IaaS vs PaaS vs SaaS: Where the Costs Actually Hide

The list price of a cloud service is the one number you can safely ignore. When we compare total cost across IaaS, PaaS, and SaaS for the same workload, the visible line items — VM hours, per-seat fees — are rarely what separates the options. The gaps come from egress charges, idle capacity, and the labor each model quietly leaves on your side of the fence. Here is where the costs actually sit, with a worked example you can rebuild in a spreadsheet.

What do the three models mean in practice?

NIST Special Publication 800-145 gives the standard definitions. With IaaS you rent compute, storage, and networking and run everything above the hypervisor yourself. With PaaS you deploy code onto a managed runtime and the provider handles the operating system and middleware. With SaaS you use a finished application and manage only your data, users, and settings. Each step up transfers work to the provider — and prices that work into the fee. The cost question is never “which is cheaper” in the abstract; it is “cheaper for this workload, at this team size, over this time horizon.”

Where do IaaS costs hide?

Compute is the visible part. In our experience, four other lines grow faster than teams expect:

• Egress. Data flowing into most clouds is free; data flowing out is billed per gigabyte. A common published first-tier list price for internet egress is around $0.09 per GB, and backup restores, analytics exports, and cross-region replication all count.
• Idle and oversized resources. A VM billed by the hour costs the same at 4% utilization as at 90%. The FinOps Foundation’s framework calls this out directly: rightsizing and shutting down idle capacity is usually the first optimization worth doing.
• Snapshots and secondary storage. Backups accumulate. Nobody deletes them, and each generation is a separate billed object.
• Your own labor. Patching, monitoring, and on-call for the OS layer stay with you — see our breakdown of the shared responsibility model for exactly what that includes.

Where do PaaS and SaaS costs hide?

PaaS instances carry a higher unit price than raw VMs because the provider operates the platform underneath. The trap is different: platform-specific services are convenient to adopt and awkward to leave, so the real cost may appear years later as switching cost. Watch the per-request and per-execution meters too — they are small numbers multiplied by very large counts.

SaaS moves the meter to seats and tiers. The recurring surprises we see: seat counts that grow with every hire and never shrink after departures; features gated behind a tier jump that doubles the per-user price; API rate limits that force an upgrade once you integrate anything; and per-gigabyte storage overages. SaaS is also the model where exporting your own data on exit can be genuinely painful, which is a cost even though it never appears on an invoice.

Worked example: one workload, three ways

Take a hypothetical internal application serving 40 staff, with 500 GB of stored data and 3 TB of monthly egress to branch offices. We checked the arithmetic below in Python before publishing; the unit prices are illustrative round numbers, so substitute your own quotes.

Model	Assumptions	Monthly cost
IaaS	4 VMs at $0.20/hr × 730 h = $584; 3,000 GB egress at $0.09 = $270; 500 GB storage at $0.023 = $11.50	$865.50 + your ops labor
PaaS	2 managed instances at $0.35/hr × 730 h = $511; same storage and egress	$792.50 + reduced ops labor
SaaS	40 users × $28 per seat, storage and egress included	$1,120, labor mostly gone

Over 36 months the IaaS path totals $31,158 and the SaaS path $40,320 — a gap of about $9,162. That gap buys you out of patching, upgrades, and on-call for this app. If covering those duties in-house costs you more than roughly $255 a month in engineer time, SaaS wins on total cost despite the higher sticker. That is the comparison that matters, and it is invisible if you only read price pages.

How should you compare models for your own workload?

Price the full three-year picture, not month one: unit prices, egress at your actual data volumes, growth in seats or instances, the labor each model leaves with you, and a realistic exit cost. The FinOps Foundation’s FOCUS specification exists because even reading one provider’s bill is hard; normalize everything into one spreadsheet before deciding. When two options land close together, we weight the one that is easier to leave.

FAQ

Is IaaS always the cheapest option?

No. IaaS has the lowest unit prices but leaves the most work with your team, and unmanaged VMs are the easiest place to accumulate idle spend. For small teams, the labor line often erases the price advantage.

Why are egress fees such a big deal?

Because they are asymmetric and back-loaded. Moving data in is free, so nothing warns you at adoption time; the charge arrives when you export, integrate, or leave. Any workload that ships data out regularly should have egress modeled before signing.

Can we mix models?

Most organizations already do — a SaaS CRM next to PaaS-hosted apps on an IaaS foundation is a normal stack. Mixing is fine as long as each workload’s model is a decision rather than an accident, and someone owns the combined bill.

When you are ready to put real quotes behind these estimates, you can compare IaaS, PaaS, and SaaS providers in our directory.