Techniques for distributed data processing application service networking in a cloud provider network are described. A first request to launch a virtual machine is received, the first request including a session network identifier to identify a network of a distributed data processing application cluster hosted by the provider network. The first virtual machine is launched. An internet protocol (IP) address of the first virtual machine is set, and the IP address of the first virtual machine is formed at least in part by combining an IP subnet assigned to the computer system with the session network identifier. A firewall controlling network traffic to and from the first virtual machine is configured to allow packets having a source or destination address that matches a portion of the IP address of the first virtual machine that includes the session network identifier.