1. A method comprising: at a telephony network platform system that includes a cloud manager, a database, and a monitor module, the cloud manager including a pub-sub messaging system, the cloud manager using the pub-sub messaging system for communication with a remote third-party Internet-based multi-tenant computing platform via the Internet, the multi-tenant computing platform being constructed to provide at least one machine group that includes a plurality of machines for implementing a cloud-based telephony platform that provides one of a plurality of telephony platform services including a voice communication service, a messaging communication service and a video communication service: at the cloud manager, receiving a first user instruction to create a first telephony platform machine group that includes a plurality of machines of the remote Internet-based multi-tenant computing platform, the first user instruction being received from an outside system via a REST API of the cloud manager, the outside system being an external system of a user of the remote multi-tenant computing platform; responsive to receipt of the first user instruction, the cloud manager storing a first machine group record in the database in accordance with the first user instruction, the first machine group record comprising a group configuration and a group definition, the group configuration comprising a set of rules, the group definition defining the machines of the first machine group, in a domain specific language, the first machine group record relating to an initial state of the first machine group as defined by at least one of the group definition and the group configuration, the initial state of the first machine group record specifying first telephony platform software for a first telephony platform service, the first telephony platform service being one of the voice communication service, the messaging communication service, and the video communication service; the cloud manager establishing a cloud manager publication channel with the pub-sub messaging system, the pub-sub messaging system being constructed to provide the first telephony platform software via the Internet to each machine of the first machine group, establishing the cloud manager publication channel comprising: the cloud manager storing a security key of the first machine group and a security key for each machine of the first machine group, the security key for each machine of the first machine group being supplied at boot time of the respective machine and provided to the cloud manger via the pub-sub messaging system, the security key of each machine being used to securely identify the machine; at the cloud manager, receiving a second user instruction to start the first telephony platform machine group, the second user instruction being received from the outside system via the REST API of the cloud manager; at the cloud manager and responsive to receipt of the second user instruction to start the telephony platform machine group, the cloud manager launching the first telephony platform machine group at the remote computing platform by using the pub-sub messaging system, launching the first telephony platform machine group comprising: for each machine of the first telephony platform machine group: encrypting the first telephony platform software of the first machine group record with the stored security key of the machine, providing the encrypted first telephony platform software to the machine via the cloud manager publication channel, wherein responsive to the machine decrypting the encrypted first telephony platform software by using the security key, the machine executes the first telephony platform software, the first telephony platform software being constructed to control the machine to provide at least a portion of the first telephony platform service; at the cloud manager, the cloud manager controlling the monitor module to generate a monitoring loop to check status of the first telephony platform machine group at the remote computing platform, the monitor module comprising a rules engine for stateless application of the set of rules of the group configuration of the first telephony platform machine group; the monitor module checking actual status of the first telephony platform machine group at the remote computing platform, and comparing the actual status with a desired state of the first telephony platform machine group as indicated by the first machine group record stored in the database, comparing the actual status with the desired state comprising: determining whether each machine of the first telephony platform machine group is executing telephony platform software specified by the first machine group record; and at the cloud manager, receiving a third user instruction to change operation of the machines of the first telephony platform machine group, the third user instruction being received from the outside system via the REST API of the cloud manager; at the cloud manager and responsive to receipt of the third user instruction to change operation of the machines, the cloud manager updating the first machine group record in the database in accordance with the third user instruction, updating the first machine group record comprising: updating the first machine group record to specify second telephony platform software for a second telephony platform service, the second telephony platform service being one of the plurality of telephony platform services that is different from the first telephony platform service; responsive to a determination by the monitor module that at least one machine of the first telephony platform machine group is executing the first telephony platform software and the first machine group record specifies the second telephony platform software, the monitor module adjusting the actual status of the first telephony platform machine group at the remote computing platform to match the desired state by using the rules engine to apply the set of rules of the group configuration, adjusting the actual status comprising: for each machine of the first telephony platform machine group: encrypting the second telephony platform software of the first machine group record with the stored security key of the machine, providing the encrypted second telephony platform software to the machine via the cloud manager publication channel to replace the first telephony platform software with the second telephony platform software at the machine, the machine decrypting the encrypted second telephony platform software by using the security key of the machine and the machine replacing execution of the first telephony platform software with execution of the second telephony platform software to provide at least a portion of the second telephony platform service, wherein responsive to the machine decrypting the encrypted second telephony platform software by using the security key, the machine executes the second telephony platform software.