This question is only for knowledge purpose.

When a Pega-managed cloud is provisioned for customer (considering all the infrastructure & middleware was done from Pega support side), does it allow Customers to access middleware/AWS configurations for the Cloud instance?

From the documents I visited(link given below), it is understood that for Client-Managed Cloud, customer has the complete flexibility to architect & orchestrate the infrastructure for Cloud. But in that Client generally hosts Pega instance in their own AWS Enterprise Cloud. 

But I am looking for a scenario, where Client wants the cloud to be hosted in Pega Infrastructure, but also get full/partial access to server (like installing/uninstalling digital certificates, bouncing the serves, install encryptions for all web services etc. ) or middleware or set up own security protocol in the cloud etc.? If partial/full control is given to customer, what kind of Infra structure configurations can they control?

https://docs-previous.pega.com/client-managed-cloud-deployments-prior-pega-platform-82/client-managed-cloud-deployments-prior-pega-platform-82

Any suggestion in this regard will be helpful.