IaaS (manage OS/apps, vendor manages hardware): EC2, Azure VMs.
PaaS (manage apps/data, vendor manages platform): Azure App Service.
SaaS (vendor manages everything, you manage users/data): Office 365, Salesforce.
Shared responsibility: more abstraction = vendor manages more security. IaaS = most control, most responsibility. SaaS = least control, least responsibility (but still responsible for data, access, user management). The customer ALWAYS owns their data regardless of service model.