Techniques for deriving system architecture from security group relationships are described. One or more security group rules can be obtained for an application, the one or more security group rules controlling communication of one or more security groups. The one or more security group rules can be analyzed to determine placement data for the one or more security groups. The placement data can be provided to a placement service, and the placement service can be caused to deploy at least one virtual machine using the placement data.