Cloud services: service models, commitments, egress fees and FinOps

IaaS, PaaS and SaaS: the NIST definition of cloud services

The standard reference is NIST Special Publication 800-145, published in September 2011. It defines three service models. The line between them is what the customer still manages.^1,11

NIST also defines four deployment models: private, community, public and hybrid. A hybrid cloud joins two or more distinct clouds that stay separate but are bound by technology that lets data and applications move between them.¹⁵

Hybrid is the common case. In Flexera's 2026 State of the Cloud survey, a vendor-run poll of 753 technical professionals and executives taken in the winter of 2025, 73% of organizations reported running hybrid estates.^16,17

The shared responsibility model: who secures what

Each major provider publishes a split of security duties. AWS calls its side security of the cloud: the hardware, software, networking and facilities that run its services.¹⁸

AWS classes EC2 as IaaS, so customers who run EC2 instances manage the guest operating system, including updates and security patches.⁴

Some duties never move to the provider. Microsoft lists them for every deployment type: the customer's data, including classification, protection and encryption decisions, and user accounts and access.^5,19,20

Google says the shared responsibility model stops short of producing better security outcomes, and calls its own approach shared fate. Google's documentation also says many cloud security breaches are the direct result of misconfiguration.^21,22

Google says applying the model requires an in-depth understanding of each service, its configuration options and what the provider does to secure it.²³

Cloud commitment discounts: Savings Plans, Azure reservations, committed use discounts

AWS, Microsoft and Google discount usage or spend that is committed in advance. Each publishes a maximum discount, and each term runs one or three years.^6,7,8

An Azure virtual machine reservation covers compute costs only, not software, Windows, networking or storage charges.²⁹

A commitment is paid whether or not it is used. Google bills resource-based commitments monthly until the end of the term, regardless of use.²⁸

Flexera's 2026 survey found that fewer than half of organizations use any one commitment discount per cloud provider.³⁰

Cloud egress fees and the EU Data Act switching rules

The EU Data Act, Regulation (EU) 2023/2854, defines data egress charges as fees for extracting data through the network to another provider or to on-premises infrastructure. It counts them as switching charges. The regulation has applied since September 12, 2025.^10,31,32

What Article 29 and the switching chapter require of cloud providers:

• From January 11, 2024 to January 12, 2027, providers may charge reduced switching charges, capped at the costs directly linked to the switch.^33,34
• From January 12, 2027, providers may not impose any switching charges for the switching process.⁹
• Contracts must set a maximum notice period to start a switch of no more than two months, then a transitional period of at most 30 calendar days.^35,36
• Before signing, providers must give clear information on standard service fees, early termination penalties and any reduced switching charges.³⁷

The ban has limits. Switching charges exclude standard service fees and early termination penalties. Where two services run in parallel, providers may still charge egress, passing on their costs without exceeding them. The Article 29 ban also does not apply to services mostly custom-built for one customer and not offered at broad commercial scale.^38,39,40

Providers moved before the deadline. Google Cloud said on January 11, 2024 that customers leaving it could migrate data out with free network data transfer, globally. AWS said on March 5, 2024 that it would waive data transfer out to the internet for customers moving off AWS, through a request to AWS Support, paid as credits once approved.^{41,42,43,44,45}

Outside that program, AWS stated in 2024 that it gives 100 GB a month of free data transfer from its regions to the internet.⁴⁶

Cloud waste and the FinOps framework

Flexera attributes the rise in waste to cost complexity from AI and from new IaaS and PaaS services. The figures come from a vendor-run survey of 753 respondents.^17,47

The FinOps Foundation defines FinOps as an operational framework and cultural practice that creates financial accountability through collaboration between engineering, finance and business teams. Its framework runs in three phases: inform, optimize and operate.^51,52

Among its principles, everyone takes ownership of their technology usage, and business value drives technology decisions. The framework now applies beyond public cloud, to SaaS, licensing and data centers.^53,54

Teams use unit economics to tie spend to outcomes. In Flexera's 2026 survey, 49% tracked cost per service this way, up from 40% the year before.⁵⁵

Cloud sovereignty in procurement

The European Commission wrote its Cloud Sovereignty Framework to turn digital sovereignty into measurable procurement criteria. It measures providers against eight objectives, including legal, operational, supply chain and security considerations.^56,57

It grades them on Sovereignty Effectiveness Assurance Levels, from SEAL-0 to SEAL-4. SEAL-4 requires a full EU supply chain, from chips to software.⁵⁸

The Commission applied it in a sovereign cloud tender for EU institutions worth up to EUR 180 million over 6 years. It required SEAL-2, the data sovereignty level, and awarded four contracts to avoid lock-in to a single provider, as it announced on April 17, 2026.^59,60,61

One of the four awards went to a Proximus-led partnership using a technical environment based on Google Cloud technology, operated only by EU companies. It reached SEAL-2.^62,63

Where cloud services cost more than planned

• Overcommitting. Google Compute Engine commitments cannot be canceled, and AWS takes back only small Savings Plans bought within the past 7 days.^25,28
• Assuming a reservation covers the workload. Azure VM reservations do not cover software, Windows, networking or storage charges.²⁹
• Counting on the Data Act for multi-cloud. It ends switching charges, but in-parallel use can still carry egress charges at cost.^9,39
• Treating security as the provider's job. Google points to misconfiguration as the direct cause of many cloud breaches, and Microsoft leaves data and access with the customer in every model.^5,19,20,22
• Budgeting without forecasting. In Flexera's 2026 survey, 17% of respondents went over their public cloud budget, and Flexera calls accurate forecasting a persistent challenge.⁴⁹