What's changed: Created Cloud Digital Leader Chapter 1 (Domain 1 "Digital transformation": why cloud transforms business = DX/on-prem vs cloud/CapEx-OpEx/TCO/value of cloud; service models and shared responsibility = IaaS/PaaS/SaaS/shared responsibility model/deployment models). GCP is Instiq’s first new vendor.
1.2Cloud service models and shared responsibility
Understand the three cloud service models (IaaS, PaaS, SaaS) and when to use each, the shared responsibility model that splits duties between the cloud provider and the customer, and deployment models: public, private, hybrid, and multicloud.
Cloud services fall into three main models based on how much the provider manages versus the customer. Management effort and control are a trade-off; you choose based on the use case.
1.2.1IaaS, PaaS, SaaS
| Model | Customer manages | Google Cloud example |
|---|---|---|
| IaaS (infrastructure) | OS, app, data (rent VMs) | Compute Engine |
| PaaS (platform) | App and data only (runtime managed) | App Engine / Cloud Run |
| SaaS (software) | Use and configure only (finished product) | Google Workspace |
IaaS rents infrastructure like virtual machines (Compute Engine), where you manage from the OS up (most control). PaaS like App Engine or Cloud Run lets the provider run the platform so you focus on app development. SaaS like Google Workspace is finished software you just use, with almost no operations. Going down, management gets easier and control decreases.
1.2.2The shared responsibility model
Cloud security follows the shared responsibility model, splitting duties between Google and the customer. Google is responsible for security "of" the cloud (data centers, hardware, infrastructure), while the customer is responsible for security "in" the cloud (their data, access, and configuration). Crucially, the boundary shifts with the service model: in IaaS the customer’s scope is larger (e.g., OS patching), while in SaaS Google’s scope is larger. However, data and access management (who is allowed to do what) is always the customer’s responsibility.
1.2.3Deployment models
- Public cloud: use a provider’s shared platform like Google (most common; agile, pay-as-you-go).
- Private cloud: a dedicated environment (used for regulatory or legacy reasons).
- Hybrid cloud: combine on-premises/private with public and integrate them.
- Multicloud: use multiple public clouds (e.g., Google Cloud plus another).
Common: requirement → model. E.g., "manage the OS yourself / move existing VMs" = IaaS (Compute Engine); "let the platform be managed, focus on dev" = PaaS (App Engine/Cloud Run); "use finished software immediately" = SaaS (Workspace); "use with on-premises" = hybrid; "use multiple clouds" = multicloud; "who owns protecting data and access?" = always the customer.
Watch the mix-ups: (1) management effort is IaaS > PaaS > SaaS (lower = easier, less control). (2) The responsibility boundary shifts with the model, but data and access management is always the customer’s. (3) Hybrid (on-prem + public) vs multicloud (multiple public) are different.
1.2.4Section summary
- IaaS (Compute Engine) / PaaS (App Engine, Cloud Run) / SaaS (Workspace) = trade-off of effort vs control
- Shared responsibility: Google = "of" the cloud, customer = "in" the cloud; boundary shifts by model; data/access always the customer
- Deployment models = public / private / hybrid / multicloud
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which service model rents VMs and lets you manage from the OS up, with the most control?
Q2. Which model lets the provider manage the runtime so developers focus on building apps?
Q3. Which model means using finished software with configuration only and almost no operations?
Q4. In the shared responsibility model, what is always the customer’s responsibility regardless of service model?
Q5. Which deployment model combines on-premises with public cloud and integrates them?
Q6. Which service model requires the least management effort (the provider manages the most)?