Many companies and other organizations operate computer networks that interconnect numerous computing systems to support their operations, such as with the computing systems being co-located (e.g., as part of a local network) or instead located in multiple distinct geographical locations (e.g., connected via one or more private or public intermediate networks).  For example, data centers housing significant numbers of interconnected computing systems have become commonplace, such as private data centers that are operated by and on behalf of a single organization, and public data centers that are operated by entities as businesses to provide computing resources and services to customers.  Some public data center operators provide network access, power, and secure installation facilities for hardware owned by various customers, while other public data center operators provide “full service” facilities that also include hardware resources made available for use by their customers.  However, as the scale and scope of typical data centers has increased, the tasks of provisioning, administering, and managing the physical computing resources have become increasingly complicated. 
The advent of virtualization technologies for commodity hardware has provided benefits with respect to managing large-scale computing resources for many customers with diverse service needs, allowing various computing resources and services to be efficiently and securely shared by multiple customers.  For example, virtualization technologies may allow a single physical computing machine to be shared among multiple users by providing each user with one or more virtual machines hosted by the single physical computing machine, with each such virtual machine being a software simulation acting as a distinct logical computing system that provides users with the illusion that they are the sole operators and administrators of a given hardware computing resource, while also providing application isolation and security among the various virtual machines.  Furthermore, some virtualization technologies are capable of providing virtual resources that span two or more physical resources, such as a single virtual machine with multiple virtual processors that spans multiple distinct physical computing systems.  As another example, virtualization technologies may allow data storage hardware to be shared among multiple users by providing each user with a virtualized data store which may be distributed across multiple data storage devices, with each such virtualized data store acting as a distinct logical data store that provides users with the illusion that they are the sole operators and administrators of the data storage resource. 
In many environments, various types of distributed applications may be implemented using virtualized compute and storage resources that may span large numbers of devices potentially spread across multiple data centers.  For example, a distributed relational database service may be implemented using a set of virtual compute and storage servers of a provider network that are allocated to the service provider, allowing clients to access the database service from other compute servers of the provider network that are allocated to the clients, where for example the client's web tier or application tier may be executed.  At least three parties may be involved in the provision of such services: the clients, the service provider implementing the service, and the provider network operator responsible for the underlying infrastructure resources, each of which may have access rights to various resources involved in the provision of the services.  As the sophistication of the services increases, the number of different types of physical and logical resources used to implement a given service may also increase, potentially requiring new access control techniques to ensure efficient service provision and to reduce the likelihood of service interruptions caused by unintentional configuration errors or by malicious users. 
While embodiments are described herein by way of example for several embodiments and illustrative drawings, those skilled in the art will recognize that embodiments are not limited to the embodiments or drawings described.  It should be understood, that the drawings and detailed description thereto are not intended to limit embodiments to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope as defined by the appended claims.  The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description or the claims.  As used throughout this application, the word “may” is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must).  Similarly, the words “include,” “including,” and “includes” mean including, but not limited to.