That seems pretty reasonable, and maybe even necessary. If they're copying your code around or distributing it to users, they may need those rights.

"..solely as necessary for Cloud Foundry to provide the Service..." is the key point, there.

Just so I understand you correctly, does that imply that their intention is to prevent being sued if they need to change your code in order for it to work on the platform, in the event of say, an upgrade of their core infrastructure? If so, that makes a lot more sense. Thanks.

I think their intention is to not be sued if they need to redistribute your code in order to run the platform. This means they might need to copy it to other instances, send copyrightable assets (javascript, css, images) to users as is, etc.

But yes, it would also give them the right to change things as necessary to run the service. It could cover installing additional plugins like Heroku does, or munging config files, or even doing things like partially compiling source to some target.

By default, they really don't have the legal right to do a bunch of those things. Some of them are vague and arguable since hosting doesn't exactly fit into copyright law all the time, so companies will sometimes put in clauses like this that explicitly grant them rights that might otherwise seem like common sense. It may be obvious to you and me, but it's now spelled out in an agreement "just in case".

For example, if you upload a Rails 3 application that (as per the default) disables serving javascript and html files, CloudFoundry (and any PaaS that runs Rack basically) have to flip that switch for you. I believe that clause just makes sure such things are permitted. For Java apps, you have to generate XML files containing whatever the values turned out to be at runtime, etc.

Why are you concerned about this specifically?

It appears they're gaining the authorization required to run your app.

Seems reasonable to me. I think terms like this are essential elements for a PaaS offering.