Group types
The closed list of type= values a group can take, each drawn by the renderer as it appears in a diagram, with the frame and tone it uses and the icon it draws for each provider. It is for anyone choosing a type for a group, human or AI agent.
TL;DR
| Question | Answer |
|---|---|
| How many types are there? | 30. The list is closed: one spelling for each, no aliases. A misspelling is error E124 with the nearest type. |
| What does a type set? | The icon in the corner tab, the tone (color family), and the frame style (solid, dashed, or dotted). |
| How do I pick one? | The type that says what the group is. A VPC is network, a public subnet is public-subnet, an Azure resource group is resource-group. |
| What if no type fits? | Use subnet, environment, or trust-boundary when one is close, or write no type and set icon= and tone= by hand. |
| Which icon does a provider draw? | The provider's own icon where it has one, the generic icon otherwise. The icon matrix shows every cell. |
| Can I change what a type sets? | Yes. icon= and tone= override it, and icon=none removes the icon. Prefer the type. |
1. The list
Each picture is the group alone, drawn by the renderer with a plain node inside, with no provider set. The type= column is the text to write. The tone chip shows the tone in light and in dark.
| Picture | type= | Use it for | Frame | Tone |
|---|---|---|---|---|
 | cloud | A provider's whole cloud: the outermost frame that holds its accounts, regions, and networks. | solid |  |
 | account | An account, subscription, or project: the container of one provider's resources that bills and grants access together. | solid | |
 | region | A geographic region of a provider, such as eu-west-1 or West Europe. | dashed | |
 | zone | An availability zone inside a region, drawn as a column. | dashed | |
 | network | A VPC, VNet, or other private network that holds subnets and resources. | dashed |  |
 | subnet | A subnet inside a network whose role is not public, private, management, or isolated. | solid | |
 | public-subnet | A subnet whose resources can be reached from the internet, such as load balancers and bastion hosts. | solid |  |
 | private-subnet | A subnet with no direct route from the internet, such as application servers and databases. | solid |  |
 | management-subnet | A subnet for administration: jump hosts, bastions, and tooling that operators use. | solid |  |
 | isolated-subnet | A subnet with no route in or out of the network, such as a database that only the application tier can reach. | solid |  |
 | resource-group | A logical group of resources that are managed together, such as an Azure resource group. | solid | |
 | cluster | A Kubernetes or container cluster. | solid | |
 | scale-group | An auto scaling group, scale set, or managed instance group of identical machines. | solid |  |
 | service-plan | A hosting plan that runs several apps on shared compute, such as an App Service plan. | solid | |
 | web-tier | The layer that faces users: web servers and the load balancer in front of them. | solid | |
 | app-tier | The layer that runs application code: application servers, services, or functions. | solid | |
 | data-tier | The layer that holds databases and caches. | solid | |
 | storage-account | A storage account or a set of buckets and file shares. | solid | |
 | messaging | Queues, topics, and event buses that decouple services. | solid |  |
 | edge | The public edge in front of the application: DNS, CDN, and front doors. | solid | |
 | security | Security services such as firewalls, web application firewalls, and key management. | solid | |
 | identity-boundary | The area that authenticates users and issues tokens: an identity provider and its directory. | dashed | |
 | trust-boundary | A line across which trust changes: what is inside is checked differently from what is outside. | dashed | |
 | observability | Monitoring, logging, and tracing. | solid | |
 | ci-cd | A build and release pipeline with its repositories. | solid | |
 | environment | A deployment environment such as development, staging, or production. | solid | |
 | cloud-boundary | The line between your own premises and the cloud: everything inside is on the cloud side. | dotted | |
 | on-premises | A data center or office network that you run yourself, outside any cloud. | dotted | |
 | client-side | Browsers, mobile apps, and devices that call the system. | dotted | |
 | external-systems | Third-party services and partners that you call but do not run. | dotted | |
Frame styles carry meaning
The frame lets a reader tell a boundary from a container without reading the name. Dashed frames are boundaries (region, zone, network, identity-boundary, trust-boundary), dotted frames are one side of a line (cloud-boundary, on-premises, client-side, external-systems), and every other type is a solid container. Frames, tones, lines, and symbols draws each frame style, every tone, and the nesting depth.
Tones carry meaning
The four subnet roles each have their own tint, so a reader sees which side of the network a subnet is on before reading its name: public-subnet is green, private-subnet violet, management-subnet amber, and isolated-subnet red. web-tier is blue, app-tier violet, and data-tier aqua, so the three tiers of a request stay apart in the same way. Every tint keeps the text readable in light and in dark. A plain subnet stays neutral, for a subnet whose role is not one of the four.
A group nested in another is shaded one step stronger than the one around it, in light and in dark, so an account, a region, a network, and a subnet read as four levels. Depth is automatic; there is nothing to write.
The cloud and its boundary
The provider's own cloud is the outermost frame, drawn with type=cloud. Draw a hybrid system with type=cloud-boundary around everything on the cloud side and type=on-premises beside it, joined by an edge through a gateway node, so the line between the two sides is the dotted frame.
2. Icons by provider
With a provider, a type draws that provider's own icon where the provider has one. Where it has none, the type draws its generic icon, so a cell that repeats the generic icon means the provider has nothing more specific for that type. Set the provider once on the header (flow "Title" provider=azure), or on the top group of one cloud in a multi-cloud diagram; nested groups inherit it.
Every cell shows the icon as the renderer draws it, and its name. The names are the exact text for icon= if you want to set one by hand.
type= | No provider | AWS | Azure | Google Cloud |
|---|---|---|---|---|
cloud |  lucide:cloud |  aws:cloud-group |  azure:cloud |  gcp:cloud |
account | lucide:cloud |  aws:account |  azure:subscriptions | gcp:cloud |
region |  lucide:map-pin |  aws:region | lucide:map-pin | lucide:map-pin |
zone |  lucide:layers | lucide:layers | lucide:layers | lucide:layers |
network |  lucide:network |  aws:virtual-private-cloud-vpc |  azure:virtual-network |  gcp:vpc |
subnet |  lucide:waypoints | lucide:waypoints |  azure:subnet | lucide:waypoints |
public-subnet |  lucide:lock-open |  aws:public-subnet | lucide:lock-open | lucide:lock-open |
private-subnet |  lucide:lock |  aws:private-subnet | lucide:lock | lucide:lock |
management-subnet |  lucide:settings | lucide:settings | lucide:settings | lucide:settings |
isolated-subnet |  lucide:door-closed | lucide:door-closed | lucide:door-closed | lucide:door-closed |
resource-group |  lucide:boxes | lucide:boxes |  azure:resource-groups | lucide:boxes |
cluster |  lucide:container |  aws:eks |  azure:aks |  gcp:gke |
scale-group |  lucide:server-cog |  aws:auto-scaling-group |  azure:vm-scale-sets |  gcp:compute-engine |
service-plan |  lucide:server |  aws:ecs |  azure:app-service-plans |  gcp:cloud-run |
web-tier |  lucide:monitor | lucide:monitor | lucide:monitor | lucide:monitor |
app-tier | lucide:server | lucide:server | lucide:server | lucide:server |
data-tier |  lucide:database |  aws:rds |  azure:sql-database |  gcp:cloud-sql |
storage-account |  lucide:hard-drive |  aws:s3 |  azure:blob-storage |  gcp:cloud-storage |
messaging |  lucide:send |  aws:sqs |  azure:service-bus |  gcp:pubsub |
edge |  lucide:globe |  aws:cloudfront |  azure:front-door |  gcp:cloud-cdn |
security |  lucide:shield-check |  aws:waf |  azure:firewall |  gcp:security-identity |
identity-boundary |  lucide:id-card |  aws:iam |  azure:entra-id |  gcp:iam |
trust-boundary |  lucide:shield | lucide:shield | lucide:shield | lucide:shield |
observability |  lucide:activity |  aws:cloudwatch |  azure:monitor |  gcp:observability |
ci-cd |  lucide:workflow |  aws:codepipeline |  azure:devops |  gcp:devops |
environment |  lucide:rocket | lucide:rocket | lucide:rocket | lucide:rocket |
cloud-boundary |  lucide:cable | lucide:cable | lucide:cable | lucide:cable |
on-premises |  lucide:factory |  aws:corporate-data-center | lucide:factory | lucide:factory |
client-side |  lucide:monitor-smartphone | lucide:monitor-smartphone | lucide:monitor-smartphone | lucide:monitor-smartphone |
external-systems |  lucide:plug | lucide:plug | lucide:plug | lucide:plug |
See also
| Doc | Why |
|---|---|
| Cloud architecture | The five-step recipe and a map of these pages |
| Frames, tones, lines, and symbols | Frame styles, tones, depth, and lines drawn one by one |
| Icon names and lookup | How provider:product resolves |
| Writing diagrams | Group options in the whole language |
| Group types in the language reference | Every group type with its meaning and the icon each provider draws |