Micro-segmentation of virtual computing elements

One or more non-transitory computer readable storage media having program instructions stored thereon for micro-segmenting virtual computing elements based on applications running thereon, the program instructions, when read and executed by a processing system, direct the processing system to:

• identify one or more multi-tier applications comprising a plurality of virtual machines, wherein each application tier of the one or more multi-tier applications comprises at least one of the plurality of virtual machines, and wherein the identifying comprises querying the virtual machines for process information that identifies processes executing thereon and automatically identifying the one or more multi-tier applications based on the process information from the virtual machines;
• maintain information about the one or more multi-tier applications, wherein the information at least indicates a security group for each virtual machine of the plurality of virtual machines;
• identify communication traffic flows between virtual machines of the plurality of virtual machines;
• identify one or more removable traffic flows of the communication traffic flows based, at least in part, on the information;
• and
• block the one or more removable traffic flows.

A system for micro-segmenting virtual computing elements based on applications running thereon, the system comprising:

• one or more non-transitory computer readable storage media;
• a processing system operatively coupled with the one or more computer readable storage media;
• and
• program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
• identify one or more multi-tier applications comprising a plurality of virtual machines, wherein each application tier of the one or more multi-tier applications comprises at least one of the plurality of virtual machines, and wherein the identifying comprises querying the virtual machines for process information that identifies processes executing thereon and automatically identifying the one or more multi-tier applications based on the process information from the virtual machines;
• maintain information about the one or more multi-tier applications, wherein the information at least indicates a security group for each virtual machine of the plurality of virtual machines;
• identify communication traffic flows between virtual machines of the plurality of virtual machines;
• identify one or more removable traffic flows of the communication traffic flows based, at least in part, on the information;
• and
• block the one or more removable traffic flows.