Cloud architecture
Cloud architecture examples
Three complete cloud diagrams, one for each of Azure, AWS, and Google Cloud, each drawn from a checked pattern. It is for anyone who wants to read a finished diagram before writing one, human or AI agent.
TL;DR
| Question | Answer |
|---|---|
| Where do these come from? | Each example is a pattern from the architecture patterns guide. It validates with no warnings, passes the text-fit check, and renders in light and dark at desktop and phone width. |
| Can I copy one? | Yes. The source is in the block above each picture. Every label and value is a placeholder, so rename them to fit the request. |
| Where do I start from a pattern? | Call find_pattern with the request in plain words, then draw_from_pattern with the values to change. |
| Which features do they show? | Typed groups, a provider icon on every service, stack marks, overlays, event edges, and a level edge between a primary and a replica. |
1. Web application on Azure
A single-page app served from storage behind a CDN, services on an app plan, a database, secrets, a queue, sign-in, monitoring, and a delivery pipeline. It uses typed groups, a provider icon on every service, stack marks, and dotted edges for events.
Plotwork
flow "Web application on a cloud" provider=azure direction=down desc="Visitors load a single-page app from storage through a content delivery network and sign in through an identity service. The app calls an API on an application plan, which stores uploads, reads a database, and hands slow work to a queue that a background worker drains. A pipeline builds and deploys the API, and a monitoring service collects telemetry."
node visitors client "Visitors" sub="Browsers"
group edge "Edge" type=edge { node cdn gateway "Content delivery" icon=azure:cdn}
group sign-in "Sign-in" type=identity-boundary { node idp identity "Identity service" icon=azure:entra-id}
group files "Storage" type=storage-account { node site storage "Web app files" icon=azure:blob-storage stack=simple:react,simple:typescript node uploads storage "Uploads" icon=azure:blob-storage}
group plan "Application plan" type=service-plan { node api service "Orders API" icon=azure:app-service stack=simple:nodedotjs}
group messaging "Messaging" type=messaging { node jobs queue "Job queue" icon=azure:service-bus}
node worker function "Background worker" icon=azure:functions stack=simple:nodedotjsnode db database "Database" icon=azure:sql-database
group delivery "Delivery pipeline" type=ci-cd { node repo step "Source code" icon=lucide:git-branch node build step "Build pipeline" icon=azure:devops}
group monitoring "Monitoring" type=observability { node telemetry service "Metrics and logs" icon=azure:monitor}
visitors -> cdn : "HTTPS"visitors -> idp : "sign in" role=identitycdn -> sitecdn -> api : "API calls"api -> uploads : "store files" role=dataapi -> jobs : "enqueue" role=asyncjobs ..> worker : "event"worker -> db : "writes" role=dataapi -> db : "reads" role=datarepo -> buildbuild ..> api : "deploys image"api ..> telemetry : "telemetry"Nodes:
- Visitors (Browsers), client
- Background worker, function, stack: nodedotjs
- Database, database
- Edge: Edge
- Content delivery, gateway
- Identity: Sign-in
- Identity service, identity
- Storage: Storage
- Web app files, storage, stack: react, typescript
- Uploads, storage
- Service plan: Application plan
- Orders API, service, stack: nodedotjs
- Messaging: Messaging
- Job queue, queue
- CI and CD: Delivery pipeline
- Source code, step
- Build pipeline, step
- Observability: Monitoring
- Metrics and logs, service
Connections:
- Visitors to Content delivery: HTTPS
- Visitors to Identity service (identity line): sign in
- Content delivery to Web app files
- Content delivery to Orders API: API calls
- Orders API to Uploads (stored data line): store files
- Orders API to Job queue (asynchronous line): enqueue
- Job queue to Background worker (dotted): event
- Background worker to Database (stored data line): writes
- Orders API to Database (stored data line): reads
- Source code to Build pipeline
- Build pipeline to Orders API (dotted): deploys image
- Orders API to Metrics and logs (dotted): telemetry
2. Two-zone network on AWS
A network in a region with two zones. Each zone has a public, a private, and an isolated subnet. Load balancers and a scaling group span both zones with overlays, and the primary database replicates to its replica across the zones.
Plotwork
flow "Two-zone network with a replicated database" provider=aws direction=down desc="Traffic enters through an internet gateway and reaches load balancers in the public subnets of two availability zones. Each balancer sends it to an application server in a private subnet, and the two servers form one scaling group. Each server writes to a database in an isolated subnet, and the primary database replicates to the replica in the other zone."
node internet external "Internet"
group cloud "Cloud" type=cloud { node igw gateway "Internet gateway" icon=aws:internet-gateway
group vpc "Application network" type=network sub="10.0.0.0/16" { group za "Zone A" type=zone { group pub-a "Public subnet A" type=public-subnet sub="10.0.0.0/24" { node lb-a gateway "Load balancer A" icon=aws:elb } group app-a "Private subnet A" type=private-subnet sub="10.0.1.0/24" { node web-a service "Application server A" icon=aws:ec2 } group db-za "Isolated subnet A" type=isolated-subnet sub="10.0.2.0/24" { node db-a database "Primary database" icon=aws:rds } } group zb "Zone B" type=zone { group pub-b "Public subnet B" type=public-subnet sub="10.0.10.0/24" { node lb-b gateway "Load balancer B" icon=aws:elb } group app-b "Private subnet B" type=private-subnet sub="10.0.11.0/24" { node web-b service "Application server B" icon=aws:ec2 } group db-zb "Isolated subnet B" type=isolated-subnet sub="10.0.12.0/24" { node db-b database "Replica database" icon=aws:rds } } }}
overlay balancer "Load balancer" type=edge members=lb-a,lb-boverlay scaling "Scaling group" type=scale-group members=web-a,web-b
internet <-> igwigw -> lb-aigw -> lb-blb-a -> web-alb-b -> web-bweb-a -> db-aweb-b -> db-bdb-a ..> db-b : "replication"Nodes:
- Internet, external
- Cloud: Cloud
- Internet gateway, gateway
- Virtual network: Application network (10.0.0.0/16)
- Availability zone: Zone A
- Public subnet: Public subnet A (10.0.0.0/24)
- Load balancer A, gateway
- Private subnet: Private subnet A (10.0.1.0/24)
- Application server A, service
- Isolated subnet: Isolated subnet A (10.0.2.0/24)
- Primary database, database
- Public subnet: Public subnet A (10.0.0.0/24)
- Availability zone: Zone B
- Public subnet: Public subnet B (10.0.10.0/24)
- Load balancer B, gateway
- Private subnet: Private subnet B (10.0.11.0/24)
- Application server B, service
- Isolated subnet: Isolated subnet B (10.0.12.0/24)
- Replica database, database
- Public subnet: Public subnet B (10.0.10.0/24)
- Availability zone: Zone A
Overlays:
- Edge overlay: Load balancer, around Load balancer A, Load balancer B
- Scale group overlay: Scaling group, around Application server A, Application server B
Connections:
- Internet with Internet gateway
- Internet gateway to Load balancer A
- Internet gateway to Load balancer B
- Load balancer A to Application server A
- Load balancer B to Application server B
- Application server A to Primary database
- Application server B to Replica database
- Primary database to Replica database (dotted): replication
3. Serverless API on Google Cloud
A function behind an API gateway with a database, a queue for slow work, and storage for files, drawn with Google Cloud icons.
Plotwork
flow "Serverless API" provider=gcp direction=down desc="A client calls an API gateway, which checks the caller with a sign-in service and routes each request to one of three functions. The functions keep records in a managed database and files in object storage, and send logs and metrics to monitoring."
node client client "Client app" sub="Web or mobile"node gateway gateway "Orders API" sub="API Gateway" icon=gcp:api-gateway
group fns "Functions" type=app-tier icon=gcp:cloud-functions { node create function "Create order" sub="Cloud Functions" icon=gcp:cloud-functions node list function "List orders" sub="Cloud Functions" icon=gcp:cloud-functions node get function "Get order" sub="Cloud Functions" icon=gcp:cloud-functions}
group signin "Sign-in" type=identity-boundary { node auth identity "User directory" sub="Identity Platform" icon=gcp:identity-platform}
group data "Data stores" type=data-tier icon=gcp:firestore { node bucket storage "Order files" sub="Cloud Storage" icon=gcp:cloud-storage node db database "Orders database" sub="Firestore" icon=gcp:firestore}
group obs "Monitoring" type=observability { node monitor service "Logs and metrics" sub="Cloud Monitoring" icon=gcp:cloud-monitoring}
client -> gateway : "HTTPS"gateway -> create : "POST /orders"gateway -> list : "GET /orders"gateway -> get : "GET /orders/id"gateway -> auth : "verify token" role=identitycreate -> bucket : "upload" role=datacreate -> db : "write" role=datalist -> dbget -> dbget ..> monitor : "logs and metrics"Nodes:
- Client app (Web or mobile), client
- Orders API (API Gateway), gateway
- Application tier: Functions
- Create order (Cloud Functions), function
- List orders (Cloud Functions), function
- Get order (Cloud Functions), function
- Identity: Sign-in
- User directory (Identity Platform), identity
- Data tier: Data stores
- Order files (Cloud Storage), storage
- Orders database (Firestore), database
- Observability: Monitoring
- Logs and metrics (Cloud Monitoring), service
Connections:
- Client app to Orders API: HTTPS
- Orders API to Create order: POST /orders
- Orders API to List orders: GET /orders
- Orders API to Get order: GET /orders/id
- Orders API to User directory (identity line): verify token
- Create order to Order files (stored data line): upload
- Create order to Orders database (stored data line): write
- List orders to Orders database
- Get order to Orders database
- Get order to Logs and metrics (dotted): logs and metrics
See also
| Doc | Why |
|---|---|
| Architecture patterns | Every pattern, with its slots and the advice on what to keep, rename, and split |
| Cloud architecture | The five-step recipe |
| Group types | The types the examples use, each drawn |
| Marks, second lines, and overlays | The marks and overlays the examples use |
| Writing diagrams with an agent | The validate-and-fix loop |