A method for providing a platform as a service, PaaS, service, wherein the method comprises: receiving, by a PaaS management system, a PaaS operation request sent by a first real tenant, wherein the PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource; determining, by the PaaS management system, information about a first virtual tenant corresponding to the first real tenant, wherein there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences; and controlling, by the PaaS management system, based on the PaaS operation request and the information about the first virtual tenant, an infrastructure as a service, IaaS, management system, by using the first virtual tenant, to process an IaaS operation corresponding to the PaaS operation; wherein the IaaS management system is a management system configured to process an IaaS operation in a cloud computing service architecture; the cloud computing service architecture provides an IaaS service for the first real tenant based on a first infrastructure resource group; only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group; the PaaS management system is a management system configured to process a PaaS operation in the cloud computing service architecture; the cloud computing service architecture provides a PaaS service for the first real tenant based on a second infrastructure resource group; and only the first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group. receiving, by a PaaS management system, a PaaS operation request sent by a first real tenant, wherein the PaaS operation request is used to indicate a PaaS operation intended for a PaaS resource; determining, by the PaaS management system, information about a first virtual tenant corresponding to the first real tenant, wherein there are one-to-one correspondences between real tenants and virtual tenants, and the first real tenant and the first virtual tenant are a pair in the one-to-one correspondences; and controlling, by the PaaS management system, based on the PaaS operation request and the information about the first virtual tenant, an infrastructure as a service, IaaS, management system, by using the first virtual tenant, to process an IaaS operation corresponding to the PaaS operation; wherein the IaaS management system is a management system configured to process an IaaS operation in a cloud computing service architecture; the cloud computing service architecture provides an IaaS service for the first real tenant based on a first infrastructure resource group; only the first real tenant has permission to manage an infrastructure resource in the first infrastructure resource group; the PaaS management system is a management system configured to process a PaaS operation in the cloud computing service architecture; the cloud computing service architecture provides a PaaS service for the first real tenant based on a second infrastructure resource group; and only the first virtual tenant has permission to manage an infrastructure resource in the second infrastructure resource group.