1. A system, comprising: one or more computing devices configured to: implement a first set of programmatic interfaces enabling a client to request a control operation associated with resources of one or more network-accessible services of a provider network; implement a second set of programmatic interfaces enabling a client to submit a resource registration request, wherein the resource registration request indicates one or more resources located at a data center external to the provider network as candidate targets for a category of control operation requests received via the first set of programmatic interfaces, wherein the category of control operation requests are associated with at least a particular network-accessible service of the one or more network-accessible services; receive a particular resource registration request via the second set of programmatic interfaces, indicating a particular resource located at the data center external to the provider network; verify functionality of one or more modules of a management software stack installed at the particular resource; establish a secure network connection between a particular module of the one or more modules at the particular resource, and an administrative resource located within a data center of the provider network; and in response to a particular control operation request of the category of control operation requests received via a programmatic interface of the first set, transmit a control command from the administrative resource to the particular resource via the secure network connection.