in IaaS, you get a piece of hardware, virtualized though it may be. The provider may permit you to select different pre-configured images, but you're still getting "bare metal", and have root. IAAS requires you to do your own "sysadmining". Generally, you're on dedicated hardware, or at least presented with a reasonable facsimile. Security-wise, your main exposure is that you have to trust the provider (inter-VM threads are pretty unusual even with multi-tenancy.)

In PaaS, you get a user-level platform: you don't get root, you can't change the OS. You can often install your own (user-level) packages. You're probably sharing the machine with other users, and you may be able to tell who they are. And security-wise, your attack surface is vastly greater, since those other tenants might be sloppy. PaaS predates that name: almost any HPC center, for instance, might call itself a shared research cluster, but is basically PaaS. Most would consider a VPS to be PaaS.

One really must think of I- vs P- as a question of isolation. P- provide much more efficient multi-tenancy, but less isolation. I- isolates you almost completely, but makes you responsible for more issues and is less efficient in sharing a piece of hardware.

There are varying *aaS forms which might be considered intermediate: for instance, Linux containers are not as isolated as VMs (IaaS), but significantly more than PaaS. In my opinion, it's not the tools and APIs that make the difference, but rather the properties your application/stack sees when using the solution. Scaling latency might well be such a property, since it's obviously faster to start a 1k-core job on a compute cluster (PaaS) than it would be to spin up a dedicated VM on the requisite number of nodes (IaaS).

Finally, PaaS is layered on top of some sort of infrastructure - which means that you can always take IaaS and build your own PaaS on it. People who provide RoR PaaS on top of Amazon IaaS are a fine example (but you can certainly do it yourself). At one or more levels, resource use always has to be scheduled - whether it's a VM accounted by the node-hour or a process counted by the core-second. Or a dynamically-provisioned bare-metal server by the month.

Infrastructure as a Service is hardware delivery model in which hardware equipment (servers, storage, networks ...) used to support operations is provided by IaaS provider on rental basis. Whereas Platform as a service is broader than Iaas and includes software resources as well. The ownership, housing, maintenance, upgrade of hardware and software is with the IaaS/PaaS provider and the client organization pay for the use. IaaS/PaaS are key components of cloud computing along with SaaS (Software as a Service). All these models help reduce the upfront and long term costs of the client company.

Muhammad Riaz brings up an interesting point: that the industry is promoting the meme that *aaS saves money. It is interesting to ponder why and whether this might be. First, *aaS is merely another form of outsourcing - everything these providers do can be done by your own IT department. Fundamentally, any outsourcing decision is based on the conclusion that your own organization is unwilling, unable or less efficient at providing the outsourced service.

Here, I'm mainly interested in the question of cost-savings - when the decision to go *aaS is really a decision that you can't efficiently do IT. I think the unspoken assumption is that large providers always offer some sort of efficiency-of-scale, and this justifies the decision. The easiest place to see this is at small scale: if your organization needs 2 servers to provide its IT, going in-house might be a huge cost. You need some space, preferably climate-controlled and secure, with dedicated internet and power backup; you need someone who knows how to run the machines and software stack. You will be paying somewhat higher costs for most of this: well-run large-scale datacenters are somewhat more efficient in cooling, etc. There is also a 'granularity' effect with human factors, since you can't hire 5% of a sysadmin - so you'll probably have multifunctional people. The critical thing to note, though, is that many of these factors are purely linear once above a certain size. For instance, the space, cooling, power requirements for servers is purely a linear function of scale: there is quite marginal "economy of scale" (really there is only a "distortion of small scale"). For instance, any datacenter engineered by an awake person can hit a PUE of 1.3 or so, probably 1.2 with a little care. The very largest *aaS providers can hit 1.05 in their dedicated warehouse sites. That's not worthless, of course: since a server consumes power costing about 10% of its capital cost per year, a savings of 20% on power is like a 2% reduction in capital cost - to be honest let's say you keep the box for 3 years, so 6% overall. Not bad, but not really game-changing. Does a whole outsourcing industry rest on saving

A simple answer can be if you are allowed to switch OS.

Hah, I like Shiping's answer! Though I would rephrase it: *you* choose the OS in IaaS, but PaaS provides it for you.

In my mind, IaaS provides Virtualization, Server, Storage and Networking, however, PaaS would be all of those (whatever IaaS provides) plus Operating System, Database and Runtimes. In other words, PaaS provides more efficiency, while IaaS would be toward more controlled environment…

IAAS - is a virtualized hardware access, PaaS is a software platform. See NIST and EXIN Cloud Computing BoK

See this attached figure, may be it will guide you

The red color indicates that it is managed by user and green color indicates that it is managed by cloud service provider.

Mark Hahn gave the absolute definition of the difference between IaaS and Paas. For example only, PaaS offers middleware or development tools, rather than IaaS is the virtualization of hardware and networks.