How it works | Best fit |
|---|---|---|
| On-demand | Pay the list price with no commitment | Unpredictable or short-lived workloads |
| Reserved or committed use | Discount in exchange for a one- or three-year commitment | Steady baseline capacity |
| Spot or preemptible | Deep discount on spare capacity that can be reclaimed at short notice | Fault-tolerant batch jobs, rendering, CI runners |
| Dedicated hosts | Physical server reserved for one customer | Licensing or isolation requirements |
Hidden costs often surprise new users. Data egress (traffic leaving the provider’s network), provisioned IOPS, snapshots, idle public IP addresses and forgotten test instances can together exceed the compute bill. Tagging resources and reviewing usage monthly is basic cost governance.
When IaaS is the right choice
IaaS suits workloads that need operating-system-level control but benefit from elastic, rented capacity. It is the usual target of a lift-and-shift migration, in which existing servers are moved to the cloud with minimal changes.
- Legacy applications that require a specific operating system, kernel module or installed agent.
- Custom software stacks such as self-managed databases, mail servers or specialized middleware.
- Variable or temporary capacity for testing, seasonal peaks, data processing or disaster recovery sites.
- Hybrid cloud and multi-cloud setups where workloads must run consistently across environments.
When an application can run on a managed runtime or database, PaaS usually lowers operational effort, because the provider handles patching, scaling and backups of the platform layer.
Limitations and common mistakes
- Treating virtual machines as pets: hand-configured servers without automation are hard to rebuild after failure.
- Ignoring availability zones: a single instance in one zone has no protection against a zone outage.
- Overprovisioning: instances sized for an imagined peak waste budget every hour they run.
- Open management ports: SSH or RDP exposed to the internet is a constant target for brute-force attacks.
- Vendor lock-in through proprietary services: networking, identity and monitoring APIs differ between providers, which complicates later moves.
Performance can also vary, because virtual machines share physical hosts. Noisy neighbors, burstable instance credits and network limits per instance size should be understood before a production rollout.
Understanding it simply
IaaS means renting computers, disks and networks from a cloud provider instead of buying them. You get virtual servers within minutes and pay only for the time you use them.
It is like leasing an empty, fully wired office. The landlord maintains the building, power and security at the door, but you furnish it, run it and lock your own cabinets. In IaaS, the provider runs the hardware, and you install and maintain everything on your servers.
Applied in practice
A regional logistics company must replace aging on-premises servers that host its route-planning application. Instead of buying new hardware, it moves the application to IaaS: three virtual machines with 4 vCPUs and 16 GB of memory each, spread across two availability zones behind a managed load balancer, plus a self-managed database on a separate instance with daily snapshots.
At a hypothetical on-demand price of $0.20 per hour, each application instance costs about $146 for a 730-hour month, or $438 for all three. After observing three months of stable load, the company buys a one-year commitment for that baseline and adds instances automatically only during the holiday peak, cutting infrastructure lead time from weeks to minutes while keeping full control over the operating system.