Cloud Computing

Week of 2026-10-20 · Download .docx

Objectives

Differentiate IaaS, PaaS, SaaS, and FaaS cloud models by responsibility level and give real-world examples of each.
Explain SaaS benefits — automatic updates, collaboration — and describe the shared responsibility model for SaaS security.
Compare public, private, hybrid, and multi-cloud deployment models and explain cloud elasticity and auto-scaling.
Apply the shared responsibility model to cloud security and identify common misconfigurations that cause cloud breaches.

Key terms

IaaS: Infrastructure as a Service — cloud model providing virtual machines with full admin access; customer manages OS, runtime, and applications. Examples: AWS EC2, Azure VMs.
PaaS: Platform as a Service — cloud model where customer deploys application code; provider manages OS, runtime, and infrastructure. Examples: Heroku, Google App Engine.
SaaS: Software as a Service — fully managed application delivered via browser; customer manages only data and user accounts. Examples: Microsoft 365, Salesforce, Gmail.
FaaS: Function as a Service — serverless model where individual event-triggered functions are deployed; provider manages all server infrastructure. Examples: AWS Lambda, Azure Functions.
Elasticity: Cloud's ability to automatically scale resources up or down based on demand — eliminating the need to over-provision for peak loads.
Hybrid Cloud: Architecture connecting on-premises private infrastructure to a public cloud provider, allowing sensitive workloads on-premises and elastic workloads in the cloud.
Multi-Cloud: Strategy distributing workloads across multiple public cloud providers (AWS + Azure + GCP) to avoid vendor lock-in and leverage best-of-breed services.
Shared Responsibility: Cloud security framework dividing duties: provider secures the cloud infrastructure; customer secures their data, IAM, and (in IaaS) their OS and applications.
CSPM: Cloud Security Posture Management — tools continuously scanning cloud configurations for misconfigurations such as public storage buckets and overly permissive IAM policies.
IaC: Infrastructure as Code — using code (Terraform, CloudFormation) to define and provision cloud infrastructure in a repeatable, version-controlled manner.
Auto-Scaling: Cloud service that automatically adjusts compute capacity based on real-time demand metrics, provisioning instances when load rises and removing them when it falls.
CDN Edge Server: Geographically distributed server in a content delivery network that caches static content close to users, reducing latency by minimizing physical distance.

The concept

Cloud computing has fundamentally changed how IT resources are provisioned, managed, and consumed. Rather than purchasing and maintaining physical hardware, organizations rent computing resources on-demand from global cloud providers.

**The Cloud Service Models**

The cloud service model spectrum describes how much management responsibility falls to the customer vs. the cloud provider. IaaS (Infrastructure as a Service) gives the customer virtual machines with root/admin access — the customer installs and manages the OS, runtime, middleware, and applications. The provider manages physical hardware, networking, and the hypervisor. AWS EC2 and Azure Virtual Machines are IaaS.

PaaS (Platform as a Service) abstracts away the OS and runtime — the customer deploys only application code and manages only that code and its data. Heroku, Google App Engine, and AWS Elastic Beanstalk are PaaS. Moving from IaaS to PaaS reduces operational burden but also reduces control.

SaaS (Software as a Service) provides a complete, vendor-managed application accessed through a browser. The customer manages only their data and user accounts — not the application, runtime, OS, or hardware. Microsoft 365, Salesforce, Slack, and Zoom are SaaS. FaaS (Function as a Service) is serverless computing — developers write individual event-triggered functions with no server management whatsoever.

**Cloud Deployment Models**

Public cloud provides shared infrastructure managed by a provider (AWS, Azure, GCP). Private cloud is dedicated infrastructure — owned or leased — for a single organization. Hybrid cloud connects on-premises private infrastructure to a public cloud, giving organizations direct control over sensitive data while using the public cloud for elastic workloads. Multi-cloud uses services from multiple providers to avoid vendor lock-in and leverage specialized capabilities.

**Elasticity and Key Cloud Capabilities**

Cloud elasticity automatically scales compute, storage, and networking up during demand spikes and down during quiet periods — eliminating the traditional IT practice of over-provisioning for peak load. IaC (Infrastructure as Code) tools like Terraform and AWS CloudFormation define infrastructure in code files, enabling repeatable, version-controlled deployments and eliminating manual ClickOps provisioning.

**Cloud Security and Shared Responsibility**

Cloud security operates under the shared responsibility model. The provider secures the physical data centers, hardware, virtualization layer, and managed services. The customer is responsible for everything they deploy on top: data classification and encryption, identity and access management (IAM) configuration, network security groups, and (in IaaS) OS patching. The most common cause of cloud data breaches is not sophisticated hacking — it is misconfiguration: public S3 buckets, overly permissive IAM roles, and databases with no authentication. CSPM (Cloud Security Posture Management) tools continuously scan cloud configurations for these issues.

Worked examples

Example 1: Choosing a cloud model: A startup is building a new web application. They have limited IT staff but need to scale rapidly. IaaS option (EC2): they manage Linux servers, install Node.js, configure nginx — requires sysadmin expertise. PaaS option (Heroku): they push code; Heroku handles the runtime, scaling, and SSL — far less operational overhead. SaaS option: not applicable (they are building the app, not using someone else's). Recommendation: PaaS lets the startup focus on their application code rather than server management. If they later need custom OS-level configuration unavailable on PaaS, they can migrate to IaaS.

Example 2: Applying the shared responsibility model: A company stores HR records in an AWS S3 bucket. Breach occurs — the bucket was publicly accessible. Was this AWS's fault or the customer's? Under the shared responsibility model: AWS is responsible for the security OF the cloud (physical infrastructure, hardware, S3 service availability). The customer is responsible for security IN the cloud (S3 bucket access policies, whether the bucket is public or private). The misconfiguration making the bucket public is entirely the customer's responsibility. CSPM tools would have flagged the public bucket configuration before the breach.

Common mistakes

Confusing PaaS and SaaS. PaaS is for developers who deploy their own applications — the customer wrote the code. SaaS is for end users who consume a vendor's application — the vendor wrote the code.
Thinking multi-cloud is the same as hybrid cloud. Multi-cloud uses multiple public cloud providers. Hybrid cloud combines public cloud with on-premises private infrastructure. An organization can be multi-cloud, hybrid, or both simultaneously.
Believing 'the cloud is always more secure than on-premises.' Cloud providers invest heavily in physical and infrastructure security that small organizations cannot match. However, customers are responsible for their configuration choices — a public S3 bucket is a customer misconfiguration, not a provider failure.
Thinking elasticity means unlimited resources. Cloud providers have physical resource limits. Elasticity means you can provision resources on-demand within those limits — you still encounter capacity constraints and cost implications when scaling massively.
Underestimating IAM misconfiguration as a risk. Overly permissive IAM policies — giving users or service accounts more permissions than needed — are a leading cause of cloud breaches. Applying least privilege to every cloud IAM policy is as important as any technical security control.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. Which cloud model gives the customer the most control over the operating system?

SaaS
FaaS
PaaS
IaaS

2. Under the SaaS shared responsibility model, what is the customer responsible for?

OS patching
Application code security
User access management and their own data
Physical server security

3. Cloud elasticity means:

Unlimited free storage
Resources scale automatically with demand
Fixed monthly pricing regardless of usage
Physical servers that bend without breaking

4. What is the most common cause of cloud data breaches?

Nation-state hacking
Provider hardware failures
Cloud misconfiguration (e.g., public S3 buckets)
Natural disasters

5. A hybrid cloud architecture combines:

Two different public cloud providers
On-premises infrastructure and a public cloud provider
SaaS and PaaS applications from the same vendor
Private cloud for all workloads

Self-check answers

1. D — IaaS provides virtual machines with full admin access — the customer installs and manages the OS, giving them maximum control.
2. C — In SaaS, the vendor manages everything from hardware through application. The customer is responsible only for IAM and their own data.
3. B — Elasticity automatically provisions additional resources when demand rises and removes them when demand drops.
4. C — Misconfigured cloud resources — public buckets, overly permissive IAM roles — are the leading cause of cloud breaches according to Gartner.
5. B — Hybrid cloud connects on-premises (private) infrastructure to a public cloud provider, allowing sensitive workloads to stay on-premises.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top