Infrastructure as a Service is the right call when you need control of the operating system and you are tired of buying hardware that sits half idle. You rent compute, storage and networking by the hour or the second, you keep root on the machine, and the provider worries about power, cooling and failed disks. Everything above the hypervisor stays yours: patching, backups, monitoring, the lot.
That trade is excellent for some workloads and a waste of money for others. This guide sets out what IaaS includes under the standard definition, how the market splits between providers, what the bill looks like once commitments and data transfer land, and the cases where you should skip IaaS entirely.
What IaaS actually covers
The definition worth using is the one in NIST Special Publication 800-145, published in 2011 and still the reference every auditor reaches for. It lists five essential characteristics of cloud computing: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. If a service misses one of those, it is hosting with a nicer invoice, not cloud.
NIST’s wording on IaaS is precise about the split. The consumer provisions processing, storage and networks, and controls operating systems, storage and deployed applications, with possibly limited control of selected networking components such as host firewalls. The consumer does not manage the underlying infrastructure. In practice that means you choose the Linux distribution and the kernel version, you own the patch cadence, and you get an email when the provider plans maintenance on the host your instance happens to live on.
- Patch your operating system, runtime or application dependencies.
- Test that your backups restore. Snapshots are not a restore test.
- Size your instances. Over-provisioning bills quietly, month after month.
- Design your failure domains. A single instance in a single zone is a single point of failure.
IaaS, PaaS and SaaS side by side
The three service models are not a maturity ladder. They are different answers to the question of how much of the stack you want to be responsible for. Most organisations we work with end up with all three: IaaS for the awkward legacy application, PaaS for new services, and SaaS for email and finance.
| Layer | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Building, power, cooling | You | Provider | Provider | Provider |
| Servers, storage, network | You | Provider | Provider | Provider |
| Virtualisation | You | Provider | Provider | Provider |
| Operating system | You | You | Provider | Provider |
| Runtime and middleware | You | You | Provider | Provider |
| Application code | You | You | You | Provider |
| Data and access control | You | You | You | You |
Read the bottom row twice. Every model leaves you holding data classification, identity and access control. The 2026 breach reports that make the news are mostly stories about an access key in a public repository, not a hypervisor failure.
Who you are buying from
Scale matters here because it buys you regions, instance variety and a labour market of people who already know the platform. Synergy Research reported enterprise spending on cloud infrastructure services of $143 billion in the second quarter of 2026, more than $43 billion up on the same quarter a year earlier. CRN’s breakdown of the same Synergy data gives the three-year share picture below.
The interesting detail is the direction of travel rather than the ranking. AWS slipped two points year on year while Google Cloud added two, which is the first sustained share shift in years. Outside this trio, the Chinese providers run large businesses that barely register on Western procurement shortlists — we compare two of them in Alibaba Cloud versus Huawei Cloud.
For a 20-person company none of this decides anything. Pick the provider whose regions sit near your users, whose compliance paperwork your customers accept, and whose console your team can actually operate at 2am.
What it costs once commitments and egress land
On-demand pricing is the worst price you will ever pay, and it is the one every calculator shows you first. The savings come from commitment and from switching things off. Published maximums, taken from the providers’ own pages at the time of writing in October 2026:
| Mechanism | Provider | Published maximum saving | Commitment | Flexibility |
|---|---|---|---|---|
| Compute Savings Plans | AWS | Up to 66% | 1 or 3 years, hourly spend | Any instance family, size or region |
| EC2 Instance Savings Plans | AWS | Up to 72% | 1 or 3 years, hourly spend | One instance family in one region |
| Committed use discounts | Google Cloud | Up to 55% (70% memory-optimised) | 1 or 3 years, resource or spend | Depends on the commitment type |
| Sustained use discounts | Google Cloud | Up to 30% | None — applied automatically | Kicks in past 25% of a billing month |
Then there is the waste. Flexera’s 2026 State of the Cloud Report, based on 753 cloud decision-makers, estimates 29% of IaaS and PaaS spend is wasted — the first increase in five years, which Flexera attributes to AI workloads being harder to forecast. A 72% discount on an instance you did not need is still money gone.
- Idle development instances left running over weekends and holidays.
- Unattached storage volumes and snapshots from machines deleted months ago.
- Cross-zone and internet data transfer, which is metered per gigabyte in one direction.
- Managed database instances sized for a launch-day traffic spike that never came.
Egress deserves its own note because it shapes exit options. Oracle publishes 10 TB of free monthly egress on OCI, which is unusually generous and tells you how much pricing freedom providers have here. In the EU the picture changes again: under the Data Act, switching and data-egress charges are abolished from 12 January 2027. If a migration is on your roadmap, that date is worth marking.
What the SLA really promises
Uptime percentages are easy to nod along to and hard to feel. The arithmetic on a 30-day month makes them concrete. Google’s Compute Engine SLA promises at least 99.99% monthly uptime for instances spread across multiple zones and 99.9% for a single instance outside the memory-optimised family. AWS commits to 99.99% at region level for EC2.
Two things follow. The higher number requires you to run across zones, because no contract makes one machine more reliable. And the compensation for a missed SLA is a service credit, not your lost revenue, so the SLA is a statement of intent rather than insurance.
The SLA tells you what the provider owes you in credits. Your architecture tells you what your customers actually experience.
A starting architecture that holds up
For a typical business application serving a few thousand users, the boring pattern still wins. Two small instances behind a managed load balancer in two availability zones, a managed database with automated backups and a tested restore, object storage for files, and a content delivery network in front of static assets. No Kubernetes until something forces it.
- Right-size after two weeks, not on day one. Launch slightly large, measure, then cut. Guessing up front always costs more.
- Tag everything from the first instance. Owner, environment, cost centre. Retrofitting tags across 300 resources is a miserable afternoon.
- Automate the build. If you cannot rebuild the environment from a repository, you have a pet, not infrastructure.
- Put a budget alert in before you need it. A notification at 60% of the monthly forecast catches runaway jobs early.
- Test a restore every quarter. Thirty minutes, calendar invite, no exceptions.
When IaaS is the wrong answer
Sometimes the honest answer is that you do not want IaaS at all. If your application is a standard web stack with no unusual dependencies, a managed platform removes the patching work you would otherwise carry. If the workload is email, document collaboration or accounting, buy the SaaS product and move on. And if you run a steady, predictable load on hardware you already own and depreciate, a colocated server can still be the cheaper option for years.
The decision usually comes down to two questions. Does anything about your stack require control of the operating system? And does your team have the appetite to keep that stack patched and monitored? Two yeses point to IaaS. One no points somewhere else, and there is no shame in it.
Eudora Technology plans, builds and runs this remotely for clients across time zones, from a single migrated server to a multi-region estate. Our cloud solutions pages set out how we scope that work.
Frequently asked questions
Is IaaS cheaper than buying our own servers?
Over three years, often not for steady workloads. IaaS wins when demand varies, when you need a second site for resilience, or when capital is better spent elsewhere. Compare the fully loaded cost — hardware, replacement cycle, power, floor space, licences and the hours your team spends on maintenance — against a committed cloud price, not the on-demand rate.
Do we still need backups if the provider replicates our storage?
Yes. Replication copies your mistakes faithfully, including deletions and ransomware encryption. You need point-in-time backups held somewhere with separate credentials, and you need to restore one occasionally to prove it works. Replication protects against hardware failure; backups protect against people and software.
Who patches the operating system on an IaaS instance?
You do. NIST’s definition puts the operating system on the customer side of the line, and every major provider’s shared responsibility model agrees. The provider patches the hypervisor and the physical estate. If nobody on your team owns OS patching with a schedule, choose a managed platform instead.
How do we avoid being locked in?
Keep your data in open formats, keep the build in code, and avoid proprietary services for anything you could not replace in a fortnight. Price your exit before you commit: calculate the egress volume at list rates. If you operate in the EU, switching and egress charges fall away from 12 January 2027 under the Data Act.
Not sure whether your workload belongs on IaaS, a managed platform or neither? Get in touch with Eudora Technology to talk about your project.
Sources
- SP 800-145: The NIST Definition of Cloud Computing
- Q2 Cloud Market Passes $143 Billion; Highest Growth Rate in Eight Years
- Cloud Market Share Q2 2026: Google Gains Share As AWS Falls
- Compute Engine Service Level Agreement
- Compute Savings Plans pricing
- Flexera Finds Cloud Value is Rising While AI Waste Grows
