A system, comprising: one or more computing devices configured to: implement a first set of programmatic interfaces enabling a client to request a control operation associated with resources of one or more network-accessible services of a provider network; implement a second set of programmatic interfaces enabling a client to submit a resource registration request, wherein the resource registration request indicates one or more resources (991A, 991B, 911R, 911S) located at a data center external to the provider network as candidate targets for a category of control operation requests received via the first set of programmatic interfaces, wherein the category of control operation requests are associated with at least a particular network-accessible service of the one or more network-accessible services; receive a particular resource registration request via the second set of programmatic interfaces, indicating a particular resource located at the data center external to the provider network; verify capability of one or more modules of a management software stack (314A, 324A) installed at the particular resource for responding to the category of control operation requests; establish a secure network connection between a particular module of the one or more modules at the particular resource, and an administrative resource located within a data center of the provider network; and in response to receiving a particular control operation request of the category of control operation requests via a programmatic interface of the first set, transmit a control command from the administrative resource to the particular resource via the secure network connection. implement a first set of programmatic interfaces enabling a client to request a control operation associated with resources of one or more network-accessible services of a provider network; implement a second set of programmatic interfaces enabling a client to submit a resource registration request, wherein the resource registration request indicates one or more resources (991A, 991B, 911R, 911S) located at a data center external to the provider network as candidate targets for a category of control operation requests received via the first set of programmatic interfaces, wherein the category of control operation requests are associated with at least a particular network-accessible service of the one or more network-accessible services; receive a particular resource registration request via the second set of programmatic interfaces, indicating a particular resource located at the data center external to the provider network; verify capability of one or more modules of a management software stack (314A, 324A) installed at the particular resource for responding to the category of control operation requests; establish a secure network connection between a particular module of the one or more modules at the particular resource, and an administrative resource located within a data center of the provider network; and in response to receiving a particular control operation request of the category of control operation requests via a programmatic interface of the first set, transmit a control command from the administrative resource to the particular resource via the secure network connection.