Cloud Architecture and Service Models
The Cloud Architecture and Service Models domain tests how cloud environments are structured and who is responsible for what. You need the NIST reference architecture roles, the three service models with their management boundaries, the four deployment models, and the enabling technologies of virtualisation and multi-tenancy.
Reference architecture roles
NIST SP 500-292 names five actors: the cloud consumer who uses services; the cloud provider who delivers them; the cloud auditor who independently assesses controls; the cloud broker who aggregates, integrates or arbitrages services from multiple providers; and the cloud carrier who provides network connectivity.
Service models and the responsibility boundary
- IaaS: the provider manages hardware, network and hypervisor; the consumer manages operating systems, middleware, runtime, applications and data.
- PaaS: the provider also manages the OS, runtime and middleware; the consumer manages its application code and its data.
- SaaS: the provider manages the whole stack; the consumer still manages identities, access, configuration and the data it puts in.
Deployment models
Private (single organisation), public (open to the market), community (shared by organisations with common concerns) and hybrid (two or more distinct models bound by technology enabling data and application portability). Private describes ownership and exclusivity, not location - a private cloud can be hosted by a third party.
Worked example
A team deploys containerised code and configures environment variables and scaling rules, but never patches an operating system or installs a runtime. Which model? Reasoning: the provider owns the OS, runtime and middleware; the team owns only its application and configuration. Control of scaling rules and environment settings does not make it IaaS, because IaaS would leave OS patching with the team. It is PaaS. If the team also chose and patched the OS, the answer would move to IaaS; if the team only used a finished business application, it would be SaaS.
Traps that cost marks
- Assuming SaaS removes all consumer responsibility: data classification, user access reviews and configuration remain yours.
- Confusing community cloud with hybrid cloud, or assuming private cloud must be on-premises.
- Mixing up the broker (service intermediation) with the carrier (connectivity).
- Choosing a service model by technology rather than by which management tasks the consumer keeps.