1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause one or more processors to perform acts comprising: causing a computing service to operate in a normal operation mode that implements rule sets that prevent unauthorized network access to one or more customer virtual machines operated by the computing service; causing the computing service to transition operation from the normal operation mode to a learning mode that at least temporarily disables at least some of the rule sets for a virtual machine and allows software, without previous configuration, to cause the virtual machine to obtain network access; recording, in a data log, information about traffic sent to or from the virtual machine in response to operations caused by the software; creating rules, based at least in part on the information about the traffic sent to or from the virtual machine in the data log, to include in the rule sets, the created rules to allow subsequent traffic to or from the virtual machine that is similar in at least one respect to the recorded information about the traffic; causing the computing service to terminate the learning mode and resume operation in the normal operation mode; and enforcing the rule sets that include the created rules.