1. A system, comprising: a processor configured to: receive a rule to be applied to network traffic associated with members of a specific dynamic address group, wherein membership of a computing resource in the specific dynamic address group is determined at least in part by performing a query using a set of one or more filters; receive virtual machine information associated with a first virtual machine instance executing on a host machine; determine, based at least in part on matching a portion of the received virtual machine information with the set of one or more filters, that the first virtual machine instance is a member of the dynamic address group; and in response to the determination, apply the rule to network traffic associated with the first virtual machine instance; and a memory coupled to the processor and configured to provide the processor with instructions.