## Cloud Service Models: Who manages what?

To secure the cloud, you must understand the "Pizza-as-a-Service" analogies.

### 1. On-Premises (Traditional IT)
*   **Concept**: You own everything. The building, the AC, the servers, the cables, the OS, the App.
*   **Pizza**: You buy flour, cheese, an oven, gas, and make the pizza at home.
*   **Security**: You are responsible for 100% of the stack.

### 2. IaaS (Infrastructure as a Service)
*   **Concept**: You rent the hardware (VMs). Amazon manages the data center and the hypervisor. You manage the OS and up.
*   **Pizza**: You buy a frozen pizza (App) and bake it in a rented oven (Infrastructure).
*   **Examples**: AWS EC2, Azure VM, Google Compute Engine.
*   **Security**: You must patch Windows/Linux. Amazon secures the physical building.

### 3. PaaS (Platform as a Service)
*   **Concept**: You just bring your code. The provider manages the Hardware AND the OS.
*   **Pizza**: You order pizza delivery.
*   **Examples**: AWS Lambda, Azure SQL Database, Google App Engine, Heroku.
*   **Security**: You secure your *Code* and *Identity*. You cannot patch the OS (AWS does it).

### 4. SaaS (Software as a Service)
*   **Concept**: You just use the software.
*   **Pizza**: You go to a restaurant.
*   **Examples**: Gmail, Salesforce, Dropbox, Slack.
*   **Security**: You only manage **Access** (Who can log in?) and **Data** (What files do we upload?).

### Why this matters for the SOC?
If you get an alert for a SaaS app (Salesforce), checking the "CPU usage" is impossible. You have no server access. You can only check "Login Logs".
If you get an alert for IaaS (EC2), you *can* check CPU usage and likely have Shell access.