Resource sharing between cloud-hosted virtual networks

1 . A computer-implemented method comprising:

by a virtual network interlink service of a cloud provider network:

associating a first network address of a first virtual network in the cloud provider network with a second network address of a resource in a second virtual network, in the cloud provider network;

receiving a request to create a virtual network interface between the virtual network interlink service and the second virtual network to share resources of the second virtual network with other virtual networks, the virtual network interface having a third network address on the second virtual network;

creating the virtual network interface between the virtual network interlink service and the second virtual network;

receiving a message destined for the first network address of the first virtual network;

translating the first network address to the second network address of the resource in the second virtual network; and

sending the message to the resource at the second network address in the second virtual network via the virtual network interface having the third network address on the second virtual network.

2 . The computer-implemented method of claim 1 , further comprising, by the virtual network interlink service:

receiving a second request to associate the resource with the virtual network interface, the second request including an identification of the resource and an indication of the virtual network interface; and

updating service metadata to associate the resource with the virtual network interface.

3 . The computer-implemented method of claim 2 , wherein the identification of the resource in the second request is at least one of a resource name unique to the resource within the cloud provider network, a domain name, or a network address.

4 . The computer-implemented method of claim 2 , wherein the second request further includes a permissions policy that identifies at least one of a user account, a role, an organizational unit, or an organization associated with the first virtual network as having permissions to access the resource.

5 . The computer-implemented method of claim 1 , further comprising, by the virtual network interlink service:

receiving a first request to create a virtual network interface between the virtual network interlink service and the first virtual network to access shared resources in other virtual networks; and

creating the virtual network interface between the virtual network interlink service and the first virtual network, wherein the message destined for the first network address is received by the virtual network interlink service via the virtual network interface.

6 . The computer-implemented method of claim 5 , further comprising, by the virtual network interlink service:

receiving a request to identify resources shared with an identity, wherein the identity is at least one of a user account, a role, an organizational unit, or an organization of the first virtual network;

providing an identification of one or more resources shared with the identity that includes an identification of the resource connected to a second virtual network; and

receiving a request to add the resource to the virtual network interface, wherein the first network address of the first virtual network is associated with the resource connected to the second virtual network based at least in part on the request to add the resource to the virtual network interface.

7 . The computer-implemented method of claim 6 , further comprising, by the virtual network interlink service updating a name server of the first virtual network with a record to associate a domain name of the resource connected to the second virtual network with the first network address.

8 . The computer-implemented method of claim 5 , further comprising, by the virtual network interlink service:

storing a mapping of the virtual network interface, a source network address of the message, and a source port of the message to a port of another virtual network interface between the virtual network interlink service and the second virtual network, wherein sending the message to the resource at the second network address in the second virtual network includes replacing the source network address of the message with a network address of the other virtual network interface and replacing the source port with the port of the other virtual network interface;

receiving a second message from the resource, the second message having a destination network address of the network address of the other virtual network interface and a destination port of the port of the other virtual network interface;

identifying the stored mapping based on the destination port of the second message;

replacing the destination network address of the second message with the source network address of the message in the stored mapping and replacing the destination port of the second message with the source port of the message in the stored mapping; and

sending the second message to the first virtual network via the virtual network interface in the stored mapping.

9 . A system comprising:

a first one or more electronic devices to implement a virtual network interlink service in a cloud provider network, the virtual network interlink service including instructions that upon execution by one or more processors cause the virtual network interlink service to:

associate a first network address of a first virtual network in the cloud provider network with a second network address of a resource in a second virtual network in the cloud provider network;

receive a request to create a virtual network interface between the service and the second virtual network to share resources of the second virtual network with other virtual networks, the virtual network interface having a third network address on the second virtual network;

create the virtual network interface between the service and the second virtual network;

receive a message destined for the first network address of the first virtual network;

translate the first network address to the second network address of the resource in the second virtual network via the virtual network interface having the third network address on the second virtual network; and

send the message to the resource at the second network address in the second virtual network; and

a second one or more electronic devices to host the resource in the second virtual network.

10 . The system of claim 1 , the virtual network interlink service includes further instructions that upon execution by the one or more processors cause the virtual network interlink service to:

receive a second request to associate the resource with the virtual network interface, the second request including an identification of the resource and an indication of the virtual network interface; and

update service metadata to associate the resource with the virtual network interface.

11 . The system of claim 10 , wherein the identification of the resource in the second request is at least one of a resource name unique to the resource within the cloud provider network, a domain name, or a network address.

12 . The system of claim 10 , wherein the second request further includes a permissions policy that identifies at least one of a user account, a role, an organizational unit, or an organization associated with the first virtual network as having permissions to access the resource.

13 . The system of claim 9 , the virtual network interlink service includes further instructions that upon execution by the one or more processors cause the virtual network interlink service to:

receive a first request to create a virtual network interface between the service and the first virtual network to access shared resources in other virtual networks; and

create the virtual network interface between the service and the first virtual network, wherein the message destined for the first network address is received by the service via the virtual network interface.

14 . The system of claim 13 , the virtual network interlink service includes further instructions that upon execution by the one or more processors cause the virtual network interlink service to:

receive a request to identify resources shared with an identity, wherein the identity is at least one of a user account, a role, an organizational unit, or an organization of the first virtual network;

provide an identification of one or more resources shared with the identity that includes an identification of the resource connected to a second virtual network; and

receive a request to add the resource to the virtual network interface, wherein the first network address of the first virtual network is associated with the resource connected to the second virtual network based at least in part on the request to add the resource to the virtual network interface.

15 . The system of claim 14 , the virtual network interlink service includes further instructions that upon execution by the one or more processors cause the virtual network interlink service to update a name server of the first virtual network with a record to associate a domain name of the resource connected to the second virtual network with the first network address.

16 . The system of claim 14 , the virtual network interlink service includes further instructions that upon execution by the one or more processors cause the virtual network interlink service to receive a policy to associate with the resource, the policy granting access to the resource to at least one of an account, a role, an organization unit, or an organization associated with the second virtual network.

17 . The system of claim 14 , the virtual network interlink service includes further instructions that upon execution by the one or more processors cause the virtual network interlink service to:

store a mapping of the virtual network interface, a source network address of the message, and a source port of the message to a port of another virtual network interface between the virtual network interlink service and the second virtual network, wherein sending the message to the resource at the second network address in the second virtual network includes replacing the source network address of the message with a network address of the other virtual network interface and replacing the source port with the port of the other virtual network interface;

receiving a second message from the resource, the second message having a destination network address of the network address of the other virtual network interface and a destination port of the port of the other virtual network interface;

identifying the stored mapping based on the destination port of the second message;

replacing the destination network address of the second message with the source network address of the message in the stored mapping and replacing the destination port of the second message with the source port of the message in the stored mapping; and

sending the second message to the first virtual network via the virtual network interface in the stored mapping.