1. A resource provider, comprising: a plurality of stored machine images; source manifests corresponding respectively to the stored machine images, wherein each source manifest indicates executable components of the corresponding stored machine image; verifiable signatures corresponding respectively to the source manifests; one or more processors configured to perform actions comprising: receiving, using a application programming interface, a plurality of machine images; storing the plurality of machine images as the plurality of stored machine images; using a specified one of the stored machine images, creating a virtual machine associated with the specified one of the stored machine images; installing an inventory module to execute on the virtual machine associated with the specified one of the stored machine images; executing the inventory module in conjunction with a startup or booting of the virtual machine associated with the specified one of the stored machine images; generating, by the inventory module, a source manifest corresponding to the specified one of the stored machine images; signing the source manifest corresponding to the specified one of the stored machine images to generate a verifiable signature; receiving a request to create a virtual machine based at least in part on the specified one of the stored machine images; inventorying, by the inventory module, the specified one of the stored machine images to identify executable components of the specified one of the stored machine images; and validating the specified one of the stored machine images by (a) verifying the signature of the source manifest corresponding to the specified one of the stored machine images and (b) comparing the identified executable components of the specified one of the stored machine images with the source manifest corresponding to the specified one of the stored machine images.