User input including an application profile is received. The profile specifies a first server group, a second server group, and computing flows between the first and second server groups. User input identifying at least the first server group to include in a cloud chamber is received. Internet Protocol (IP) addresses assigned to virtual machines provisioned into the first and second server groups are obtained. Based on the computing flows specified in the application profile and the IP addresses assigned to the virtual machines, a set of firewall rules are generated for each virtual machine in the cloud chamber.