AWS CLOUD CERTIFICATIONS
AWS Cloud Concepts Explained: IaaS, PaaS, SaaS, Shared Responsibility & Regions
Confused about the difference between IaaS, PaaS, and SaaS, or what "shared responsibility" actually means on exam day? This blog breaks down the core cloud concepts tested in AWS Cloud Practitioner (CLF-C02) in plain language, so you understand the why behind each term instead of just memorizing definitions.
Quick Answers
Cloud Concepts is the first domain of the CLF-C02 exam, which includes the concepts of service models (IaaS, PaaS, SaaS), deployment models (public, private, hybrid), the shared responsibility model, and the AWS global infrastructure (Regions, Availability Zones, Edge Locations). These concepts are important because they are the foundation for all other exam domains: Security, Technology, Billing. Once you get comfortable with these basics, the rest of your CLF-C02 preparation will be much easier to absorb.
Key Takeaways
The difference between IaaS, PaaS and SaaS is the extent to which AWS manages your infrastructure.
The shared responsibility model divides security responsibilities between AWS ('security of the cloud') and you ('security in the cloud').
Regions are geographic areas and Availability Zones are independent data centers in a Region.
Global infrastructure is a key component to understanding the answers to scenario questions relating to latency, redundancy and compliance.
These concepts have about 24% of the weightage in the exam and are not to be neglected or hurried.
Understanding Service Models and the Shared Responsibility Model
Cloud service models lie on a continuum of control to convenience. In IaaS (Infrastructure as a Service), such as Amazon EC2, you're responsible for the operating system, applications, and data, while AWS is responsible for the physical hardware and networking. PaaS (Platform as a Service), such as AWS Elastic Beanstalk, takes another layer of abstraction and provides you with the runtime and infrastructure so you can only concentrate on your application code. With SaaS (Software as a Service), such as Amazon Chime, ownership of practically everything else is transferred except for your data and user settings. This also applies to the shared responsibility model: AWS is always on the hook for the security of the cloud (physical data centers, hardware, global infrastructure), and you are responsible for the security in the cloud (your data, access management, configuration).
A key aspect of exam questions is whether you can accurately position a security task on this side of the equation.
Regions, Availability Zones, and Global Infrastructure
The AWS global infrastructure consists of Regions, Availability Zones (AZs), and Edge Locations, and it is important to understand the relationships among them for scenario-based questions. A Region is a physical geographic area (such as Mumbai or Singapore) that may have multiple isolated Availability Zones, each with independent power, cooling, and networking resources in case of localized failures. Edge Locations are even closer to end users, providing services such as Amazon CloudFront with lower latency to deliver content. Often exam scenarios will require you to select a combination of Regions and AZs for high availability, disaster recovery or compliance requirements such as: Deploying across multiple AZs within a Region protects against a single data center failure, and deploying across Regions protects against a Region-wide outage.
Skills Needed to Master These Concepts
Understanding the difference between IaaS, PaaS, and SaaS with actual AWS services.
Applying the shared responsibility model to security scenarios in the right way
Knowing the correlation between Regions, Availability Zones and Edge Locations
Assessing and comparing deployment models (public, private, hybrid) in relation to various business requirements.
Connecting cloud concepts to the AWS Well-Architected Framework's reliability pillar
Cloud Concepts at a Glance
| Concept | Definition | Example AWS Service |
|---|---|---|
| IaaS | You manage OS, apps, and data; AWS manages hardware | Amazon EC2 |
| PaaS | AWS manages infrastructure and runtime; you manage code | AWS Elastic Beanstalk |
| SaaS | AWS manages almost everything except your data/settings | Amazon Chime |
| Region | A physical geographic area with multiple Availability Zones | Asia Pacific (Mumbai) |
| Availability Zone | An isolated data center within a Region | ap-south-1a |
| Shared Responsibility | Security split between AWS and the customer | IAM policies (customer-managed) |
Step-by-Step Roadmap to Mastering Cloud Concepts
Understand the difference between IaaS, PaaS, and SaaS, and give an example of one AWS service that fits each of the three categories.
Learn about the shared responsibility model and get used to doing the sorting into the 'AWS' and “customer” columns.
Know the order of Regions, Availability Zones, and Edge Locations.
Relate these ideas to practical situations such as disaster recovery and latency.
Test your knowledge using topic-wise quizzes that only test the Cloud Concepts.
Review weak points from AWS official documentation prior to progressing to next domain.
Book Your Free Counselling Session
Still mixing up IaaS, PaaS, and SaaS on every practice question?
Understand these basic concepts simply with a cloud mentor, using real examples that stick - Book Your Free Counselling Call Today and build a foundation for all the AWS exams that follow
Expert Insights
“Consistently, candidates that fail to master the Cloud Concepts domain find the Security and Technology domain difficult as well, as both of these domains are based on the vocabulary of the Cloud Concepts domain. It can be helpful to spend more time on this even if it seems "too basic" — it will be useful throughout the exam, not just in this domain.