Generate AWS Architecture Diagrams from Terraform or CloudFormation
Your Terraform state already knows exactly what your architecture looks like. Every load balancer, ECS service, security group, and RDS instance is declared in code, versioned, and reviewed — yet the architecture diagram in your wiki is six months stale. This guide covers three ways to close that gap: reading the templates yourself, running dedicated diagram tools like InfraMap and cfn-diagram, and using an AI generator that turns a plain-English resource description into an editable draw.io diagram. It ends with a worked example that converts an ALB + ECS + RDS Terraform snippet into a diagram you can actually maintain.
Why generate diagrams from infrastructure code instead of drawing them by hand?
Hand-drawn architecture diagrams rot. The moment someone merges a PR that adds an SQS queue or swaps a NAT gateway for VPC endpoints, the diagram in Confluence is wrong, and nobody notices until an incident review or a new hire asks why the diagram shows a service that was decommissioned in March. Infrastructure as code, by contrast, cannot drift from reality — terraform plan enforces it. Deriving the diagram from the code inherits that accuracy.
There are also audiences that code cannot serve. Security reviewers, SOC 2 auditors, new engineers, and non-technical stakeholders all need to understand data flow and network boundaries, and none of them want to read 4,000 lines of HCL across twelve modules. A diagram compresses the answer to "what talks to what, and across which subnet boundary" into something a reviewer can absorb in thirty seconds.
The practical question is workflow cost. If regenerating the diagram takes an afternoon, it will not happen after every change. The approaches below are ordered roughly by how automated they are — and, honestly, by how much control you give up over the visual result.
Can you read the architecture directly from Terraform or CloudFormation?
Yes, and every engineer does it implicitly during code review. In Terraform, the architecture is encoded in resource blocks and their references: an aws_lb_target_group attached to an aws_lb listener, an aws_ecs_service whose load_balancer block points at that target group, an aws_db_instance whose security group allows ingress from the ECS tasks' security group. Follow the references and you have the topology. In CloudFormation, the same information lives in Ref and Fn::GetAtt calls between resources in the Resources section.
The problem is scale and implicit relationships. A real production stack spans modules, workspaces, and data sources; security group rules — the edges that matter most in an architecture diagram — are often defined far from the resources they connect, or created dynamically with for_each. Terraform's built-in terraform graph command outputs the full dependency graph in DOT format, and you can render it with Graphviz (terraform graph | dot -Tsvg > graph.svg), but the result includes every provider, variable, and output node. For anything beyond a toy stack it is an unreadable hairball, not an architecture diagram.
Manual reading remains the right move for one thing: verifying whatever a tool or AI generates. Treat the template as the source of truth and the diagram as a rendering of it, and spot-check the edges — especially security group relationships — before the diagram goes into a design review.
What tools turn Terraform into an architecture diagram?
InfraMap (cycloidio/inframap) is the most direct option. It reads a Terraform state file or HCL and prunes the raw dependency graph down to meaningful infrastructure — dropping variables, providers, and glue resources — then emits DOT or PNG. Run inframap generate terraform.tfstate | dot -Tpng > infra.png and you get a legible graph for AWS, Azure, GCP, or OpenStack resources. The limitation is that output is a Graphviz graph, not a styled architecture diagram: no AWS icons, no VPC grouping boxes, and limited layout control.
Terraformer (GoogleCloudPlatform/terraformer) solves a different problem: it goes the opposite direction, importing existing cloud resources into Terraform code. It matters here because of the pipeline it enables for accounts that were built by hand — run Terraformer to get HCL from the live account, then feed that HCL to InfraMap or an AI generator. If your infrastructure is not in code yet, this is the honest first step; no diagram tool can read a console-built account directly.
Rover (im2nguyen/rover) and Pluralith are worth knowing as alternatives — both visualize Terraform plan output interactively in a browser, which is excellent for reviewing a specific change but produces an artifact you cannot easily embed in a design doc or edit afterward. That editability gap is the recurring weakness of all state-derived tools: the output is a rendering, and the moment you need to annotate a data flow, add a planned-but-not-built component, or fix the layout for a presentation, you are stuck.
How do you generate a diagram from a CloudFormation template?
cfn-diagram (mhlabs/cfn-diagram) is the standout CLI for CloudFormation, SAM, and CDK-synthesized templates. Install it with npm i -g @mhlabs/cfn-diagram, then run cfn-dia draw.io -t template.yaml to emit a draw.io file, or cfn-dia html -t template.yaml for an interactive vis.js graph with resource-type filtering. Because the draw.io output is standard XML, you can open it in diagrams.net or AIDrawIO and keep editing — cfn-diagram gives you a starting layout rather than a locked image, which is exactly the property the Terraform tools above lack.
AWS's own answer is Infrastructure Composer (formerly Application Composer) in the console: import an existing CloudFormation or SAM template and it renders cards for each resource with connections between them, and you can edit the template visually. It replaced the retired CloudFormation Designer. It works well for serverless stacks, but the visualization stays inside the AWS console — exporting a clean diagram for a design doc still means screenshots.
The honest comparison: if you want a maintained, text-based diagram alongside your code, Mermaid architecture diagrams are lightweight and render in GitHub READMEs, but you write them by hand and they do not read your templates. Lucidchart can import from a live AWS account (not from templates) on paid plans. draw.io gives full control with official AWS shape libraries but starts from a blank canvas. Each trades automation against visual quality in a different place.
Can AI generate an AWS diagram from a resource description?
The newest approach skips parsing entirely: describe the resources and their relationships in plain English — or paste an excerpt of the template itself — into an AI diagram generator, and it produces a proper architecture diagram with AWS icons, VPC and subnet grouping, and labeled edges. This works because the hard part of IaC-to-diagram conversion was never extracting the resource list; it was layout, grouping, and knowing that an aws_lb with type "application" should be drawn as the Elastic Load Balancing icon inside public subnets. Language models trained on AWS architectures handle that mapping directly.
The trade-off versus InfraMap or cfn-diagram is determinism for quality. A parser will never miss a resource that exists in state, but produces a bare graph; an AI generator produces a presentable, editable diagram but renders what you described, so you review it against the template — the same verification you would apply to a hand-drawn diagram. For design docs, onboarding material, and architecture reviews, that trade usually favors the AI output, because those diagrams need curation anyway: you rarely want all 200 resources, you want the 15 that explain the system.
A useful middle path is combining approaches: run terraform state list to enumerate exactly what exists, paste that list with a one-line note about relationships into the generator, and you get accuracy from state plus layout from AI.
Worked example: from an ALB + ECS + RDS Terraform snippet to a finished diagram
Take a minimal three-tier service. The Terraform, condensed: resource "aws_lb" "web" with load_balancer_type = "application" and subnets = module.vpc.public_subnets; resource "aws_ecs_service" "api" with launch_type = "FARGATE", desired_count = 3, and network_configuration placing tasks in module.vpc.private_subnets; and resource "aws_db_instance" "db" with engine = "postgres" and multi_az = true, reachable only from the ECS tasks' security group. Three resources, two edges, one VPC boundary.
The plain-English prompt that reproduces it: "AWS architecture diagram: an internet-facing Application Load Balancer in two public subnets forwards HTTP traffic to an ECS Fargate service running 3 tasks in private subnets. The tasks connect to a Multi-AZ RDS PostgreSQL instance in database subnets. Show the VPC boundary, both availability zones, and label the security group rule from ECS to RDS on port 5432. Use official AWS icons."
Paste that into aidrawio.com/en/tools/terraform-diagram-generator and it returns a draw.io-compatible diagram using the official AWS icon set, with the ALB, Fargate service, and RDS instance grouped into their subnets. Because the output is draw.io XML, you can rearrange nodes, add the ElastiCache cluster you are planning next quarter, and export as XML, SVG, or PNG for the design doc; version history tracks the diagram as the architecture evolves. The free tier runs 5 generations per hour on Gemini 3 Flash with no account, and subscribers get Claude Opus 4.8, Claude Sonnet 5, or Gemini 3.1 Pro for larger, denser stacks. When the infrastructure changes, update the prompt and regenerate — a thirty-second loop instead of a stale wiki page.
Essayez gratuitement Terraform generator
Visualize Terraform infrastructure. Describe in plain English, get draw.io XML in seconds. No account required.
Questions frequentes
Can I automatically generate a diagram from a Terraform state file?
Yes. InfraMap reads terraform.tfstate or HCL directly and outputs a pruned infrastructure graph as DOT or PNG. For a styled diagram with official AWS icons and subnet grouping, run terraform state list and paste the resource list into an AI diagram generator, then verify the edges against your state.
How do I convert a CloudFormation template into a diagram?
The fastest CLI route is cfn-diagram: install with npm i -g @mhlabs/cfn-diagram, then run cfn-dia draw.io -t template.yaml to get an editable draw.io file, or cfn-dia html for an interactive graph. AWS Infrastructure Composer in the console can also import and visualize an existing template, but exporting a clean image for docs still means screenshots.
Does terraform graph produce a usable architecture diagram?
Rarely. It emits the complete dependency graph — including every variable, provider, and output node — so anything beyond a small config renders as an unreadable hairball in Graphviz. Use InfraMap to prune the graph down to real infrastructure, or an AI generator when you need a presentation-quality result.
Are diagrams generated from infrastructure as code always accurate?
Parser-based tools like InfraMap and cfn-diagram show exactly what exists in state or the template, but miss context like planned components or external SaaS dependencies. AI-generated diagrams render what you described, so spot-check them against the code — especially security group edges. Either way, treat the IaC as the source of truth and the diagram as a rendering.
What is the best free tool to generate AWS architecture diagrams automatically?
It depends on your input. cfn-diagram (CloudFormation/SAM/CDK templates) and InfraMap (Terraform state) are both free and open source. If you want an editable diagram with official AWS icons from a plain-English or pasted-resource description, AIDrawIO's free Terraform diagram generator allows 5 generations per hour with no account required.