Looks like things are driving towards a kind of "cloud escrow" or shared-management model. You grant a managed-serivces/saas company access to your cloud account to spin up resources. They do the day-to-day management, but you could bring it in-house or go to another firm at any time if they are no longer a good partner. In practice you get a SaaS product. But you actually have the assets of self-hosting.