Mirroring virtual network traffic

A system comprising:

• one or more processors;
• and
• computer-readable media storing instructions that, when executed by the one or more processors, cause the system to:
• establish, in association with a tenant subscription, a role-based mirroring policy capable of being applied within a virtual network hosted by a cloud-based platform, the role-based mirroring policy defining at least:
• a first role for an owner of a virtual machine to execute a workload, on the virtual machine, that causes data packets to be communicated to or from the virtual machine;
• and
• a second role for an authorized agent to monitor the workload;
• receive a remote call via an application programming interface (API) configured as part of the cloud-based platform, wherein the remote call requests application of the role-based mirroring policy to the workload executing on the virtual machine, wherein the remote call includes user information associated with a user requesting application of the role-based mirroring policy;
• verify, based on the user information, that the user requesting application of the role-based mirroring policy is associated with the second role;
• configure at least one component in a host node of the cloud-based platform that hosts the virtual machine to apply the role-based mirroring policy;
• determine, by the at least one component, that an individual data packet is communicated to or from the virtual machine;
• create, by the at least one component and based on application of the role-based mirroring policy, a copy of the individual data packet that is communicated to or from the virtual machine;
• and
• stream the copy of the individual data packet to another virtual machine in the virtual network, or in a peer virtual network hosted by the cloud-based platform, so that network analytics can be performed on data traffic.