1.2 Cloud Deployment Models
Key Takeaways
- The three deployment models are public cloud (fully on AWS), hybrid (mix of on-premises and cloud), and private cloud (organization-owned data center).
- Public cloud is the most common model and offers the greatest agility, scalability, and cost efficiency with no upfront hardware.
- Hybrid cloud suits organizations with compliance constraints or legacy systems; AWS Outposts, Direct Connect, and VPN connect on-premises to AWS.
- The three service models are IaaS (EC2), PaaS (Elastic Beanstalk), and SaaS (WorkSpaces) — the further down the stack AWS manages, the less you manage.
- Matching a scenario to the right deployment and service model is a recurring CLF-C02 question pattern.
Understanding how cloud infrastructure is deployed is a core concept on the CLF-C02 exam. There are three primary cloud deployment models and three cloud service models, and the exam tests your ability to match a scenario to the right one.
Public Cloud
In a public cloud deployment, all resources run on the cloud provider's infrastructure (for example, AWS). This is the most common model for startups, web applications, and any organization seeking maximum agility. AWS sometimes calls a public-cloud-first approach "cloud-native" or "cloud."
Characteristics:
- All infrastructure lives in the provider's data centers
- Resources are multi-tenant — logically isolated, not physically dedicated
- Accessed over the public internet or AWS Direct Connect
- Pay-as-you-go pricing with no upfront hardware investment
- Maximum scalability and global reach
Best for: startups, web and mobile apps, SaaS products, dev/test environments, and any workload without strict data-residency constraints.
AWS example: A company runs its entire e-commerce platform on EC2, RDS, S3, and CloudFront — hosted entirely on AWS.
Hybrid Cloud
A hybrid cloud deployment connects on-premises infrastructure (or a private cloud) with public cloud resources, letting workloads move between the two as needs change.
Characteristics:
- Some resources on-premises, some in the cloud
- Connected via AWS VPN, AWS Direct Connect, or AWS Outposts
- Lets organizations keep sensitive data on-premises while bursting to the cloud for scale
- More complex to manage than pure public cloud
Best for: organizations with regulatory or compliance constraints, legacy systems that cannot be migrated, or workloads that need to burst to the cloud during peak demand.
AWS services for hybrid:
| Service | Purpose |
|---|---|
| AWS Outposts | AWS infrastructure and services deployed in your own data center |
| AWS Direct Connect | Dedicated private network connection from on-premises to AWS |
| AWS Site-to-Site VPN | Encrypted connection over the internet between on-premises and AWS |
| AWS Storage Gateway | Hybrid storage connecting on-premises systems to AWS storage |
| AWS Snow Family | Physical devices for data migration and edge computing |
Private Cloud (On-Premises)
A private cloud uses cloud-like technologies but runs entirely in the organization's own data center. It is NOT hosted by a third-party provider.
Characteristics:
- Infrastructure owned and operated by the organization
- Resources not shared with other organizations
- Full control over hardware, software, and security
- Higher upfront cost and operational burden
- Limited scalability compared to public cloud
Best for: organizations with strict requirements that prohibit any data leaving their premises, certain government agencies, and organizations with significant existing infrastructure investments.
On the Exam: Match the scenario to the model. "Entirely on AWS" = public cloud; "some on-premises + some on AWS" = hybrid; "own data center with cloud-like features" = private cloud.
Cloud Service Models: IaaS, PaaS, SaaS
Beyond deployment models, you must understand the three cloud service models, which differ in how much you manage versus how much AWS manages.
| Model | What You Manage | What AWS Manages | Example |
|---|---|---|---|
| IaaS (Infrastructure as a Service) | OS, runtime, middleware, applications, data | Hardware, networking, storage, virtualization | Amazon EC2 |
| PaaS (Platform as a Service) | Applications and data | OS, runtime, middleware, hardware | AWS Elastic Beanstalk |
| SaaS (Software as a Service) | Just your data and configuration | Everything, including the application | Amazon WorkSpaces |
IaaS — Infrastructure as a Service
IaaS provides the basic building blocks of cloud IT and the highest level of flexibility and control. It most closely resembles traditional on-premises IT — you manage the operating system, applications, and data.
AWS IaaS examples: Amazon EC2, Amazon EBS, Amazon VPC.
PaaS — Platform as a Service
PaaS removes the need to manage underlying infrastructure (hardware and operating systems) so you can focus on deploying and managing applications rather than provisioning servers.
AWS PaaS examples: AWS Elastic Beanstalk, AWS App Runner, Amazon Lightsail.
SaaS — Software as a Service
SaaS provides a completed product the provider runs and manages; you only decide how to use it. Most SaaS applications are accessed through a web browser.
AWS SaaS examples: Amazon WorkSpaces (virtual desktops), Amazon Chime, and the many SaaS products in AWS Marketplace.
On the Exam: The deeper down the stack AWS manages, the less operational responsibility you carry. EC2 (IaaS) gives you the most control and the most work; SaaS gives you the least of both. This ladder also drives the Shared Responsibility Model covered in Domain 2.
Multi-Cloud and the Cloud-First Mindset
The exam centers on public, hybrid, and private models, but you may also see multi-cloud mentioned — using more than one cloud provider (for example, AWS plus another) to avoid lock-in or meet specific requirements. A related idea is a cloud-first (or cloud-native) strategy, where new workloads are built for the cloud by default rather than provisioned on-premises. The practical takeaway for CLF-C02: identify the model from the scenario's wording.
Resources "entirely on AWS" signal public cloud; a "connection from the corporate data center to AWS" signals hybrid; "no data may leave company premises" signals private cloud; and "spread across AWS and another provider" signals multi-cloud.
Quick Decision Guide
When a scenario asks you to pick a model, scan for these signals. "Maximum agility, no hardware to buy, global reach" points to public cloud. "Keep regulated data in our own data center but use AWS for scale" points to hybrid cloud (Outposts, Direct Connect, or VPN). "Nothing may leave our premises" points to private cloud. For service models, "we want full control of the OS" is IaaS (EC2), "just deploy our app, don't make us manage servers" is PaaS (Elastic Beanstalk), and "ready-to-use software in a browser" is SaaS (WorkSpaces).
A company runs some workloads on its own servers in its own data center and uses AWS for other workloads. What deployment model is this?
Which AWS service brings AWS infrastructure and services to a customer's on-premises data center?
In the PaaS (Platform as a Service) model, which of the following is the customer responsible for?
Which AWS service is the clearest example of Infrastructure as a Service (IaaS)?