Abstract: The present disclosure is directed to a monitoring system for rapidly updating a service architecture of a widely distributed service operated by an Infrastructure-as-a-Service (IaaS) tenant but deployed on a set of virtual resources controlled by an independent IaaS provider. The set of virtual resources provided to the IaaS tenant by the IaaS provider is selected by the IaaS provider and can change rapidly in both size and composition (i.e., the virtual resources are “ephemeral”). The monitoring system can infer from infrastructure metadata and/or system-level metric data how the virtual resources should be organized into groups, clusters and hierarchies. The monitoring system can also update the service architecture frequently to capture an expected rate of change of the resources, e.g., every five minutes. The monitoring system can then run analytics based on this inferred service architecture to report on service operation.