I would argue no - what would be the difference between him spinning up VMs and handing off the credentials and hosting a public web service on it? The VMs are

I would argue no - what would be the difference between him spinning up VMs and handing off the credentials and hosting a public web service on it? The VMs are still his responsibility - he is just allowing other people to use them.