{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/iaas","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/iaas/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/iaas/"},"term":{"en":"Infrastructure as a service (IaaS)","da":"Infrastructure as a service (IaaS)"},"aka":{"en":[],"da":[]},"domain":["platform"],"cluster":"cloud","layer":"infrastructure","status":"current","era":2006,"summary":{"en":"The cloud model where you rent bare building blocks - machines, storage and network - and run everything on top yourself.","da":"Cloudmodellen, hvor du lejer de rå byggeklodser - maskiner, lager og netværk - og selv driver alt ovenpå."},"body":{"formal":{"en":"A cloud service model in which the provider supplies processing, storage and network resources, while the customer installs and manages the operating system, programs and data, and some network settings.","da":"En cloud-servicemodel, hvor udbyderen leverer regnekraft, lager og netværk, mens kunden selv installerer og driver styresystem, programmer og data samt dele af netværksopsætningen."},"plain":{"en":"Like renting an empty warehouse - the landlord keeps the walls and roof sound, but the shelves, locks and stock inside are up to you.","da":"Som at leje en tom lagerhal - udlejeren holder vægge og tag i orden, men hylder, låse og varer indenfor er dit ansvar."},"inPractice":{"en":"The IT operations manager at an accounting firm rents a virtual machine from a cloud provider for the firm's finance system and must personally install updates, set up the firewall and create user accounts on it.","da":"Den IT-driftsansvarlige i et revisionsfirma lejer en virtuel maskine hos en cloududbyder til firmaets økonomisystem og skal selv installere opdateringer, sætte firewallen op og oprette brugerkonti på den."},"whyItMatters":{"en":"It gives the most freedom but leaves the most security work with the customer; teams that assume the provider patches their machines leave gaps open.","da":"Den giver mest frihed, men efterlader mest sikkerhedsarbejde hos kunden; teams, der tror, at udbyderen patcher deres maskiner, efterlader huller åbne."}},"deepDive":{"en":"NIST SP 800-145 defines IaaS as the capability to provision processing, storage, networks and other fundamental computing resources on which the consumer can deploy and run arbitrary software, including operating systems; the consumer does not manage the underlying infrastructure but controls operating systems, storage and deployed applications, with possibly limited control of select networking components such as host firewalls. The building blocks are compute instances (Amazon EC2, Azure Virtual Machines, Google Compute Engine) launched from machine images, network block storage with incremental snapshots, object storage, and virtual networks (VPC, VNet) with subnets, route tables and filtering. In AWS, security groups are stateful and attach to network interfaces, while network ACLs are stateless and attach to subnets, a distinction that regularly trips up rule reviews.\n\nInstance bootstrapping relies on user data processed by cloud-init (or its Windows counterparts) and on the instance metadata service at the link-local address 169.254.169.254, which also hands out the temporary credentials of the instance's IAM role. That makes the metadata service a prime SSRF target; AWS IMDSv2 requires a session token obtained with an HTTP PUT and a response hop limit, which defeats most SSRF primitives, and hardened baselines enforce it. Instance store disks are ephemeral and vanish when the instance stops, whereas network volumes persist; spot or preemptible capacity is cheaper but can be reclaimed at short notice (two minutes of warning on AWS).\n\nEverything from the guest OS upwards is the customer's job: patching, hardening (for example against CIS Benchmarks images), endpoint protection, host logging, backup, disk encryption key choices and firewall rules. Characteristic IaaS failures are golden images that silently age, SSH keys shared between administrators, publicly shared snapshots or machine images containing data or credentials, orphaned volumes nobody owns, and management ports exposed to the internet instead of reached through a bastion or session-manager service.\n\nIaaS differs from classic hosting or colocation through self-service provisioning via API, per-second or per-hour metering and elasticity, and from PaaS in that the operating system remains the customer's. Managed Kubernetes sits in between: the provider operates the control plane, but worker nodes, depending on the offering, may still require customer patching and upgrade scheduling. Lift-and-shift migrations usually land on IaaS and bring their on-premises technical and security debt with them, which is why the shared responsibility line is furthest from the provider here.","da":"NIST SP 800-145 definerer IaaS som muligheden for at stille regnekraft, lager, netværk og andre grundlæggende IT-ressourcer til rådighed, hvorpå kunden kan installere og køre vilkårlig software, herunder styresystemer; kunden driver ikke den underliggende infrastruktur, men styrer styresystemer, lager og installerede applikationer og har eventuelt begrænset kontrol over udvalgte netværkskomponenter som værtsfirewalls. Byggeklodserne er compute-instanser (Amazon EC2, Azure Virtual Machines, Google Compute Engine) startet fra maskinimages, netværksbaseret bloklager med inkrementelle snapshots, objektlager og virtuelle netværk (VPC, VNet) med subnet, routetabeller og filtrering. I AWS er security groups stateful og knyttet til netværksinterfaces, mens netværks-ACL'er er stateless og knyttet til subnet, en forskel, der jævnligt snyder ved regelgennemgange.\n\nOpstart af instanser bygger på user data, som behandles af cloud-init (eller tilsvarende på Windows), og på instansens metadata-tjeneste på link-local-adressen 169.254.169.254, som også udleverer de midlertidige loginoplysninger til instansens IAM-rolle. Det gør metadata-tjenesten til et oplagt SSRF-mål; AWS IMDSv2 kræver et sessionstoken hentet med HTTP PUT og en hop-grænse på svaret, hvilket slår de fleste SSRF-teknikker ud, og hærdede baselines håndhæver det. Instance store-diske er flygtige og forsvinder, når instansen stoppes, mens netværksvolumener består; spot- eller preemptible-kapacitet er billigere, men kan tages tilbage med kort varsel (to minutters advarsel hos AWS).\n\nAlt fra gæstestyresystemet og op er kundens opgave: patching, hærdning (fx med CIS Benchmarks-images), endpoint-beskyttelse, logning på værten, backup, valg af nøgler til diskkryptering og firewallregler. Typiske IaaS-fejl er golden images, der ældes i stilhed, SSH-nøgler delt mellem administratorer, offentligt delte snapshots eller maskinimages med data eller loginoplysninger, forældreløse volumener uden ejer og administrationsporte eksponeret mod internettet i stedet for at blive nået via en bastion eller en session manager-tjeneste.\n\nIaaS adskiller sig fra klassisk hosting og housing ved selvbetjening via API, afregning pr. sekund eller time og elasticitet, og fra PaaS ved at styresystemet stadig er kundens. Managed Kubernetes ligger midt imellem: udbyderen driver kontrolplanet, men worker nodes kan afhængigt af produktet stadig kræve, at kunden patcher og planlægger opgraderinger. Lift-and-shift-migreringer lander som regel på IaaS og tager deres tekniske og sikkerhedsmæssige gæld fra egen drift med sig, og derfor ligger grænsen i modellen for delt ansvar længst fra udbyderen her."},"edges":[{"type":"kind-of","to":"platform/cloud-computing","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"platform/paas","why":{"en":"With IaaS you look after the operating system yourself; with PaaS the provider does, and you bring only your program and data.","da":"Med IaaS passer du selv styresystemet; med PaaS gør udbyderen det, og du leverer kun dit program og dine data."},"confidence":"high","strength":"primary"},{"type":"contrasts-with","to":"platform/saas","why":{"en":"IaaS hands you raw machines to build on; SaaS hands you a finished program to use.","da":"IaaS giver dig rå maskiner at bygge på; SaaS giver dig et færdigt program at bruge."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/virtual-machine","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"NIST SP 800-145 - The NIST Definition of Cloud Computing","tier":"standard","publisher":"NIST"}],"draft":true}