1. A system, comprising one or more computing devices configured to: receive an indication of a client account of a provider network, wherein the client account is associated with respective sets of resources of one or more network-accessible services of the provider network; obtain metadata pertaining to the respective sets of resources from the one or more network-accessible services, wherein at least a portion of the metadata is obtained using a private administrative mechanism of the provider network; generate a graph representation of the metadata comprising a plurality of nodes and a plurality of edges linking respective pairs of nodes, wherein a first node and a second node of the plurality of nodes represent a respective first and second resource associated with the client account, and an edge between the first node and the second node represents a configuration relationship established on behalf of the client between the first and second resources; provide, via a programmatic interface, a customizable visualization of resources and configuration relationships included in the graph representation, wherein the programmatic interface enables submissions of one or more configuration modification requests via graphical interactions; and in response to an authorized graphical interaction received via the programmatic interface, issue one or more commands to a service of the one or more network-accessible services to implement a particular configuration modification associated with at least one resource of the first and second resources.