Dynamic multi-cloud network provisioning

1 . A method, comprising:

identifying, by a process, source security groups associated with devices of a computer network;

determining, by the process and based on observation of packets sourced from the devices, a set of destinations of the packets sourced from the devices;

deducing, by the process, destination security groups associated with the devices based on the set of destinations used in the packets sourced from the devices;

identifying, by the process, cloud services currently utilized by the devices based on the source security groups and the destination security groups; and

establishing, by the process, a dynamic provisioning configuration for the computer network based on the cloud services currently utilized by the devices in the computer network.

2 . The method of claim 1 , further comprising:

determining operational workflow state of network resource devices that provide the cloud services; and

determining the dynamic provisioning configuration for the computer network based on the operational workflow state of the network resource devices.

3 . The method of claim 2 , wherein the operational workflow state is based on one or more of: a number of connected clients, a bandwidth consumption, link states, processing capacity and utilization, or memory capacity and utilization.

4 . The method of claim 1 , further comprising:

establishing a digital twin of the computer network;

testing the dynamic provisioning configuration on the digital twin; and

releasing the dynamic provisioning configuration to the computer network based on an outcome of testing.

5 . The method of claim 4 , wherein testing comprises:

attempting a plurality of dynamic provisioning configurations on the digital twin; and

selecting a best configuration of the plurality of dynamic provisioning configurations based on compliance with a network provisioning intent.

6 . The method of claim 4 , wherein testing comprises:

applying a plurality of potential traffic scenarios on the digital twin; and

selecting a particular dynamic provisioning configuration that is most responsive to the plurality of potential traffic scenarios.

7 . The method of claim 1 , further comprising:

provisioning the computer network based on the dynamic provisioning configuration by setting a corresponding network intent on network resource devices that provide the cloud services.

8 . The method of claim 1 , further comprising:

determining an end-to-end network state for the cloud services; and

determining the dynamic provisioning configuration for the computer network based on the end-to-end network state.

9 . The method of claim 8 , further comprising:

collecting telemetry data from the computer network for use in determining the end-to-end network state for the cloud services.

10 . The method of claim 1 , wherein the source security groups correspond to source group tags (SGTs), and the destination security groups correspond to destination group tags (DGTs).

11 . The method of claim 1 , wherein identifying the source security groups is based on network addresses and credentials of the devices.

12 . The method of claim 1 , wherein identifying the source security groups occurs during onboarding of the devices to the computer network.

13 . The method of claim 1 , wherein identifying the destination security groups comprises:

querying a service control plane for the destination security groups according to at least the set of destinations used in the packets sourced from the devices.

14 . The method of claim 13 , wherein querying comprises a Locator ID Separation Protocol (LISP) map server query.

15 . The method of claim 1 , wherein the cloud services comprise multi-cloud services.

16 . The method of claim 1 , further comprising:

triggering establishment of the dynamic provisioning configuration based on occurrence of a threshold-based event.

17 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

identifying source security groups associated with devices of a computer network;

determining, based on observation of packets sourced from the devices, a set of destinations of the packets sourced from the devices;

deducing destination security groups associated with the devices based on the set of destinations used in the packets sourced from the devices;

identifying cloud services currently utilized by the devices based on the source security groups and the destination security groups; and

establishing a dynamic provisioning configuration for the computer network based on the cloud services currently utilized by the devices in the computer network.

18 . The tangible, non-transitory, computer-readable medium of claim 17 , the process further comprising:

determining operational workflow state of network resource devices that provide the cloud services; and

determining the dynamic provisioning configuration for the computer network based on the operational workflow state of the network resource devices.

19 . The tangible, non-transitory, computer-readable medium of claim 17 , the process further comprising:

establishing a digital twin of the computer network;

testing the dynamic provisioning configuration on the digital twin; and

releasing the dynamic provisioning configuration to the computer network based on an outcome of testing.

20 . An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the one or more network interfaces and configured to execute one or more processes; and

a memory configured to store a process that is executable by the processor, the process comprising:

identifying source security groups associated with devices of a computer network;

determining, based on observation of packets sourced from the devices, a set of destinations of the packets sourced from the devices;

deducing destination security groups associated with the devices based on the set of destinations used in the packets sourced from the devices;

identifying cloud services currently utilized by the devices based on the source security groups and the destination security groups; and

establishing a dynamic provisioning configuration for the computer network based on the cloud services currently utilized by the devices in the computer network.