> It's a nightmare to manage on premise but it works really well in the cloud with firewalls allowing traffic based on instance tags.

It's not though. Subnetting and firewalling are like the foundation of any corporate network.