IaaS, short for Infrastructure as a Service, means renting the raw ingredients of computing (virtual machines, disks, networks and IP addresses) from a cloud provider instead of buying hardware. The provider looks after the data centre and physical machines; everything from the operating system upward is your job.
What you rent and what you still run
With IaaS you pick a machine size (CPU cores, memory), a region and an operating system image, and the provider boots a virtual machine for you within minutes. You attach block storage, set firewall rules and assign a public IP address. Billing is metered, typically per second or per hour of running time plus storage and outbound data.
The split of duties is the defining feature. The provider handles power, cooling, hardware failures and the hypervisor. You handle OS updates, security patches, the web server, the database, backups and monitoring. That is more work than PaaS, where the platform also runs the operating system and runtime for you.
Real IaaS services
Amazon EC2, Google Compute Engine and Azure Virtual Machines are the best-known IaaS products. DigitalOcean Droplets, Hetzner Cloud and Linode (now Akamai) offer simpler versions popular with small teams. A typical worked scenario: an accounting firm needs a Windows server to run a desktop tax package for remote staff. They launch an Azure VM, install the software, restrict access to the office IP range and pay monthly for that one machine instead of buying a server for the back room.
Should a small business use IaaS for its website?
Usually not directly. A marketing site, booking page or online shop is better served by managed web hosting, a website builder or PaaS, because nobody has to patch Linux at midnight. IaaS earns its place when you need full control: legacy software, unusual server setups, compliance rules about where data sits, or workloads large enough that managed services get expensive. A VPS is the budget cousin of the same idea.
Common IaaS mistakes
- Treating the VM as backed up. Providers keep the hardware running, not your data; snapshots are your responsibility.
- Leaving ports open. Exposing SSH or a database port to the whole internet invites constant break-in attempts.
- Forgetting idle resources. Stopped machines can still bill for attached disks and reserved IPs.
- Never patching. An unmaintained server is the most common route to a hacked site.
Related terms
- PaaS: the next layer up, where the platform runs the OS for you.
- SaaS: finished software you simply log into.
- VPS: a smaller, fixed-price virtual server.
- Serverless: running code with no machine to manage at all.