receiving a discovery graph comprising a plurality of services and at least one application programming interface (API) dependency, wherein the plurality of services comprises a first service running on a first virtual private cloud (VPC) environment and a second service running on a second VPC environment, wherein the first VPC environment is distinct from the second VPC environment;

determining whether the second service is permitted to receive an initial communication from the first service based upon the at least one API dependency included in the discovery graph; and

in response to determining the second service is permitted to receive the initial communication from the first service, establishing a virtual private connection between the first VPC environment and the second VPC environment and establishing a first rule for a firewall between the first service and the second service, the first rule allowing the second service to receive the initial communication from the first service.