Controller for coordinating flow separation of intra-VPC or inter-VPC communications

A method for controlling network traffic flow separation between inter-VPC communications and intra-VPC communications, comprising:

• recovering information that identifies newly added, modified, or deleted endpoints within one or more public cloud networks, wherein the recovering comprises at least one of (a) polling an Application Programming Interface of a cloud service provider (CSP) to obtain an inventory of endpoints for the CSP for comparison to previously discovered endpoints and (b) subscribing to a CSP notification system that is configured to provide a current endpoint discovery inventory;
• based on recovered information associated with a newly discovered endpoint, determining a virtual region in which the newly discovered endpoint resides;
• generating one or more network security groups, each network security group operating as a virtual firewall that is associated with an identified endpoint;
• generating a first subset of rules for controlling a flow of a first message sourced by or destined to the newly discovered endpoint via native cloud constructs associated with a cloud service provider (CSP) underlay network when the newly discovered endpoint and another endpoint in communication with and operating as a destination and a source of the flow of the first message with the newly discovered endpoint reside within a first virtual region, the first subset of rules being applied by the network security group associated the identified endpoint for the first message sent from the source to the destination;
• generating a second subset of rules for controlling a flow of a second message sourced by or destined to the newly discovered endpoint via an overlay network providing communications between the first virtual region and a second virtual region when the newly discovered endpoint and another endpoint reside within different virtual regions, the second subset of rules being applied by a spoke gateway between the source and the destination, the second message comprising commands configured to activate an application instance in the second virtual region and return data after the application instance processes network traffic.

A non-transitory storage medium including logic that, upon execution, controls flow separation for inter-VPC communications and intra-VPC communications, comprising:

• endpoint discovery logic configured to identify newly added, modified, or deleted endpoints within a plurality of public cloud networks by at least one of (a) polling an Application Programming Interface of a cloud service provider (CSP) to obtain an inventory of endpoints for the CSP for comparison to previously discovered endpoints and (b) subscribing to a CSP notification system that is configured to provide a current endpoint discovery inventory;
• classification logic configured, based on recovered information associated with a newly discovered endpoint, to determine a virtual region in which the newly discovered endpoint resides;
• security group generation logic configured to generate one or more network security groups, each network security group operating as a virtual firewall that is associated with an identified endpoint;
• rule generation logic configured to (i) generate a first subset of rules for controlling a flow of a first message between a destination and a source via native cloud constructs associated with a cloud service provider (CSP) underlay network when the destination and source reside within a first virtual region, the first subset of rules being applied by the network security group associated the identified endpoint for the first message sent from the source to the destination and (ii) generate a second subset of rules for controlling a flow of a second message between the destination and the source via an overlay network providing communications between the first virtual region and a second virtual region when the destination and the source reside within different virtual regions, the second subset of rules being applied by a spoke gateway between the source and the destination, the second message comprising commands configured to activate an application instance in the second virtual region and return data after the application instance processes network traffic.