1. A system, comprising: one or more computing devices comprising at least a processor and memory, wherein the one or more computing devices are configured to: implement a first set of programmatic interfaces enabling a client to request a control operation associated with resources of one or more network-accessible services of a provider network; implement a second set of programmatic interfaces enabling a client to transmit a resource registration request from the client to the provider network, wherein the resource registration request indicates one or more resources located at a data center external to the provider network as candidate targets for a category of control operation requests received via the first set of programmatic interfaces, wherein the category of control operation requests are associated with at least a particular network-accessible service of the one or more network-accessible services; receive a particular resource registration request via the second set of programmatic interfaces, indicating a particular resource located at the data center external to the provider network; verify functionality of one or more modules of a management software stack installed at the particular resource; establish a secure network connection between a particular module of the one or more modules at the particular resource, and an administrative resource located within a data center of the provider network; and in response to a particular control operation request of the category of control operation requests received via a programmatic interface of the first set, transmit a control command from the administrative resource located within the data center of the provider network to the particular resource located at the data center external to the provider network via the secure network connection.