Cloud infrastructure explained

Cloud infrastructure

A website, file store, or business service needs computing power to run code, storage to hold data, and network connections to exchange data with users and other services. Cloud infrastructure provides those resources through physical equipment and supporting software. It includes servers, storage devices, network equipment, and virtualization software. Virtualization lets one physical server host multiple separate computing environments. Oracle describes cloud infrastructure as the hardware and software that underlie cloud services.

Cloud providers operate data centers and make these resources available over a network. Customers rent the capacity they need instead of buying, housing, and maintaining every server and storage device. Providers commonly charge by resource use over time, although pricing varies by provider and service.

Cloud infrastructure provides the foundation for cloud computing. Cloud architecture describes how a customer configures and connects those resources for a specific purpose, such as running a website or storing business records. Infrastructure supplies the servers, storage, and networks; architecture determines how they work together.

Cloud infrastructure components

A cloud-hosted website relies on four connected parts: compute runs the code, storage holds files and data, networking carries requests, and management software creates, secures, and monitors resources. Customers manage these resources through a web console or application programming interface (API), while the cloud provider operates the physical hardware.

Compute, storage, and networking

When a visitor opens a website, networking sends the browser request to the service. If the service uses a load balancer, the load balancer distributes requests among available servers or compute instances. Virtual machines or containers run the website code. The code may retrieve page files, account records, or other data from storage before sending a response to the browser.

A database stores structured records such as customer accounts and orders. Object storage holds files such as images, videos, and backups. Block storage provides a disk-like volume for a virtual machine. Access speed, durability, replication, and recovery features depend on the selected service and its configuration.

Management software lets customers create resources and set access permissions. Customers can also use it to review activity and monitor service health. It also supports backups and recovery. The protection available depends on the service and the settings the customer chooses.

Virtual machines and containers

A virtual machine (VM) behaves like a separate computer with its own operating system. A hypervisor is software on a physical server that creates and runs VMs. It lets multiple customers or workloads use the same hardware while keeping their computing environments separate.

A container packages code with the libraries and other dependencies it needs to run. Containers share the host operating system, so they use less overhead than VMs. Both VMs and containers let providers assign physical computing capacity to separate workloads. They differ in the operating environment included with each workload and in how they isolate workloads. Docker describes containers as packages for an application and its dependencies.

Regions and availability zones

A region is a geographic area where a cloud provider operates facilities. Within a region, providers commonly operate availability zones: separate infrastructure locations designed to reduce dependence on a single site. Zone names, physical designs, and available services vary by provider. AWS describes Availability Zones as distinct locations within Regions.

Running a service across more than one zone reduces the effect of a failure at one location. It does not guarantee uninterrupted service. Availability depends on the service design, whether data replicates between locations, and how the service responds when a component fails.

How a cloud request runs

When you open a cloud-hosted website, your browser sends a request over the internet to the service’s network address. If the service uses a load balancer, it receives the request and sends it to an available server or virtual machine. Load balancers use health checks to avoid servers or virtual machines, called backends, that they have marked unhealthy, as described for AWS Application Load Balancers.

The server runs the website code, which may retrieve a page or read a database record. It may also write new information or fetch a file from storage. It then sends a response through the network to the browser. The exact path depends on how the service connects its compute resources, databases, storage, and network controls.

Monitoring tools collect metrics and logs about resource use, errors, and service health. Operators use that information to investigate failures and adjust capacity. For example, Amazon EC2 Auto Scaling adds or removes virtual machines according to configured policies. The load balancer then distributes requests among the available backends.

Cloud control software also lets operators start, stop, and resize virtual resources. A service’s configuration and the provider’s limits determine which changes are allowed. Some changes require a virtual machine to stop first; AWS documents those conditions for EC2 instance type changes.

Cloud service models

Infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS) describe how a cloud provider and its customer divide responsibility for running technology. IaaS supplies computing resources. PaaS provides a managed environment for code, and SaaS gives customers a ready-to-use application.

Infrastructure as a service

Infrastructure as a service (IaaS) provides virtual machines, storage, and networking. The provider operates the data centers and physical hardware. The customer generally manages the operating system, installed software, configurations, and data.

IaaS gives the customer control over the computing environment, and leaves customers to administer and maintain it. Microsoft’s shared-responsibility guidance shows how responsibility shifts across cloud service types.

Platform as a service

Platform as a service (PaaS) provides a managed environment for building and running code. The provider manages the underlying infrastructure and operating system, so customers can deploy code without administering virtual machines.

Customers still manage their code, data, and the settings the service exposes. Supported programming languages, deployment methods, and configuration options vary by provider and product.

Software as a service

Software as a service (SaaS) delivers a ready-to-use application over a network. The provider operates the application and the infrastructure that supports it. Customers manage user access, service settings, and the data they enter or store.

Customers also remain responsible for identities and data they control, as IBM’s comparison of IaaS, PaaS, and SaaS notes.

These models differ mainly in how much the provider manages and how much the customer manages. A cloud solution may combine more than one model. The provider’s documentation and service terms define the actual division of work.

Where cloud resources run

Cloud resources run in provider data centers, infrastructure dedicated to one organization, or a combination of locations. The arrangement determines who operates the infrastructure and where workloads process data. It also sets how much direct control the organization has. Organizations often combine arrangements because workloads differ in their cost, control, data-location, and response-time requirements.

Public and private cloud

A public cloud provider supplies computing resources to many customers through shared infrastructure. Identity permissions, network isolation, and other logical controls separate each customer’s workloads and data.

A private cloud serves one organization exclusively. It may run in the organization’s facilities or at a provider’s site, with either the organization or a third party operating it. The National Institute of Standards and Technology definition centers on exclusive use by a single organization. A private cloud gives the organization more control over configuration and operations, while generally requiring more management and expense.

Hybrid and multicloud

A hybrid cloud connects private infrastructure with public cloud resources. It places workloads in different environments and allows data or services to communicate across them. For example, an organization may keep a database on private infrastructure while running a customer-facing service in a public cloud. That connection adds integration, security, and oversight work.

Multicloud uses services from more than one cloud provider. An organization may use one provider for general computing and another for a specialized data service or disaster recovery. This reduces reliance on a single provider, but managing multiple providers takes more work. Their tools and security models differ, as do their contracts and billing structures. Hybrid and multicloud often overlap. For example, an organization may connect its own data center to two public cloud providers.

Edge and sovereign cloud

Edge infrastructure places computing close to the devices or people producing or using data. A factory, retail site, or telecommunications network may process data locally when sending it to a distant cloud region would add too much delay. AWS defines edge computing as processing data close to its source.

Sovereign cloud offerings address requirements for data location, operational control, and legal jurisdiction. The term has no universal standard. A provider’s label alone does not establish where data resides, who can access it, or which laws govern it. Organizations need to review the service terms and operating model, as well as the applicable jurisdiction.

Combining arrangements

These arrangements can coexist. An organization may use a private cloud for a tightly controlled workload, public cloud services for general computing, two providers for different services, and edge infrastructure for time-sensitive processing. Each additional environment adds work to connect and secure resources, as well as to monitor and govern them.

Reasons to use more than one environment

A single environment is simpler to operate, but it may not meet every workload’s needs for cost, control, data location, and response time. Combining environments addresses those differences while adding operational complexity.

Edge infrastructure and cloud infrastructure

Does edge infrastructure replace cloud infrastructure? Edge infrastructure handles selected computing close to where data is produced or used. It commonly operates alongside public or private cloud resources.

Cloud security responsibilities

Cloud security is shared between the provider and the customer. The provider secures the data centers, physical hardware, and core cloud infrastructure it operates. The customer remains responsible for the identities, data, workloads, and settings under its control.

The division of work depends on the service model. With IaaS, the customer manages much of the software stack, including operating systems, installed software, and workload configuration. With SaaS, the provider manages more of the service itself, while the customer still manages user access, data sharing, retention, and other account settings. The AWS shared responsibility model and Microsoft’s cloud responsibility guidance show how these responsibilities vary by service.

Secure what you control

A secure provider facility does not protect data exposed through a customer setting. An overly broad permission or incorrectly configured network rule can give unauthorized users access. Give each person and service only the access required for its role, review access regularly, and use network rules to expose only intended services.

Assess encryption, backups, and recovery against the service and the organization’s needs. Confirm whether the service encrypts data at rest and in transit, and determine who controls the encryption keys. Identify which backups the provider creates, what they cover, and which backups the customer must configure. Test restoration. A backup that cannot restore the required data within the required time does not meet the recovery need.

Check the service and the rules

Review security responsibilities for each cloud service rather than applying one assumption to every product. For legal or regulatory requirements, identify the jurisdictions that apply to the organization and its data, then review the service terms and compliance documentation. Selecting a cloud region affects where specified resources or data are stored, but region selection alone does not establish compliance.

What cloud changes about cost

An organization must buy servers and other equipment for a traditional data center, then house, power, and maintain them, paying these costs before it knows exactly how much computing capacity it will need. Cloud providers instead charge for the computing, storage, and other resources an organization uses over time. This model makes it easier to add or remove capacity as demand changes.

Flexible capacity does not guarantee lower costs. Total cost depends on the workload. It includes compute time and stored data, plus data transfer and support. Staffing and the reliability and recovery measures the service requires add to the cost. A virtual server left running after a short project continues to generate charges. A fair comparison includes the full cost of cloud resources and of buying and operating local equipment. No pricing model costs less for every workload.

Keep cloud spending visible

Set budgets and alerts, review resource use regularly, and remove resources that no longer serve a purpose. Alerts warn when spending approaches a chosen threshold; they do not automatically stop charges. In AWS, for example, budget notifications send warnings. An operator or automated action must still stop, resize, or remove the resources driving the increase.

Cloud changes when and how an organization pays for computing capacity. Savings depend on matching resources to demand and tracking what remains in use.

Cloud infrastructure trade-offs

Cloud infrastructure lets an organization add or remove computing resources without buying and installing hardware. In return, a service depends on the cloud provider, network connections, and the organization’s own configuration.

A provider outage interrupts workloads that rely on the affected service or region. Resilience depends on the service design: whether it can switch to a backup resource when a dependency fails, restore data, and continue serving users. Operators also need to test recovery plans. A provider availability commitment does not keep every individual workload running. AWS, for example, recommends designing for failure and testing recovery procedures.

Network distance affects response time. Requests take longer when users, stored data, and computing resources are far apart. That delay matters for services that need fast responses. Examples include real-time control and interactive trading, as well as industrial monitoring. Provider-specific databases, managed services, and data formats also make a later move harder. Migration may require code changes and data conversion. It may also require new operating procedures.

Hybrid and multicloud arrangements spread workloads across local infrastructure and one or more cloud providers. They require managed connections and monitoring across environments. They also need consistent security controls and staff who understand each platform. When no one owns a connection, configuration gaps can expose a service or interrupt it. Unowned account settings and access rules pose the same risk.

Sensitive data, legal duties, predictable demand, and existing equipment also affect the balance between cloud flexibility, cost, and control.

When local infrastructure fits

Local or dedicated infrastructure may suit workloads that need direct control, specialized hardware, or strict limits on where data and computing work can run. Existing equipment and experienced staff also affect whether moving a stable workload makes financial sense.

Keeping infrastructure local assigns security and recovery work to the organization. It must control access, maintain hardware, replace failed components, and prepare for outages. Before choosing an environment, compare full operating costs, performance requirements, security responsibilities, and recovery plans.

Choose a cloud approach

Start with the workload: what it does, the computing power and storage it needs, how demand changes over time, and how quickly it must respond. Estimate typical demand and peak periods. These estimates help avoid paying for idle capacity and show whether a service will meet demand during busy periods.

Set operating and legal requirements before comparing providers. Define the recovery time objective: the longest outage the organization can accept. Define the recovery point objective: the maximum amount of recent data it can lose after an outage. Identify where data is stored, processed, backed up, and accessed during recovery. A cloud region alone does not settle every data-location or legal requirement. Review the provider’s terms and the laws and contractual obligations that apply to the organization and its data.

Then decide how much infrastructure the organization can manage. SaaS suits standard business needs because the provider operates the product. PaaS suits custom code when the provider should manage the servers, operating systems, and much of the software environment where the code runs. IaaS gives the customer more control over virtual machines, networks, and software configuration, along with more operational work. A mixed approach suits workloads that need different levels of control, but it adds integrations and oversight.

Estimate recurring costs from realistic usage rather than advertised starting prices. Include computing, storage, and data transfer, along with support and backups. Also account for recovery capacity and staff time to operate the service. When workloads span cloud providers or local infrastructure, include network connections, monitoring, and administration for every environment. A provider’s pricing calculator helps model part of the estimate; compare options using the same workload assumptions.

Before committing, verify how the service supports monitoring, backup restoration, and data export. Confirm which data an export contains, its format, and whether provider-specific features would make migration difficult. A recovery plan or exit path is useful only when the organization has tested it and can carry it out.

Cloud infrastructure summary

Cloud infrastructure combines compute, storage, networking, and management software in facilities operated by a cloud provider. The service model and deployment arrangement determine where those resources run and which responsibilities remain with the customer.

Renting cloud capacity changes how an organization obtains and pays for computing resources. The customer still must manage security, reliability, and cost control.

Key Takeaways

• Match resources to the workload: Cloud infrastructure combines compute, storage, networking, and management software. Choose service and deployment models based on demand, response time, control, and data-location needs.
• Know who manages each layer: Providers operate the physical infrastructure, while customers retain responsibilities that vary by service, especially for access, data, software, and configuration.
• Plan for failure and recovery: Spreading workloads across locations does not guarantee uninterrupted service. Check backup, recovery, monitoring, and data-export options, then test restoration.
• Track the full cost: Usage-based billing makes capacity easier to adjust, but unused resources and data transfer still cost money. Set budgets and alerts, review usage, and compare cloud costs with local infrastructure.

FAQ

Who is responsible for data security in the cloud?

The provider secures the physical infrastructure and core cloud services it operates. The customer remains responsible for user access, data, workload settings, and other resources under its control. The exact division depends on the service.

Do availability zones guarantee uninterrupted service?

No. Using more than one availability zone reduces dependence on a single location, but continued service depends on the application design, data replication, failover process, and recovery testing.

Do spending alerts stop cloud charges?

No. Alerts notify an operator when spending reaches a threshold. An operator or automated action must still stop, resize, or remove the resources generating charges.

Is cloud infrastructure the same as cloud computing?

Cloud infrastructure is the computing, storage, networking, and management software that providers make available. Cloud computing includes the services and tools people use through those resources.

Does cloud infrastructure mean my data is stored online?

Cloud services store data on provider-operated infrastructure, but the storage location and handling depend on the service and its configuration. Check where a service stores data, how it backs it up, and who can access it.

Is a private cloud always more secure?

A private cloud gives one organization dedicated use of its environment, which provides more control over configuration. Security still depends on how people manage access, workloads, software, and data.

Can a business use cloud services and its own data center together?

Yes. Connecting public cloud resources with private infrastructure is called a hybrid cloud. It requires reliable connections and consistent oversight of access, security, monitoring, and data movement.

How do I choose between IaaS, PaaS, and SaaS?

Choose based on how much infrastructure you want to manage. With IaaS, you manage more of the software environment. PaaS manages more of the underlying infrastructure. SaaS provides a ready-to-use application.

How do I keep cloud costs under control?

Track usage and set budgets or spending alerts to flag unexpected resource use. Review charges regularly and remove resources you no longer need. Data transfers, support, and recovery needs also affect total cost.

What if one cloud location becomes unavailable?

Resources spread across separate availability zones reduce reliance on a single location, but that setup does not guarantee uninterrupted service. Check how the provider handles failures, configure backups or recovery resources, and test the recovery plan.

What if I need to move my data to another provider later?

Migration can require extra work when a service relies on provider-specific features or data formats. Before committing, check how the provider supports data export and identify what your workloads would need to run elsewhere.