# Cloud architecture examples

> Page: https://docs.plotwork.dev/cloud-architecture/examples. Index of every page: https://docs.plotwork.dev/llms.txt

Three complete cloud diagrams, one for each of Azure, AWS, and Google Cloud, each drawn from a checked pattern. It is for anyone who wants to read a finished diagram before writing one, human or AI agent.

## TL;DR

| Question | Answer |
|---|---|
| Where do these come from? | Each example is a pattern from the [architecture patterns guide](https://docs.plotwork.dev/architecture-patterns.md). It validates with no warnings, passes the text-fit check, and renders in light and dark at desktop and phone width. |
| Can I copy one? | Yes. The source is in the block above each picture. Every label and value is a placeholder, so rename them to fit the request. |
| Where do I start from a pattern? | Call `find_pattern` with the request in plain words, then `draw_from_pattern` with the values to change. |
| Which features do they show? | Typed groups, a provider icon on every service, stack marks, overlays, event edges, and a level edge between a primary and a replica. |

## 1. Web application on Azure

A single-page app served from storage behind a CDN, services on an app plan, a database, secrets, a queue, sign-in, monitoring, and a delivery pipeline. It uses typed groups, a provider icon on every service, stack marks, and dotted edges for events.

**Diagram source**

```diagram
flow "Web application on a cloud" provider=azure direction=down desc="Visitors load a single-page app from storage through a content delivery network and sign in through an identity service. The app calls an API on an application plan, which stores uploads, reads a database, and hands slow work to a queue that a background worker drains. A pipeline builds and deploys the API, and a monitoring service collects telemetry."

node visitors client "Visitors" sub="Browsers"

group edge "Edge" type=edge {
  node cdn gateway "Content delivery" icon=azure:cdn
}

group sign-in "Sign-in" type=identity-boundary {
  node idp identity "Identity service" icon=azure:entra-id
}

group files "Storage" type=storage-account {
  node site storage "Web app files" icon=azure:blob-storage stack=simple:react,simple:typescript
  node uploads storage "Uploads" icon=azure:blob-storage
}

group plan "Application plan" type=service-plan {
  node api service "Orders API" icon=azure:app-service stack=simple:nodedotjs
}

group messaging "Messaging" type=messaging {
  node jobs queue "Job queue" icon=azure:service-bus
}

node worker function "Background worker" icon=azure:functions stack=simple:nodedotjs
node db database "Database" icon=azure:sql-database

group delivery "Delivery pipeline" type=ci-cd {
  node repo step "Source code" icon=lucide:git-branch
  node build step "Build pipeline" icon=azure:devops
}

group monitoring "Monitoring" type=observability {
  node telemetry service "Metrics and logs" icon=azure:monitor
}

visitors -> cdn : "HTTPS"
visitors -> idp : "sign in" role=identity
cdn -> site
cdn -> api : "API calls"
api -> uploads : "store files" role=data
api -> jobs : "enqueue" role=async
jobs ..> worker : "event"
worker -> db : "writes" role=data
api -> db : "reads" role=data
repo -> build
build ..> api : "deploys image"
api ..> telemetry : "telemetry"
```

*Picture: Web application on a cloud: 12 nodes, 12 connections. Visitors load a single-page app from storage through a content delivery network and sign in through an identity service. The app calls an API on an application plan, which stores uploads, reads a database, and hands slow work to a queue that a background worker drains. A pipeline builds and deploys the API, and a monitoring service collects telemetry.*

**Text description**

**Nodes:**

- Visitors (Browsers), client
- Background worker, function, stack: nodedotjs
- Database, database
- Edge: Edge
  - Content delivery, gateway
- Identity: Sign-in
  - Identity service, identity
- Storage: Storage
  - Web app files, storage, stack: react, typescript
  - Uploads, storage
- Service plan: Application plan
  - Orders API, service, stack: nodedotjs
- Messaging: Messaging
  - Job queue, queue
- CI and CD: Delivery pipeline
  - Source code, step
  - Build pipeline, step
- Observability: Monitoring
  - Metrics and logs, service

**Connections:**

- Visitors to Content delivery: HTTPS
- Visitors to Identity service (identity line): sign in
- Content delivery to Web app files
- Content delivery to Orders API: API calls
- Orders API to Uploads (stored data line): store files
- Orders API to Job queue (asynchronous line): enqueue
- Job queue to Background worker (dotted): event
- Background worker to Database (stored data line): writes
- Orders API to Database (stored data line): reads
- Source code to Build pipeline
- Build pipeline to Orders API (dotted): deploys image
- Orders API to Metrics and logs (dotted): telemetry

## 2. Two-zone network on AWS

A network in a region with two zones. Each zone has a public, a private, and an isolated subnet. Load balancers and a scaling group span both zones with overlays, and the primary database replicates to its replica across the zones.

**Diagram source**

```diagram
flow "Two-zone network with a replicated database" provider=aws direction=down desc="Traffic enters through an internet gateway and reaches load balancers in the public subnets of two availability zones. Each balancer sends it to an application server in a private subnet, and the two servers form one scaling group. Each server writes to a database in an isolated subnet, and the primary database replicates to the replica in the other zone."

node internet external "Internet"

group cloud "Cloud" type=cloud {
  node igw gateway "Internet gateway" icon=aws:internet-gateway

  group vpc "Application network" type=network sub="10.0.0.0/16" {
    group za "Zone A" type=zone {
      group pub-a "Public subnet A" type=public-subnet sub="10.0.0.0/24" {
        node lb-a gateway "Load balancer A" icon=aws:elb
      }
      group app-a "Private subnet A" type=private-subnet sub="10.0.1.0/24" {
        node web-a service "Application server A" icon=aws:ec2
      }
      group db-za "Isolated subnet A" type=isolated-subnet sub="10.0.2.0/24" {
        node db-a database "Primary database" icon=aws:rds
      }
    }
    group zb "Zone B" type=zone {
      group pub-b "Public subnet B" type=public-subnet sub="10.0.10.0/24" {
        node lb-b gateway "Load balancer B" icon=aws:elb
      }
      group app-b "Private subnet B" type=private-subnet sub="10.0.11.0/24" {
        node web-b service "Application server B" icon=aws:ec2
      }
      group db-zb "Isolated subnet B" type=isolated-subnet sub="10.0.12.0/24" {
        node db-b database "Replica database" icon=aws:rds
      }
    }
  }
}

overlay balancer "Load balancer" type=edge members=lb-a,lb-b
overlay scaling "Scaling group" type=scale-group members=web-a,web-b

internet <-> igw
igw -> lb-a
igw -> lb-b
lb-a -> web-a
lb-b -> web-b
web-a -> db-a
web-b -> db-b
db-a ..> db-b : "replication"
```

*Picture: Two-zone network with a replicated database: 8 nodes, 8 connections. Traffic enters through an internet gateway and reaches load balancers in the public subnets of two availability zones. Each balancer sends it to an application server in a private subnet, and the two servers form one scaling group. Each server writes to a database in an isolated subnet, and the primary database replicates to the replica in the other zone.*

**Text description**

**Nodes:**

- Internet, external
- Cloud: Cloud
  - Internet gateway, gateway
  - Virtual network: Application network (10.0.0.0/16)
    - Availability zone: Zone A
      - Public subnet: Public subnet A (10.0.0.0/24)
        - Load balancer A, gateway
      - Private subnet: Private subnet A (10.0.1.0/24)
        - Application server A, service
      - Isolated subnet: Isolated subnet A (10.0.2.0/24)
        - Primary database, database
    - Availability zone: Zone B
      - Public subnet: Public subnet B (10.0.10.0/24)
        - Load balancer B, gateway
      - Private subnet: Private subnet B (10.0.11.0/24)
        - Application server B, service
      - Isolated subnet: Isolated subnet B (10.0.12.0/24)
        - Replica database, database

**Overlays:**

- Edge overlay: Load balancer, around Load balancer A, Load balancer B
- Scale group overlay: Scaling group, around Application server A, Application server B

**Connections:**

- Internet with Internet gateway
- Internet gateway to Load balancer A
- Internet gateway to Load balancer B
- Load balancer A to Application server A
- Load balancer B to Application server B
- Application server A to Primary database
- Application server B to Replica database
- Primary database to Replica database (dotted): replication

## 3. Serverless API on Google Cloud

A function behind an API gateway with a database, a queue for slow work, and storage for files, drawn with Google Cloud icons.

**Diagram source**

```diagram
flow "Serverless API" provider=gcp direction=down desc="A client calls an API gateway, which checks the caller with a sign-in service and routes each request to one of three functions. The functions keep records in a managed database and files in object storage, and send logs and metrics to monitoring."

node client client "Client app" sub="Web or mobile"
node gateway gateway "Orders API" sub="API Gateway" icon=gcp:api-gateway

group fns "Functions" type=app-tier icon=gcp:cloud-functions {
  node create function "Create order" sub="Cloud Functions" icon=gcp:cloud-functions
  node list function "List orders" sub="Cloud Functions" icon=gcp:cloud-functions
  node get function "Get order" sub="Cloud Functions" icon=gcp:cloud-functions
}

group signin "Sign-in" type=identity-boundary {
  node auth identity "User directory" sub="Identity Platform" icon=gcp:identity-platform
}

group data "Data stores" type=data-tier icon=gcp:firestore {
  node bucket storage "Order files" sub="Cloud Storage" icon=gcp:cloud-storage
  node db database "Orders database" sub="Firestore" icon=gcp:firestore
}

group obs "Monitoring" type=observability {
  node monitor service "Logs and metrics" sub="Cloud Monitoring" icon=gcp:cloud-monitoring
}

client -> gateway : "HTTPS"
gateway -> create : "POST /orders"
gateway -> list : "GET /orders"
gateway -> get : "GET /orders/id"
gateway -> auth : "verify token" role=identity
create -> bucket : "upload" role=data
create -> db : "write" role=data
list -> db
get -> db
get ..> monitor : "logs and metrics"
```

*Picture: Serverless API: 9 nodes, 10 connections. A client calls an API gateway, which checks the caller with a sign-in service and routes each request to one of three functions. The functions keep records in a managed database and files in object storage, and send logs and metrics to monitoring.*

**Text description**

**Nodes:**

- Client app (Web or mobile), client
- Orders API (API Gateway), gateway
- Application tier: Functions
  - Create order (Cloud Functions), function
  - List orders (Cloud Functions), function
  - Get order (Cloud Functions), function
- Identity: Sign-in
  - User directory (Identity Platform), identity
- Data tier: Data stores
  - Order files (Cloud Storage), storage
  - Orders database (Firestore), database
- Observability: Monitoring
  - Logs and metrics (Cloud Monitoring), service

**Connections:**

- Client app to Orders API: HTTPS
- Orders API to Create order: POST /orders
- Orders API to List orders: GET /orders
- Orders API to Get order: GET /orders/id
- Orders API to User directory (identity line): verify token
- Create order to Order files (stored data line): upload
- Create order to Orders database (stored data line): write
- List orders to Orders database
- Get order to Orders database
- Get order to Logs and metrics (dotted): logs and metrics

## See also

| Doc | Why |
|---|---|
| [Architecture patterns](https://docs.plotwork.dev/architecture-patterns.md) | Every pattern, with its slots and the advice on what to keep, rename, and split |
| [Cloud architecture](https://docs.plotwork.dev/cloud-architecture.md) | The five-step recipe |
| [Group types](https://docs.plotwork.dev/cloud-architecture/group-types.md) | The types the examples use, each drawn |
| [Marks, second lines, and overlays](https://docs.plotwork.dev/cloud-architecture/marks-and-overlays.md) | The marks and overlays the examples use |
| [Writing diagrams with an agent](https://docs.plotwork.dev/mcp/agent-loop.md) | The validate-and-fix loop |