Securing an injection of a workload into a virtual network hosted by a cloud-based platform

A system comprising:

• one or more processors;
• and
• computer-readable media storing instructions that, when executed by the one or more processors, cause the system to:
• receive, as part of a workload executing on a virtual machine in a first virtual network of a cloud-based platform that is operated by a resource provider, a call into a host node supporting a portion of a second virtual network that is operated by a tenant of the cloud-based platform, the call including an encoded string representation of a binary token;
• determine that the encoded string representation of the binary token included in the call matches an encoded string representation of a binary token accessed via a publication service of the cloud-based platform;
• and
• allow the workload to be injected into the portion of the second virtual network based at least in part on the determining that the encoded string representation of the binary token included in the call matches the encoded string representation of the binary token accessed via the publication service.

A system comprising:

• one or more processors;
• and
• computer-readable media storing instructions that, when executed by the one or more processors, cause the system to:
• receive, as part of a workload executing on a virtual machine in a first virtual network of a cloud-based platform, a call into a host node supporting a portion of a second virtual network that is operated by a tenant of the cloud-based platform, the call including an identifier of a network interface controller used to make the call;
• determine that the identifier included in the call corresponds to a name of a resource provider that has been delegated control of the portion of the second virtual network;
• and
• allow the workload to be injected into the portion of the second virtual network based at least in part on the determining that the identifier included in the call corresponds to the name of the resource provider that has been delegated control of the portion of the second virtual network.