Micro-segmentation of virtual computing elements

1. A computer-implemented method of micro-segmenting virtual computing elements based on applications running thereon, the method comprising:

identifying one or more multi-tier applications comprising a plurality of virtual machines, wherein each application tier of the one or more multi-tier applications comprises at least one of the plurality of virtual machines, wherein the identifying comprises querying the virtual machines for process information that identifies processes executing thereon and automatically identifying the one or more multi-tier applications based on the process information from the virtual machines;

maintaining information about the one or more multi-tier applications, wherein the information at least indicates a security group for each virtual machine of the plurality of virtual machines;

identifying communication traffic flows between virtual machines of the plurality of virtual machines;

identifying one or more removable traffic flows of the communication traffic flows based, at least in part, on the information; and

blocking the one or more removable traffic flows.

2. The method of claim 1 , further comprising:

presenting the one or more removable traffic flows to a user;

receiving confirmation from the user that the removable traffic flows should be removed; and

wherein blocking the removable traffic flows occurs in response to the confirmation.

3. The method of claim 2 , wherein presenting the removable traffic flows comprises:

presenting a graphical display that visually groups virtual machines of the plurality of virtual machines into respective application tiers and respective security groups; and

displaying the communication traffic flows between the virtual machines.

4. The method of claim 3 , wherein the graphical display labels the application tiers and the security groups.

5. The method of claim 3 , wherein presenting the removable traffic flows further comprises:

highlighting the removable traffic flows of the displayed communication traffic flows.

6. The method of claim 1 , wherein blocking the one or more removable traffic flows comprises implementing one or more firewall rules that block the one or more removable traffic flows.

7. The method of claim 1 wherein each of multi-tier applications comprises three tiers, wherein the three tiers include a web tier, application tier, and database tier.

8. The method of claim 7 , wherein the one or more removable traffic flows comprise traffic flows other than those between the web tier and the application tier, the application tier and the database tier, and an external system and the web tier.

9. The method of claim 1 , wherein identifying the communication traffic flows further comprises:

in one or more computing systems hosting the plurality of virtual machines, identifying communication traffic going into and out of each virtual machine of the plurality of virtual machines.

10. The method of claim 1 , wherein the information further includes an identifier for each of the one or more multi-tier applications.

11. One or more non-transitory computer readable storage media having program instructions stored thereon for micro-segmenting virtual computing elements based on applications running thereon, the program instructions, when read and executed by a processing system, direct the processing system to:

identify one or more multi-tier applications comprising a plurality of virtual machines, wherein each application tier of the one or more multi-tier applications comprises at least one of the plurality of virtual machines, and wherein the identifying comprises querying the virtual machines for process information that identifies processes executing thereon and automatically identifying the one or more multi-tier applications based on the process information from the virtual machines;

maintain information about the one or more multi-tier applications, wherein the information at least indicates a security group for each virtual machine of the plurality of virtual machines;

identify communication traffic flows between virtual machines of the plurality of virtual machines;

identify one or more removable traffic flows of the communication traffic flows based, at least in part, on the information; and

block the one or more removable traffic flows.

12. The one or more computer readable storage media of claim 11 , wherein the program instructions further direct the processing system to:

present the one or more removable traffic flows to a user;

receive confirmation from the user that the removable traffic flows should be removed; and

wherein the program instructions direct the processing system to block the removable traffic flows in response to the confirmation.

13. The one or more computer readable storage media of claim 12 , wherein to present the removable traffic flows the program instructions direct the processing system to at least:

present a graphical display that visually groups virtual machines of the plurality of virtual machines into respective application tiers and respective security groups; and

display the communication traffic flows between the virtual machines.

14. The one or more computer readable storage media of claim 13 , wherein the graphical display labels the application tiers and the security groups.

15. The one or more computer readable storage media of claim 13 , wherein to present the removable traffic flows the program instructions further direct the processing system to at least:

highlight the removable traffic flows of the displayed communication traffic flows.

16. The one or more computer readable storage media of claim 11 , wherein to block the one or more removable traffic flows the program instructions direct the processing system to at least:

implement one or more firewall rules that block the one or more removable traffic flows.

17. The one or more computer readable storage media of claim 11 wherein each of multi-tier applications comprises three tiers, wherein the three tiers include a web tier, application tier, and database tier.

18. The one or more computer readable storage media of claim 17 , wherein the one or more removable traffic flows comprise traffic flows other than those between the web tier and the application tier, the application tier and the database tier, and an external system and the web tier.

19. The one or more computer readable storage media of claim 11 , wherein to identify the communication traffic flows the program instructions direct the processing system to at least:

use one or more computing systems hosting the plurality of virtual machines to identify communication traffic going into and out of each virtual machine of the plurality of virtual machines.

20. A system for micro-segmenting virtual computing elements based on applications running thereon, the system comprising:

one or more non-transitory computer readable storage media;

a processing system operatively coupled with the one or more computer readable storage media; and

program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:

identify one or more multi-tier applications comprising a plurality of virtual machines, wherein each application tier of the one or more multi-tier applications comprises at least one of the plurality of virtual machines, and wherein the identifying comprises querying the virtual machines for process information that identifies processes executing thereon and automatically identifying the one or more multi-tier applications based on the process information from the virtual machines;

maintain information about the one or more multi-tier applications, wherein the information at least indicates a security group for each virtual machine of the plurality of virtual machines;

identify communication traffic flows between virtual machines of the plurality of virtual machines;

identify one or more removable traffic flows of the communication traffic flows based, at least in part, on the information; and

block the one or more removable traffic flows.