The present disclosure relates to computer-implemented methods, software, and systems for dynamic configuration of access restrictions on an application in relation to databases running in a cloud environment. An instruction to run an application is received by a virtual machine (VM) manager. The VM manager retrieves from a database manager information identifying databases accessible to the application. The databases are associated with at least one account of the application. The VM manager sends configuration instructions to dynamically configure a particular VM at which the application is to run. The particular VM is configured based on the configuration instructions that are generated based on the retrieved information and include rules for accessing the one or more databases identified in the retrieved information. The rules identify each database by its respective network address, and wherein the rules cause the particular VM to allow the application to access the one or more databases.