The cloud — IaaS, PaaS, SaaS, deployment models, regions and zones

Objective

Understand what you actually rent when you "move to the cloud", know how to put any service in the right box (IaaS, PaaS, SaaS; public, private, hybrid) and choose a region and zones suited to users in Morocco.

Key points

• The cloud is computing rented on demand: servers, disks, networks, databases, paid per use and created in a few minutes through a console, an API or a command line.
• Three service models: IaaS (you rent the infrastructure), PaaS (you rent a platform to deploy your code), SaaS (you rent ready-to-use software).
• Three deployment models: public (shared, at a provider), private (reserved for a single organization), hybrid (both, connected).
• Providers divide the world into regions (a geographical area) and each region into availability zones (separate data centers).
• Choosing a region means balancing latency, price, available services and data rules.

1. Before the cloud: the server in the closet

Imagine a delivery startup in Casablanca in 2012. To launch its application, it must:

1. buy two servers (several tens of thousands of dirhams);
2. wait for delivery, find an air-conditioned room, a UPS, a reliable connection;
3. install the system, the updates, the backup;
4. plan big: if Ramadan doubles the orders, the servers must cope… and the rest of the year they idle at 10%.

With the cloud, the same startup opens an account, chooses a region and creates two virtual machines in ten minutes. It pays by the hour or by the second. If traffic doubles, it adds machines, then deletes them once the peak is over.

The five characteristics you find at every provider:

CAPEX versus OPEX

• CAPEX (capital expenditure): you buy the hardware and depreciate it over several years.
• OPEX (operating expenditure): you pay a monthly rent based on consumption.

The cloud turns a large upfront expense into a monthly bill. It is not automatically cheaper: a server running 24/7 for five years can cost more to rent than to buy. The benefit comes mainly from flexibility and speed.

2. The three service models

The best way to understand them: look at who manages what.

IaaS — Infrastructure as a Service

You rent virtual machines, disks and networks. You install the system, the packages, the patches: it is almost like a physical server, without the hardware.

Examples: Amazon EC2, Azure Virtual Machines, Google Compute Engine, but also the VPSs of hosting companies such as OVHcloud or Contabo.

# Create an Ubuntu virtual machine in one command (Azure CLI, as an example)
az vm create --resource-group rg-boutique --name vm-web-01 \
  --image Ubuntu2404 --size Standard_B2s --admin-username azureuser --generate-ssh-keys

# The equivalent on Google Cloud
gcloud compute instances create vm-web-01 --zone=europe-southwest1-a \
  --machine-type=e2-small --image-family=ubuntu-2404-lts-amd64 --image-project=ubuntu-os-cloud

PaaS — Platform as a Service

You deploy your code (or a container image); the platform provides the system, the runtime environment, scaling and often the HTTPS certificate.

Examples: Azure App Service, Google App Engine, AWS Elastic Beanstalk, Heroku; managed databases (Amazon RDS, Azure SQL Database, Cloud SQL) are also PaaS: you never touch the machine's system.

SaaS — Software as a Service

You use finished software in the browser: email (Gmail, Outlook), CRM, payroll software, video conferencing, an online cash register. You manage your users and your data, nothing else.

What about the other "aaS"?

• CaaS (Containers as a Service): you provide a container image, and the platform runs it (Cloud Run, Azure Container Apps, AWS Fargate).
• FaaS (Functions as a Service): you provide a function, executed on each event (AWS Lambda, Azure Functions, Cloud Run functions). This is the core of serverless, covered in lesson 1.2.

Choosing the right model: three Moroccan examples

A simple rule: the higher you go (IaaS → PaaS → SaaS), the less you administer, but the less you control.

3. Deployment models

Public cloud

The hardware belongs to the provider and serves thousands of logically isolated customers. You pay per use. This is what people call "the cloud" in everyday life: AWS, Microsoft Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, OVHcloud…

Private cloud

An infrastructure dedicated to a single organization, with the same principles (self-service, API, elasticity): for example a bank that runs OpenStack or VMware in its own data center, or dedicated servers at a local hosting company. More control, but you have to buy and administer the capacity.

Hybrid cloud

An information system that combines a private (or on-premises) environment and a public cloud, connected by a VPN or a dedicated link. Typical case: sensitive data stays in-house, while web applications or occasional computations go to the public cloud.

Multicloud

Using several public providers (for example email at one, hosting at another). This is not the same as hybrid: you can be multicloud without hosting anything yourself.

4. The major providers

The concepts in this course are the same everywhere: only the names change. A mapping table will follow you through the next lessons.

5. Regions and availability zones

The region

A region is a set of data centers in the same geographical area (a city or a province). Each region has a code:

At the time of writing, the three major providers have no region open in Morocco; the regions in the Iberian Peninsula and France are the closest. Announcements change regularly: always check the official list of your provider before a project.

The availability zone

Within a region, an availability zone is one (or more) data center(s) with independent power, cooling and network. The zones of the same region are several kilometers apart but connected by a very fast network (latency of around one millisecond).

Region eu-south-2 (Spain)
├── zone eu-south-2a   ← web server 1
├── zone eu-south-2b   ← web server 2
└── zone eu-south-2c   ← standby database

Key idea: a fire, a power cut or a network failure affects one zone. If your servers are spread across several zones, your service survives. This principle comes back in lesson 2.3.

How to choose your region

1. Latency: are your customers in Casablanca, Tangier or Agadir? An Iberian or French region responds in a few tens of milliseconds. Measure it:

   # Approximate response time to a regional endpoint (example)
   curl -o /dev/null -s -w '%{time_connect}\n' https://ec2.eu-south-2.amazonaws.com
   

2. Available services: not all regions have all services, or all machine sizes.

3. Price: it varies from one region to another (sometimes by 10 to 30%).

4. Data rules: some personal or sensitive data cannot leave the country without conditions. In Morocco, law 09-08 governs transfers abroad (lesson 3.1). This is a legal question to ask before choosing.

5. Disaster recovery: plan a second region for backup copies (for example Spain + France).

Points of presence (edge)

In addition to regions, providers have hundreds of points of presence in major cities: they are used for the CDN (caching images and web pages as close as possible to users) and for DNS. They do not run your machines, but they speed up your website.

6. How you control a cloud

Three entry points, which do the same thing:

# List the available regions (once the CLI is installed and signed in)
az account list-locations --output table
gcloud compute regions list
aws ec2 describe-regions --output table

Professional advice: do your first trials in the console to understand, then rewrite them on the command line or in Terraform to reproduce them. An infrastructure created only with the mouse is hard to document and to recreate.

Common pitfalls

• Believing the cloud is always cheaper: a server that is always on and badly sized quickly costs more than a purchased server. The gain comes from elasticity and from stopping what is not used.
• Confusing region and zone: two servers in the same zone do not protect you from a data center failure.
• Choosing the cheapest region without looking at the law: customer data may be subject to conditions for transfer outside Morocco.
• Thinking that with SaaS you are responsible for nothing: you remain responsible for your accounts, your passwords and your data.

Lab

The lab has no access to the cloud: you will write small "key=value" files that record your choices, as in an architecture file. You will classify three services (IaaS, PaaS, SaaS), write down two region codes, identify the deployment model of a clinic and spread three servers across three zones.

cat /root/cloud/classement.txt
sort -u /root/cloud/zones.txt | wc -l    # must display 3

Quiz

1. A company uses Gmail for its email. Which service model?
2. What is the difference between a region and an availability zone?
3. A hospital keeps its medical records in its own data center and uses a public cloud for its website and statistical computations. Which deployment model?
4. With IaaS, who applies the security patches of the operating system?
5. Name three criteria for choosing a region.

Reference sources: Microsoft Learn and Google Cloud documentation (CC BY 4.0). Original MasterLinux text.