National Institute of Standards and Technology (NIST). (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). U.S. Department of Commerce. In the IaaS definition, it states the consumer "has control over operating systems, storage, and deployed applications," distinguishing this control from the provider-managed infrastructure. (See Section 2, page 3).
DOI: https://doi.org/10.6028/NIST.SP.800-145
Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A., Stoica, I., & Zaharia, M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). University of California at Berkeley. The report defines IaaS as providing virtualized resources where the user can load "their own copies of operating systems and applications." (See Section 3.1, page 5).
Zhang, Q., Cheng, L., & Boutaba, R. (2010). "Cloud computing: state-of-the-art and research challenges." Journal of Internet Services and Applications, 1(1), 7-18. This article clarifies that in IaaS, "The user can deploy and run his own applications and OSs on the rented infrastructure," reinforcing that the OS is the user's responsibility. (See Section 2.1, page 8).
DOI: https://doi.org/10.1007/s13174-010-0007-6