# Group types

> Page: https://docs.plotwork.dev/cloud-architecture/group-types. Index of every page: https://docs.plotwork.dev/llms.txt

The closed list of `type=` values a group can take, each drawn by the renderer as it appears in a diagram, with the frame and tone it uses and the icon it draws for each provider. It is for anyone choosing a type for a group, human or AI agent.

## TL;DR

| Question | Answer |
|---|---|
| How many types are there? | 30. The list is closed: one spelling for each, no aliases. A misspelling is error `E124` with the nearest type. |
| What does a type set? | The icon in the corner tab, the tone (color family), and the frame style (solid, dashed, or dotted). |
| How do I pick one? | The type that says what the group is. A VPC is `network`, a public subnet is `public-subnet`, an Azure resource group is `resource-group`. |
| What if no type fits? | Use `subnet`, `environment`, or `trust-boundary` when one is close, or write no type and set `icon=` and `tone=` by hand. |
| Which icon does a provider draw? | The provider's own icon where it has one, the generic icon otherwise. The [icon matrix](#2-icons-by-provider) shows every cell. |
| Can I change what a type sets? | Yes. `icon=` and `tone=` override it, and `icon=none` removes the icon. Prefer the type. |

## 1. The list

Each picture is the group alone, drawn by the renderer with a plain node inside, with no provider set. The `type=` column is the text to write. The tone chip shows the tone in light and in dark.

| Picture | `type=` | Use it for | Frame | Tone |
|---|---|---|---|---|
|  | `cloud` | A provider's whole cloud: the outermost frame that holds its accounts, regions, and networks. | solid |  neutral |
|  | `account` | An account, subscription, or project: the container of one provider's resources that bills and grants access together. | solid |  neutral |
|  | `region` | A geographic region of a provider, such as eu-west-1 or West Europe. | dashed |  neutral |
|  | `zone` | An availability zone inside a region, drawn as a column. | dashed |  neutral |
|  | `network` | A VPC, VNet, or other private network that holds subnets and resources. | dashed |  blue |
|  | `subnet` | A subnet inside a network whose role is not public, private, management, or isolated. | solid |  neutral |
|  | `public-subnet` | A subnet whose resources can be reached from the internet, such as load balancers and bastion hosts. | solid |  green |
|  | `private-subnet` | A subnet with no direct route from the internet, such as application servers and databases. | solid |  violet |
|  | `management-subnet` | A subnet for administration: jump hosts, bastions, and tooling that operators use. | solid |  amber |
|  | `isolated-subnet` | A subnet with no route in or out of the network, such as a database that only the application tier can reach. | solid |  red |
|  | `resource-group` | A logical group of resources that are managed together, such as an Azure resource group. | solid |  neutral |
|  | `cluster` | A Kubernetes or container cluster. | solid |  violet |
|  | `scale-group` | An auto scaling group, scale set, or managed instance group of identical machines. | solid |  aqua |
|  | `service-plan` | A hosting plan that runs several apps on shared compute, such as an App Service plan. | solid |  violet |
|  | `web-tier` | The layer that faces users: web servers and the load balancer in front of them. | solid |  blue |
|  | `app-tier` | The layer that runs application code: application servers, services, or functions. | solid |  violet |
|  | `data-tier` | The layer that holds databases and caches. | solid |  aqua |
|  | `storage-account` | A storage account or a set of buckets and file shares. | solid |  amber |
|  | `messaging` | Queues, topics, and event buses that decouple services. | solid |  orange |
|  | `edge` | The public edge in front of the application: DNS, CDN, and front doors. | solid |  blue |
|  | `security` | Security services such as firewalls, web application firewalls, and key management. | solid |  red |
|  | `identity-boundary` | The area that authenticates users and issues tokens: an identity provider and its directory. | dashed |  violet |
|  | `trust-boundary` | A line across which trust changes: what is inside is checked differently from what is outside. | dashed |  neutral |
|  | `observability` | Monitoring, logging, and tracing. | solid |  aqua |
|  | `ci-cd` | A build and release pipeline with its repositories. | solid |  violet |
|  | `environment` | A deployment environment such as development, staging, or production. | solid |  amber |
|  | `cloud-boundary` | The line between your own premises and the cloud: everything inside is on the cloud side. | dotted |  blue |
|  | `on-premises` | A data center or office network that you run yourself, outside any cloud. | dotted |  neutral |
|  | `client-side` | Browsers, mobile apps, and devices that call the system. | dotted |  neutral |
|  | `external-systems` | Third-party services and partners that you call but do not run. | dotted |  neutral |

### Frame styles carry meaning

The frame lets a reader tell a boundary from a container without reading the name. Dashed frames are boundaries (`region`, `zone`, `network`, `identity-boundary`, `trust-boundary`), dotted frames are one side of a line (`cloud-boundary`, `on-premises`, `client-side`, `external-systems`), and every other type is a solid container. [Frames, tones, lines, and symbols](https://docs.plotwork.dev/cloud-architecture/lines-and-symbols.md) draws each frame style, every tone, and the nesting depth.

### Tones carry meaning

The four subnet roles each have their own tint, so a reader sees which side of the network a subnet is on before reading its name: `public-subnet` is green, `private-subnet` violet, `management-subnet` amber, and `isolated-subnet` red. `web-tier` is blue, `app-tier` violet, and `data-tier` aqua, so the three tiers of a request stay apart in the same way. Every tint keeps the text readable in light and in dark. A plain `subnet` stays neutral, for a subnet whose role is not one of the four.

A group nested in another is shaded one step stronger than the one around it, in light and in dark, so an account, a region, a network, and a subnet read as four levels. Depth is automatic; there is nothing to write.

### The cloud and its boundary

The provider's own cloud is the outermost frame, drawn with `type=cloud`. Draw a hybrid system with `type=cloud-boundary` around everything on the cloud side and `type=on-premises` beside it, joined by an edge through a gateway node, so the line between the two sides is the dotted frame.

## 2. Icons by provider

With a provider, a type draws that provider's own icon where the provider has one. Where it has none, the type draws its generic icon, so a cell that repeats the generic icon means the provider has nothing more specific for that type. Set the provider once on the header (`flow "Title" provider=azure`), or on the top group of one cloud in a multi-cloud diagram; nested groups inherit it.

Every cell shows the icon as the renderer draws it, and its name. The names are the exact text for `icon=` if you want to set one by hand.

| `type=` | No provider | AWS | Azure | Google Cloud |
|---|---|---|---|---|
| `cloud` |  `lucide:cloud` |  `aws:cloud-group` |  `azure:cloud` |  `gcp:cloud` |
| `account` |  `lucide:cloud` |  `aws:account` |  `azure:subscriptions` |  `gcp:cloud` |
| `region` |  `lucide:map-pin` |  `aws:region` |  `lucide:map-pin` |  `lucide:map-pin` |
| `zone` |  `lucide:layers` |  `lucide:layers` |  `lucide:layers` |  `lucide:layers` |
| `network` |  `lucide:network` |  `aws:virtual-private-cloud-vpc` |  `azure:virtual-network` |  `gcp:vpc` |
| `subnet` |  `lucide:waypoints` |  `lucide:waypoints` |  `azure:subnet` |  `lucide:waypoints` |
| `public-subnet` |  `lucide:lock-open` |  `aws:public-subnet` |  `lucide:lock-open` |  `lucide:lock-open` |
| `private-subnet` |  `lucide:lock` |  `aws:private-subnet` |  `lucide:lock` |  `lucide:lock` |
| `management-subnet` |  `lucide:settings` |  `lucide:settings` |  `lucide:settings` |  `lucide:settings` |
| `isolated-subnet` |  `lucide:door-closed` |  `lucide:door-closed` |  `lucide:door-closed` |  `lucide:door-closed` |
| `resource-group` |  `lucide:boxes` |  `lucide:boxes` |  `azure:resource-groups` |  `lucide:boxes` |
| `cluster` |  `lucide:container` |  `aws:eks` |  `azure:aks` |  `gcp:gke` |
| `scale-group` |  `lucide:server-cog` |  `aws:auto-scaling-group` |  `azure:vm-scale-sets` |  `gcp:compute-engine` |
| `service-plan` |  `lucide:server` |  `aws:ecs` |  `azure:app-service-plans` |  `gcp:cloud-run` |
| `web-tier` |  `lucide:monitor` |  `lucide:monitor` |  `lucide:monitor` |  `lucide:monitor` |
| `app-tier` |  `lucide:server` |  `lucide:server` |  `lucide:server` |  `lucide:server` |
| `data-tier` |  `lucide:database` |  `aws:rds` |  `azure:sql-database` |  `gcp:cloud-sql` |
| `storage-account` |  `lucide:hard-drive` |  `aws:s3` |  `azure:blob-storage` |  `gcp:cloud-storage` |
| `messaging` |  `lucide:send` |  `aws:sqs` |  `azure:service-bus` |  `gcp:pubsub` |
| `edge` |  `lucide:globe` |  `aws:cloudfront` |  `azure:front-door` |  `gcp:cloud-cdn` |
| `security` |  `lucide:shield-check` |  `aws:waf` |  `azure:firewall` |  `gcp:security-identity` |
| `identity-boundary` |  `lucide:id-card` |  `aws:iam` |  `azure:entra-id` |  `gcp:iam` |
| `trust-boundary` |  `lucide:shield` |  `lucide:shield` |  `lucide:shield` |  `lucide:shield` |
| `observability` |  `lucide:activity` |  `aws:cloudwatch` |  `azure:monitor` |  `gcp:observability` |
| `ci-cd` |  `lucide:workflow` |  `aws:codepipeline` |  `azure:devops` |  `gcp:devops` |
| `environment` |  `lucide:rocket` |  `lucide:rocket` |  `lucide:rocket` |  `lucide:rocket` |
| `cloud-boundary` |  `lucide:cable` |  `lucide:cable` |  `lucide:cable` |  `lucide:cable` |
| `on-premises` |  `lucide:factory` |  `aws:corporate-data-center` |  `lucide:factory` |  `lucide:factory` |
| `client-side` |  `lucide:monitor-smartphone` |  `lucide:monitor-smartphone` |  `lucide:monitor-smartphone` |  `lucide:monitor-smartphone` |
| `external-systems` |  `lucide:plug` |  `lucide:plug` |  `lucide:plug` |  `lucide:plug` |

## See also

| Doc | Why |
|---|---|
| [Cloud architecture](https://docs.plotwork.dev/cloud-architecture.md) | The five-step recipe and a map of these pages |
| [Frames, tones, lines, and symbols](https://docs.plotwork.dev/cloud-architecture/lines-and-symbols.md) | Frame styles, tones, depth, and lines drawn one by one |
| [Icon names and lookup](https://docs.plotwork.dev/cloud-architecture/icon-names.md) | How `provider:product` resolves |
| [Writing diagrams](https://docs.plotwork.dev/writing-diagrams.md) | Group options in the whole language |
| [Group types in the language reference](https://docs.plotwork.dev/reference/language/group-types.md) | Every group type with its meaning and the icon each provider draws |