# AWS architecture diagram

AWS diagrams are conventional enough that people read them quickly, provided you use the conventions: account boundary outermost, then VPC, then availability zones, then subnets.

The official icon set ships with the draw.io editor, so no downloads or licences are involved.

---

## When to reach for one

* Design reviews and architecture decision records.
* Security reviews, where subnet and security group boundaries are the question.
* Handover to an operations team.

---

## How to draw it in Capable

| **Route** | **Use when**                                                  |
| --------- | ------------------------------------------------------------- |
| draw.io   | The official AWS icon set, with the standard grouping shapes. |
| D2        | Text-first diagrams that change with every sprint.            |

---

## A worked example

The same architecture in text, when icons are not the point:

![AWS architecture diagram](https://help.gocapable.com/images/att1418068040.svg)

The source, which you can paste into a new diagram and edit:

```
flowchart TB
  U([Users]) --> CF[CloudFront]
  CF --> ALB[Application Load Balancer]
  subgraph VPC[VPC 10.0.0.0/16]
    subgraph PUB[Public subnets]
      ALB
      NAT[NAT gateway]
    end
    subgraph PRIV[Private subnets]
      ECS[ECS service]
      RDS[(RDS Postgres)]
    end
  end
  ALB --> ECS
  ECS --> RDS
  ECS --> S3[(S3 bucket)]
  ECS --> NAT --> INET([Internet])
```

---

## A few things that catch people out

* Show availability zones if resilience is part of the story, and leave them out if it is not.
* Security groups are not boundaries you can draw as boxes; annotate them instead.
* Region and account belong on the diagram. Most confusion in AWS diagrams is about which account something is in.

---

## Related

[Azure architecture diagramResource groups, subscriptions and hierarchy.](https://help.gocapable.com/diagrams/azure-architecture-diagram.html)

[Google Cloud architectureProjects, services and the lines between them.](https://help.gocapable.com/diagrams/google-cloud-architecture.html)

[ExamplesWorking diagrams you can copy.](https://help.gocapable.com/diagrams/examples.html)

---

_Draw the trust boundary._