How do I generate an architecture diagram from Terraform?

Paste your Terraform configuration and the tool parses the resource blocks, resolves references between them, and draws the result with VPCs, availability zones, and subnets as nested boundaries. For an exact diagram, run "terraform show -json" and paste that instead: plan and state output has variables, modules, count, and for_each already resolved, so nothing is missing or miscounted.

Why does a diagram from raw Terraform say "best effort"?

Static Terraform cannot be fully evaluated without running a plan. Variables, locals, module contents, count, and for_each all resolve at plan time, so a diagram drawn from configuration alone may miss resources or draw one where several will exist. The tool states this explicitly, lists what it could not resolve, and marks plan or state JSON as exact fidelity.

Which input formats are supported?

Terraform HCL, Terraform plan and state JSON from "terraform show -json" (which also covers OpenTofu), Kubernetes manifests including multi-document YAML, and Docker Compose files. The format is detected automatically, so there is nothing to select.

How is the architecture score calculated?

Each finding subtracts points weighted by severity from a 0 to 100 score, which maps to an A to F grade. Critical findings such as a public database or disabled backups drop the score fastest. It uses the same weighting as the ops0 IAM Least-Privilege Analyzer so a grade means the same thing across both tools.

What export formats does the diagram support?

SVG and 2x PNG for slides and documents, Mermaid for GitHub and Notion, draw.io XML that opens in diagrams.net with the layout preserved, PlantUML for documentation pipelines, and a plain text outline for design docs. All are generated in the browser.

How is this different from draw.io, Lucidchart, or Cloudcraft?

Those tools are drawing surfaces: you place the shapes. This generator reads infrastructure code and derives the architecture from it, including which resources depend on which, so regions, VPCs, availability zones, and subnets become nested boundaries automatically. It also reviews the architecture it draws rather than only rendering it.

Does the diagram show my live cloud environment?

No. This tool only sees the code you paste, so it shows intended infrastructure at a point in time. Resources created manually in a console and never captured in code will not appear. Reading live cloud state, including unmanaged resources, is what the ops0 platform does through read-only discovery.

Is this cloud architecture diagram generator free?

Yes, completely free with no signup and no account. It runs entirely in your browser, so there is no usage limit and no cloud credentials are ever requested. It is one of the free tools ops0 publishes alongside its IAM Least-Privilege Analyzer.

Can I generate an AWS architecture diagram from code?

Yes. Paste Terraform, OpenTofu, or terraform show -json output that provisions AWS resources and the generator draws VPCs, subnets, availability zones, load balancers, ECS and EKS clusters, RDS and Aurora databases, S3, NAT gateways, and more, grouped into the boundaries they belong to. Azure, Google Cloud, and Oracle Cloud Infrastructure resources are supported the same way.

Can it visualize Terraform state?

Yes, and this is the most accurate option. Run terraform show -json against your state file and paste the JSON. Because state has every resource, count, and dependency already resolved, the diagram is exact rather than best-effort, and it reflects what is actually deployed rather than what the configuration intends.

Does it work with OpenTofu?

Yes. OpenTofu uses the same HCL syntax and the same JSON output format as Terraform, so both OpenTofu configuration and tofu show -json output are parsed identically.

Can I export the diagram to draw.io?

Yes. The generator exports draw.io XML that opens directly in diagrams.net with the layout preserved, so you can keep editing it there. It also exports SVG, 2x PNG, Mermaid, PlantUML, and a plain text outline.

Is this a Cloudcraft, Hava, or Lucidchart alternative?

It serves the same goal of a clear cloud architecture diagram, but the approach is different. Cloudcraft, Hava, Lucidchart, and draw.io are drawing tools where you place and connect shapes yourself. This generator reads your infrastructure code and derives the architecture, including boundaries and dependencies, automatically, and it runs free in the browser with nothing uploaded.

Can I edit the diagram after it is generated?

You can pan, zoom, and explore it in the browser, and select any finding to highlight the resources it affects. For freeform editing, export to draw.io and the diagram opens in diagrams.net with its layout intact, ready to rearrange or annotate.

Free tool · runs in your browser

Cloud architecture diagram generator

Name: ops0
Author: ops0

Turn Terraform, Kubernetes, or Docker Compose into an architecture diagram in seconds. ops0 detects regions, VPCs, availability zones, and subnets, draws them as nested boundaries, and flags the structural problems hiding inside — free, entirely in your browser, nothing uploaded.

100% client-side

No signup

Nothing uploaded

Diagram in seconds

Open on desktop

The diagram generator needs a real screen and a keyboard to paste infrastructure code and read the architecture. Open this page on a desktop browser to use it.

Infrastructure code

100% in your browser. Nothing is uploaded. Open DevTools then Network and see for yourself.

</>

Paste infrastructure code and hit Generate. Regions, VPCs, availability zones, and subnets are detected automatically and drawn as nested boundaries.

Worked example

AWS three-tier input, diagram, and findings.

This synthetic sample includes a load balancer, application services, and a database. It deliberately includes public SSH access, an unencrypted public database, and disabled database backups so you can examine the findings. It is a visualization example, not a deployment template or a customer environment.

Generated AWS sample architecture with network boundaries, application services, and a database; inferred connections require review — Actual output from this tool: 9 resource nodes, 8 boundaries, and 10 structural findings. Connections describe references or inferred relationships, not measured network traffic.

Download sample input Download generated SVG Read the findings JSON

Use the AWS three-tier sample button in the generator above to try it yourself. Only resources represented by the supplied file can appear.

What it does

A cloud architecture diagram generator that understands the infrastructure.

Reads infrastructure, not shapes

Terraform HCL, `terraform show -json` plan and state, Kubernetes manifests, and Docker Compose are parsed into a resource graph with real dependencies, not hand-placed boxes.

Boundaries detected automatically

Regions, VPCs and VNets, availability zones, subnets, clusters, namespaces, and Compose networks become nested containers, so the diagram reflects how the estate is actually structured.

Architecture findings, not just a picture

Single-AZ databases, public database endpoints, security groups open to 0.0.0.0/0, overlapping CIDRs, missing NAT, absent WAF, and unattached volumes are detected as you paste.

Every finding explains itself

Each result carries why it was raised, the risk it creates, the best practice that resolves it, and the impact of fixing it. Severity rolls up into an A to F architecture score.

Honest about fidelity

Static Terraform cannot resolve every variable, module, count, or for_each. JSON provides resolved instances, but a diagram is still limited to the supplied snapshot and supported resources. Review parser notices and inferred connections.

Exports that stay editable

SVG and 2× PNG for slides, Mermaid for GitHub and Notion, draw.io XML that opens with the layout intact, PlantUML for docs pipelines, and a plain text outline.

Supported inputs

Generate a diagram from Terraform, Kubernetes, or Docker Compose

The format is detected automatically, so there is nothing to configure. Paste code or drop a file — everything is parsed locally in your browser.

Terraform diagram generator

Terraform · OpenTofu · HCL

Paste Terraform or OpenTofu HCL and the generator parses every resource block, resolves references between them, and lays out VPCs, subnets, and availability zones as nested boundaries. Because raw HCL cannot resolve variables, modules, count, or for_each without a plan, the diagram is marked best-effort and tells you exactly what it could not resolve.

Diagram from Terraform state or plan

terraform show -json

Paste terraform show -json output from your state or a saved plan to visualize resolved resource instances. This can capture more detail than raw HCL. It shows the supplied snapshot, not a live cloud scan: check state freshness, unsupported types, parser notices, and connections inferred by the tool.

Kubernetes architecture diagram

YAML · multi-document manifests

Paste one manifest or a whole multi-document YAML file. Deployments, StatefulSets, Services, and Ingress are grouped by namespace, and the edges are derived the way Kubernetes actually wires them: Service label selectors to workloads, Ingress backends to Services, and HorizontalPodAutoscalers to their scale targets.

Docker Compose diagram

docker-compose.yml

Paste a compose file and each service, network, and volume is drawn with the links between them — depends_on ordering, volume mounts, and network membership. Published ports and credential-shaped environment variables are flagged as findings.

Why it is different

Choose the diagram workflow that fits your source.

Drawing tools

A manually maintained drawing is useful for proposed designs, annotations, and resources that have no code representation. Its author decides what to include and keeps it current as the architecture changes.

This generator

Generate a point-in-time diagram from the infrastructure files you provide, with supported boundaries and structural findings. No cloud account access is needed. Some relationships are inferred; confirm them against the source.

Live cloud discovery

For resources missing from code and changes made outside Terraform, use a workflow that reads connected cloud accounts. Compare access permissions, refresh frequency, coverage, and export options before choosing one.

Detected automatically

Regions and availability zonesVPCs, VNets, VCNs, and subnetsClusters, namespaces, and resource groupsPublic database endpointsSecurity groups open to 0.0.0.0/0Single-AZ databases and disabled backupsOverlapping CIDR rangesMissing or single NAT gatewaysLoad balancers with no WAFPublic Kubernetes API endpointsPrivileged containers and mutable image tagsUnattached volumes and unused public IPs

Snapshot vs continuous

This tool is the snapshot. ops0 is the control.

This free tool

Point-in-time diagram from code you paste
No signup, no cloud credentials, no access to your account
Runs in your browser, nothing is uploaded
Structural findings, an architecture score, and exports

ops0, continuous

Reads live cloud read-only, so the graph reflects what is actually running
Includes console-created resources that appear in no module
Blast radius before a change, drift after it
Routes the fix through policy, cost, approval, pull request, and audit

Common questions

Yes. The diagram generator runs entirely in your browser. Your Terraform, Kubernetes, and Docker Compose files are never uploaded to any server, and no cloud credentials are requested or used. You can confirm this in your browser DevTools Network tab.

Single-AZ databases, publicly accessible database endpoints, security groups allowing 0.0.0.0/0, disabled backups, missing encryption at rest, overlapping CIDR ranges, missing or single NAT gateways, load balancers with no WAF, public Kubernetes API endpoints, privileged containers, mutable image tags, missing resource limits and health probes, single-replica deployments, and unattached volumes or unassociated public IPs.

This draws the code you pasted.
ops0 draws the cloud you actually run.

ops0 reads live cloud read-only, so the graph includes the resources nobody ever put in a module, stays drift-aware as things change, and shows the blast radius of a change before anyone approves it.

Why static infrastructure diagrams go stale

See the live Resource Graph