What is cloud computing?

Cloud computing is the delivery of computing resources — servers, storage, databases, networking and software — over the internet, usually paid for on demand. Instead of buying a physical server and keeping it in a closet, you rent capacity from a provider.

The cloud is not a single place. It is a business model and a set of technologies. Your data still lives on physical machines in data centers; you just do not own or operate them.

The three common service models

Infrastructure as a service (IaaS) gives you virtual machines, storage and networks. You manage the operating system, runtime and application. It is close to renting a data center with a control panel.

Platform as a service (PaaS) gives you a managed environment for running code. The provider handles the operating system and much of the runtime. You focus on the application and its data.

Software as a service (SaaS) gives you a finished application through a browser or app. Email, video meetings and online document editors are common examples. You manage users and settings, not servers.

The lines blur. A managed database is PaaS-like. A container service may sit between IaaS and PaaS.

Why teams use it

• Elasticity: add capacity for a launch and remove it afterward.
• Speed: provision a server in minutes instead of ordering hardware.
• Global reach: place services in regions closer to users.
• Managed services: let a provider handle backups, patching and scaling for common systems.
• Variable cost: pay for what you use, at least in theory.

The trade-off is that variable cost can become unpredictable, and convenience can hide complexity.

Public, private and hybrid

Public cloud resources are shared across many customers, with logical isolation. The major providers operate large public clouds.

Private cloud is dedicated infrastructure, often in a company's own data center or a hosted environment. It can offer more control but usually costs more to operate.

Hybrid combines on-premises systems with public cloud services. A company might keep sensitive records on its own hardware and run a public-facing app in the cloud.

“Private cloud” is sometimes used loosely. A single dedicated server is not automatically a cloud. Elasticity, self-service and resource pooling are part of the usual definition.

The shared responsibility model

Cloud security is a partnership, but the split depends on the service.

• The provider secures the physical facilities, hardware and underlying network.
• The customer secures identities, access policies, data, configurations and application code.

A misconfigured storage bucket is usually a customer problem, even though the storage service is managed. The provider cannot know that your data should not be public.

What cloud computing is not

• It is not automatically cheaper. Lifting an inefficient system into the cloud can make it more expensive.
• It is not automatically secure. Default settings can be permissive.
• It is not immune to outages. Regions and availability zones improve resilience, but they are not magic.
• It is not a backup by itself. Replication is not the same as a tested, isolated backup.
• It is not always the right choice. Some workloads are cheaper or easier on owned hardware.

A cost checklist

Cloud bills grow through many small choices:

• idle virtual machines;
• oversized databases;
• data transfer between regions;
• logs stored forever;
• snapshots that are never deleted;
• managed services used without limits;
• development environments left running overnight.

Tag resources, set budgets and alerts, and review the bill by service and team. The cheapest architecture is often the one with fewer moving parts.

How to think about lock-in

Using a provider's unique database or AI service can save time, but it can make migration harder. The right level of lock-in depends on the workload. For a short-lived experiment, speed may matter more. For a decade-long system, portability and exit costs deserve more attention.

The practical summary

Cloud computing turns capital expense into operating expense and moves operational work to a provider. It offers flexibility, but it does not remove the need for architecture, security, cost control and disaster planning.

For how software talks to these services, read what is an API?.