Infrastructure as a service (IaaS)

NIST SP 800-145 defines IaaS as the capability to provision processing, storage, networks and other fundamental computing resources on which the consumer can deploy and run arbitrary software, including operating systems; the consumer does not manage the underlying infrastructure but controls operating systems, storage and deployed applications, with possibly limited control of select networking components such as host firewalls. The building blocks are compute instances (Amazon EC2, Azure Virtual Machines, Google Compute Engine) launched from machine images, network block storage with incremental snapshots, object storage, and virtual networks (VPC, VNet) with subnets, route tables and filtering. In AWS, security groups are stateful and attach to network interfaces, while network ACLs are stateless and attach to subnets, a distinction that regularly trips up rule reviews.

Instance bootstrapping relies on user data processed by cloud-init (or its Windows counterparts) and on the instance metadata service at the link-local address 169.254.169.254, which also hands out the temporary credentials of the instance's IAM role. That makes the metadata service a prime SSRF target; AWS IMDSv2 requires a session token obtained with an HTTP PUT and a response hop limit, which defeats most SSRF primitives, and hardened baselines enforce it. Instance store disks are ephemeral and vanish when the instance stops, whereas network volumes persist; spot or preemptible capacity is cheaper but can be reclaimed at short notice (two minutes of warning on AWS).

Everything from the guest OS upwards is the customer's job: patching, hardening (for example against CIS Benchmarks images), endpoint protection, host logging, backup, disk encryption key choices and firewall rules. Characteristic IaaS failures are golden images that silently age, SSH keys shared between administrators, publicly shared snapshots or machine images containing data or credentials, orphaned volumes nobody owns, and management ports exposed to the internet instead of reached through a bastion or session-manager service.

IaaS differs from classic hosting or colocation through self-service provisioning via API, per-second or per-hour metering and elasticity, and from PaaS in that the operating system remains the customer's. Managed Kubernetes sits in between: the provider operates the control plane, but worker nodes, depending on the offering, may still require customer patching and upgrade scheduling. Lift-and-shift migrations usually land on IaaS and bring their on-premises technical and security debt with them, which is why the shared responsibility line is furthest from the provider here.