AWS architecture diagram

AWS diagrams are conventional enough that people read them quickly, provided you use the conventions: account boundary outermost, then VPC, then availability zones, then subnets.

The official icon set ships with the draw.io editor, so no downloads or licences are involved.

#When to reach for one

• Design reviews and architecture decision records.

• Security reviews, where subnet and security group boundaries are the question.

• Handover to an operations team.

#How to draw it in Capable

#A worked example

The same architecture in text, when icons are not the point:

The source, which you can paste into a new diagram and edit:

flowchart TB
  U([Users]) --> CF[CloudFront]
  CF --> ALB[Application Load Balancer]
  subgraph VPC[VPC 10.0.0.0/16]
    subgraph PUB[Public subnets]
      ALB
      NAT[NAT gateway]
    end
    subgraph PRIV[Private subnets]
      ECS[ECS service]
      RDS[(RDS Postgres)]
    end
  end
  ALB --> ECS
  ECS --> RDS
  ECS --> S3[(S3 bucket)]
  ECS --> NAT --> INET([Internet])

#A few things that catch people out

• Show availability zones if resilience is part of the story, and leave them out if it is not.

• Security groups are not boundaries you can draw as boxes; annotate them instead.

• Region and account belong on the diagram. Most confusion in AWS diagrams is about which account something is in.

#Related

Draw the trust boundary.