Skip to content
Connect an agent
Cloud architecture

Architecture gallery

Five full-size cloud and network architectures drawn in Plotwork, with the text that makes each one and the prompt that gets an agent to write something like it. Read them to see what the language does with real systems, then copy the text and change the names. It is for anyone drawing an environment with accounts, networks, tunnels, and several sites.

TL;DR

QuestionAnswer
What is here?A disaster recovery setup that spans AWS and a managed host, a multi-account AWS network with numbered traffic flows, an edge network where tunnels reach private origins, an Azure hub and spoke with private DNS and a private database, and the same Azure workload shown by tenant, management group, subscription, and resource group.
What do they show that a small diagram does not?Groups nested four deep, typed groups with their icons, provider icons on every service, numbered steps that say what happens in what order, and animated lines for traffic that moves.
How do I use one?Paste the prompt into your agent and change the names, or copy the text into a diagram fence. The text is the whole diagram.
Why is the text short?The engine lays out the groups, routes the lines, sizes the boxes to fit the words, and draws both color schemes. You write what is in what and what talks to what.
Do the lines move on GitHub?Animated lines move when the SVG is shown as an image in a browser, including in a README on GitHub. A PNG export, an email, or a reader that flattens SVG shows them still, and motion stops for a reader who asks for reduced motion.

1. Hybrid disaster recovery

A production site and a disaster recovery site, each with a managed host and an AWS account behind it. Staff and customers connect over site-to-site VPN, and the two sites replicate over a private WAN.

What to notice:

  • Groups nest four deep (site, host, power environment, and AWS account) and each has a type= that picks its icon and tone.
  • The two sites sit side by side because both are reached from the customer gateways. Nothing in the text says where to put them.
  • Only the lines that carry traffic move (animate=on): the VPN tunnels and the replication. The rest stays still, so the eye finds the data in flight.

Ask your agent:

text
Use Plotwork to draw a hybrid disaster recovery design. A customer's users and on-premises resources connect through customer gateways over site-to-site VPN to a production site and a disaster recovery site. Each site has a managed host with a VPN gateway, an isolated power environment running IBM i partitions with flash storage, and WAN routers, plus an AWS account with Direct Connect to application servers and object storage. The two sites replicate over a private multipath WAN. Engineering support centres reach both sites through a remote management gateway over VPN. Animate the VPN and replication lines.
Hybrid disaster recovery across AWS and a managed host: 21 nodes, 22 connections. A customer reaches a production site and a disaster recovery site over site-to-site VPN. Each site runs IBM i workloads in an isolated managed environment, linked to AWS over Direct Connect, and the two sites replicate over a private WAN.

2. Multi-account AWS network with numbered flows

Three AWS accounts joined by a Transit Gateway: networking, shared services, and an application account. The numbers on the lines say what happens, in order, from a visitor's request to the outbound traffic of the application.

What to notice:

  • numbered=on in the header puts a numbered badge on every line in the order the lines are written. The text description reads "1. External users to Internet gateway: Browse the site" and so on, so the order survives for someone who cannot see the picture.
  • provider=aws in the header sets the icons of the typed groups, and each service carries its own icon=aws: name.
  • A line can skip a number with step=off, or set one with step=12, when a flow has side paths.

Ask your agent:

text
Use Plotwork to draw a multi-account AWS network with numbered traffic flows. A networking account holds a DMZ VPC with an internet gateway, a Direct Connect connection, a Transit Gateway, and an egress VPC with a NAT gateway. A shared services account holds Managed Microsoft AD and a management host in private subnets. An application account has an Elastic Load Balancing tier in public subnets and an auto scaling group in private subnets. Number the steps: external users reach the site through the internet gateway and the Transit Gateway to the load balancer, then the application authenticates users against the directory. Corporate staff connect over Direct Connect through the Transit Gateway to the management host. The application sends outbound updates through the NAT gateway. Animate the lines that carry user traffic.
Multi-account AWS network with numbered traffic flows: 10 nodes, 9 connections. Internet users and corporate staff reach applications through a networking account. A Transit Gateway joins the networking, shared services and application accounts, and the numbers show each hop in order.

3. An edge network with tunnels to private origins

Visitors and remote staff reach the nearest edge server. Every server runs every service, and a small agent next to each origin keeps an outbound-only tunnel open, so nothing behind it has a public address.

What to notice:

  • The services sit in one group, "Every service, on every server", in two chains: application protection on the left and zero trust on the right. Each chain reads top to bottom in the order traffic meets it.
  • The tunnels are the only lines that move, so the picture shows which traffic crosses the boundary into private space.
  • The icons come from the cloudflare: set, and the nodes without a product icon keep the default glyph of their type.

Ask your agent:

text
Use Plotwork to draw an edge network where tunnels reach private origins. Visitors on a public network reach an edge server. Remote staff run a device agent that opens an encrypted tunnel to a second edge server. Inside the edge network a group called "Every service, on every server" holds two chains: DDoS protection, an L3 and L4 firewall, a web application firewall, bot management, load balancing and a CDN; and zero trust network access, a secure web gateway, data loss prevention, a cloud access security broker and remote browser isolation. An IaaS group with an application and a data centre with a private network of two databases each run a cloudflared agent, and a tunnel connects each to the edge network. Animate the tunnels.
Cloudflare Anycast network: 21 nodes, 19 connections. Visitors and remote staff reach the nearest Cloudflare server. Every server runs every service, and lightweight tunnel agents carry traffic to applications in a cloud and to private networks in a data centre, so no origin has a public address.

4. Azure hub and spoke with private DNS and a private database

A React frontend on a Web App and an API on a Function App share one App Service plan in a workload spoke. Users arrive through Front Door and Private Link, the API reaches PostgreSQL Flexible Server, Key Vault, and Storage over private addresses, and a hub firewall and DNS resolver serve every spoke.

What to notice:

  • The spoke and the hub are two type=network groups with subnets inside them, each with its address range in sub=. A subnet delegated to a service (App Service, PostgreSQL) says so in its name.
  • The App Service plan is a group of its own (type=service-plan) around the two apps that run on it.
  • The numbered steps follow one request from the browser to the database and to the vault. The lines that only keep the platform running (egress through the firewall, DNS lookups, telemetry) use step=off, so they are drawn without taking a number.
  • Four private DNS zones sit together, linked to the hub and the spoke, and the resolver in the hub answers for all of them.

Ask your agent:

text
Use Plotwork to draw an Azure hub and spoke network with private DNS. Users reach a Front Door Premium with WAF, which reaches a Web App (React frontend) through a private endpoint. The Web App and a Function App (the API) run on one zone-redundant App Service plan in an integration subnet delegated to App Service, in a workload spoke VNet. The Function App reads secrets from Key Vault and files from a Storage account through private endpoints in a separate subnet, and queries PostgreSQL Flexible Server with private access in a subnet delegated to PostgreSQL. A hub VNet holds an Azure Firewall for egress and a Private DNS resolver, which answers for four private DNS zones: azurewebsites, vaultcore, blob, and postgres. Application Insights and a Log Analytics workspace collect telemetry. Number the steps of one request and animate the Private Link, the API call and the database lines.
Azure hub and spoke with private DNS and a private database: 18 nodes, 17 connections. A React frontend on a Web App and an API on a Function App share one App Service plan in a workload spoke. Users arrive through Front Door and Private Link, the API reaches PostgreSQL Flexible Server, Key Vault and Storage over private addresses, and a hub firewall and DNS resolver serve every spoke.

5. Azure landing zone: tenant, subscriptions, and resource groups

The Azure workload of the previous example, drawn again with where each part is owned. One Microsoft Entra tenant signs users in with Conditional Access and multifactor authentication (MFA), a tree of management groups applies Azure Policy, and three subscriptions (connectivity, management, and workload) hold the resource groups that contain every resource.

What to notice:

  • The nesting is the ownership chain: tenant root management group, then a management group, then a subscription (type=account), then a resource group (type=resource-group), then the resource. Each level has its own icon from the Azure set.
  • The Entra tenant is a group of its own (type=identity-boundary) with the sign-in services in it: Entra ID, Conditional Access with MFA, Privileged Identity Management, and app registrations.
  • The first three numbers are the sign-in: the user signs in, Conditional Access evaluates it, and a token is issued before the request goes on to Front Door. The API then uses a managed identity, with no stored credentials, to read secrets and to connect to PostgreSQL with an Entra token.
  • Private endpoints sit in the resource group of the thing they protect, next to Key Vault, which is where Azure puts them by default.
  • Platform lines (egress, DNS, telemetry, policy) use step=off, so the numbers stay on the request path.

Ask your agent:

text
Use Plotwork to draw an Azure landing zone with the ownership shown. Put a Microsoft Entra tenant at the top with Entra ID, Conditional Access and MFA, Privileged Identity Management, and app registrations. Below it a tenant root management group holds Azure Policy and Defender for Cloud and two child management groups: landing zones, with a workload production subscription, and platform, with a connectivity subscription and a management subscription. In the workload subscription put three resource groups: spoke network (a spoke VNet with a private endpoint subnet for the Web App), app (an App Service plan with a React Web App and a Function App API, plus a managed identity), and data (a private endpoint for Key Vault, Key Vault with RBAC, and PostgreSQL Flexible Server with Entra authentication). In the connectivity subscription put a hub network resource group (Azure Firewall and a Private DNS resolver) and a private DNS resource group (zones for azurewebsites, vaultcore and postgres). In the management subscription put a monitoring resource group with Application Insights and a Log Analytics workspace. Number one request: the user signs in, Conditional Access evaluates it, a token is issued, Front Door reaches the Web App by Private Link, the Web App calls the Function App with the bearer token, the Function App's managed identity reads Key Vault and connects to PostgreSQL. Animate the Private Link, the API call and the database connection.
Azure landing zone: tenant, subscriptions and resource groups: 22 nodes, 20 connections. The same hub and spoke workload shown with where everything is owned: one Microsoft Entra tenant signs users in with Conditional Access and MFA, a management group tree applies policy, and three subscriptions (connectivity, management and workload) hold the resource groups that contain each resource.

Next steps

DocWhy
Examples to copySmaller diagrams, one idea each, with the prompt for each
Cloud architectureAccounts, regions, networks, subnets, and icons for AWS, Azure, and Google Cloud
Writing diagramsNumbered steps, animated lines, and the rest of the language
Architecture patternsChecked, ready-made diagrams to start from

See also

DocWhy
Quick startConnect an agent and draw a first diagram
Group typesThe types of group used here, each drawn
Icon names and lookupFrom a product name to an icon=