Home / Glossary / IaaS (Infrastructure as a Service)
Tech & ITIaaS (Infrastructure as a Service)
By Sitraka Forler · Lecturer, Durham Business SchoolUpdated 3 October 2026 About this site
Rented virtual machines, storage and networks that you configure and run yourself.
The provider owns the data centre, hardware and virtualisation layer; you pick the operating system and install, patch and secure everything above it. Amazon EC2 (Elastic Compute Cloud), Azure Virtual Machines and Google Compute Engine are IaaS. It is the layer with the most control, and the most chores: an unpatched virtual machine is your security hole, and a forgotten one keeps costing money.
The intuition
Infrastructure as a service is renting computers, disks and networks by the hour. The provider owns the data centre, the physical servers and the virtualisation layer that slices them into virtual machines; you pick a machine size and an operating system image, and a few minutes later you have root access to a server that exists nowhere physical you could point to. Amazon EC2, Azure Virtual Machines and Google Compute Engine are the standard examples, and block storage, virtual networks and load balancers come from the same catalogue.
The useful picture is a leased, empty office. The landlord supplies the building, the power and the locks on the outer doors; you bring the furniture, decide who gets a key, and are responsible for whatever happens inside. In cloud terms the provider secures the hardware, the hypervisor and the physical network; you install and patch the operating system, configure the firewall, manage user accounts and encrypt the data. Of the three cloud layers it is the one with the most control and the most chores.
Teams choose IaaS when they need that control: a specific database version, a GPU for model training, software that assumes a full machine, or a lift-and-shift of an existing on-premises system. The costs that surprise newcomers are operational rather than financial. A virtual machine does not patch itself, a security group left open to the world is your incident, and an instance nobody remembers starting keeps billing until someone terminates it. Automation tools such as Terraform and configuration management exist precisely because managing fleets of rented machines by hand does not scale.
Example
# IaaS: rent a bare virtual machine; its operating system is now yours to patch aws ec2 run-instances \ --image-id YOUR_IMAGE_ID \ --instance-type t3.micro \ --count 1 # It bills until you terminate it: aws ec2 terminate-instances --instance-ids YOUR_INSTANCE_ID
Renting a VM for a nightly risk batch, securing it, and finding the one that was never switched off
- A risk team needs a machine with 32 GB of memory to run a nightly scenario job that is too heavy for the PaaS tier. From the AWS CLI: aws ec2 run-instances --image-id ami-... --instance-type r6i.xlarge --key-name risk-team --security-group-ids sg-... --subnet-id subnet-.... Within a minute the response contains an InstanceId and a private IP address.
- Connect and configure: ssh -i risk-team.pem ubuntu@10.0.3.17 over the office VPN. The team installs Python, the risk library and a cron entry that runs the batch at 02:00 and writes results to the firm's object storage. The provider supplied a bare Ubuntu image; everything above it was the team's doing.
- Patch it: sudo apt update && sudo apt upgrade runs today, but it will not run itself. The team adds an unattended-upgrades configuration and a monthly reboot window, because an unpatched VM is the customer's hole in the shared-responsibility model.
- Lock the network: the security group initially allowed SSH from 0.0.0.0/0, the whole internet. Within hours the authentication log shows hundreds of failed login attempts from unknown addresses. The rule is narrowed to the VPN's address range and the noise stops.
- Cost check at month end: the instance is listed at about 0.25 dollars an hour in eu-west-1, which is roughly 180 dollars for a 30-day month if it runs continuously, plus storage. Since the job needs two hours a night, the team schedules the instance to stop at 05:00 and start at 01:30, cutting the compute bill by about 85%.
- The audit finds a second r6i.xlarge, started in March for a one-off backtest and never terminated. It has billed every hour since, with nothing running on it. aws ec2 terminate-instances --instance-ids i-... ends it, and a tagging policy (owner, purpose, expiry) is introduced so the next orphan has a name on it.
IaaS hands you a working server in a minute and hands you its operating system, firewall, patches and bill for as long as it exists, which is why orphaned and unpatched instances are the two classic IaaS failures.
Common pitfalls
- Leaving the operating system unpatched because it is in the cloud: the provider patches the hypervisor, not your Ubuntu or Windows image.
- Opening SSH or RDP to the whole internet: scanners find a new public address within hours, and brute-force attempts begin immediately.
- Forgetting that billing is per hour of existence, not per hour of use: an idle instance costs the same as a busy one, and stopped instances still bill for their disks.
- Storing the only copy of data on an instance's local disk: terminate the instance and the data goes with it; use persistent volumes or object storage with backups.
- Managing more than a handful of machines by hand: without infrastructure-as-code and tagging, nobody can say what runs where, who owns it or when it may be deleted.
Frequently asked questions
What is IaaS with an example?
Infrastructure as a service is renting virtual machines, storage and networking from a provider that owns the physical hardware. Amazon EC2 is the best-known example: you choose a machine type and an image, and get a server you administer yourself. Azure Virtual Machines and Google Compute Engine offer the same, and block storage, virtual networks and load balancers are part of the same layer.
What is the difference between IaaS and PaaS?
IaaS gives you a machine; PaaS gives you a place to run code. On IaaS you install and patch the operating system, runtime and web server yourself, which allows anything the machine can do. On PaaS the provider handles all of that and you only push application code, trading control for speed. A GPU training box is a typical IaaS choice; a web API is a typical PaaS choice.
Who is responsible for security in IaaS?
The provider secures the physical data centre, the hardware and the virtualisation layer. The customer secures everything from the operating system upward: patches, firewall rules, user accounts, encryption and the application. This is the shared-responsibility model, and on IaaS most of the responsibility is on the customer's side because the customer controls most of the stack.
Is IaaS cheaper than owning servers?
For variable or short-lived workloads, usually yes: you pay by the hour and stop paying when you stop the machine. For a constant 24/7 load, a reserved instance or your own hardware can be cheaper over several years. The frequent mistake is to rent by the hour and then run continuously, which combines the higher hourly price with none of the elasticity.