How Responsibility Shifts Across IaaS, PaaS, and Serverless
Goal
Service models are best understood as different placements of operational responsibility. More management by the provider can reduce undifferentiated work, but it also changes control, constraints, debugging, portability, and cost behavior.
The Short Version
Infrastructure as a service (IaaS) exposes virtualized compute, storage, and networking while the customer operates more of the operating system and runtime.
Platform as a service (PaaS) operates more of the application platform while the customer supplies code, configuration, and data.
Serverless is an operating model in which the provider manages infrastructure provisioning and scaling behind a service interface; the customer still owns code or configuration, data, access, integration, observability, and outcomes.
These labels overlap in real catalogs. Evaluate the actual service boundary instead of arguing about the category name.
A Responsibility Continuum
| Layer | IaaS VM | Managed application platform | Function service |
|---|---|---|---|
| Facilities and hardware | Provider | Provider | Provider |
| Host and virtualization | Provider | Provider | Provider |
| Guest OS patching | Customer | Provider | Provider |
| Runtime/platform maintenance | Customer | Mostly provider | Provider |
| Application code and dependencies | Customer | Customer | Customer |
| Scaling configuration | Customer-designed and operated | Shared through settings | Shared through limits and settings |
| Identity, data, monitoring, cost, risk | Customer | Customer | Customer |
The table is a simplified mental model. Individual services can place backups, scaling, network controls, runtime versions, and patching differently.
Select by Responsibility Fit
Choose IaaS when the workload requires operating-system control, specialized software, legacy compatibility, or platform behavior unavailable in a managed option, and the team can operate that layer safely.
Choose a managed platform when standard application hosting fits, faster delivery matters, and accepting platform constraints is cheaper than owning the underlying runtime. Verify deployment behavior, network integration, scaling, supported runtimes, maintenance, and diagnostics.
Choose a function or other serverless model when work is event-driven or intermittent, units of execution are suitable, and provider-managed scaling is useful. Validate execution limits, concurrency, retries, idempotency, state handling, cold-path performance, observability, and cost at expected usage.
Example: Moving an API
A team runs a small API on two virtual machines. It patches the operating system, maintains the web runtime, configures scaling, and handles failed hosts. Traffic is variable and the application uses no OS-specific feature.
Moving to a managed application platform could remove guest-OS and platform maintenance. The team would still own API code, dependency updates, identity, network access, secrets, database behavior, deployment safety, monitoring, capacity settings, and cost. Moving further to functions might also change execution, scaling, and billing behavior, but would require the API to fit the function model and handle retries correctly.
The decision is not "serverless is more modern." It is "which operational responsibilities should this team retain, and what constraints will it accept in exchange?"
Common Mistakes
Choosing IaaS by habit and inheriting work that adds no business value.
Choosing serverless by label without validating workload shape and limits.
Assuming provider-managed scaling guarantees application performance.
Ignoring the new debugging, observability, quota, and dependency model.
If Someone Asks You
Is a more managed service always better?
No. It is better when the shifted responsibilities and platform constraints fit the workload, risk, and team. Choose the most managed model that meets the requirement without hiding unacceptable constraints.
What You Should Remember
A service model is a choice about which operational responsibilities to retain.
Questions to Check Your Understanding
Which responsibilities disappear when an API moves from VMs to a managed platform?
Which responsibilities remain in every model?
What workload characteristics should be tested before choosing functions?
Further Study
The NIST Definition of Cloud Computing - Review the formal IaaS, PaaS, and SaaS service-model definitions.