A system for providing policy-controlled communication between a plurality of different cloud computing environments includes a user interface that receives configuration settings to be applied to a plurality of first instances within a first cloud computing environment and a plurality of second instances within a second cloud computing environment. The system also includes a plurality of collectors that retrieve information from the first cloud computing environment and the second cloud computing environment, and a controller that determines policies for the plurality of first instances and the plurality of second instances as functions of the configuration settings and the information. Further, the system includes a configurator that applies the policies to the plurality of first instances and the plurality of second instances; a first tester that inspects operations of the plurality of first instances and detects violations of the policies; and an enforcer that responds to the detected violations.