1. A system, comprising: one or more computers configured to provide a web service via a web services interface, wherein the web service is accessible via the interface to create a plurality of different web services resources for a plurality of different owners, wherein each web services resource is accessible via the interface; a storage medium configured to store instructions; and one or more processors configured to access said storage medium, wherein said instructions are executable by at least one of said one or more processors to implement a web services access control system, wherein said web services access control system is configured to: provide access control for owners of web services resources to specify access control rights for the owners' respective web services resources; receive, via the web services interface, grant requests from different owners of different web services resources accessible via the web service to grant different access types to different principals for the different web services resources of the respective owners; in response to receiving said grant requests, generate in a data store an access control entry for each request that corresponds to a principal, a resource, and an access type specified in the grant request; receive requests from different principals via the web services interface, wherein each request specifies one or more access operations to be performed; for each received request: identify a web services resource; identify a principal; and determine whether an access control entry exists in said data store that comprises: a resource identifier matching said web services resource identified; a principal identifier matching said principal identified; and an access type identifying one or more access types sufficient to perform said one or more access operations specified by said received request; and based at least in part on a determination that said access control entry does not exist for a given received request, deny said given received request.