# Diagram gallery

> Page: https://docs.plotwork.dev/diagram-gallery. Index of every page: https://docs.plotwork.dev/llms.txt

Architectures drawn in Plotwork, grouped the way an architect looks for one: infrastructure and networks, applications, data, security and identity, and delivery and operations. Each one comes provider-neutral, and most also come with AWS, Azure or Google Cloud icons. Open one to watch it drawn, switch its provider, copy its text, or hand your agent the prompt that starts from it.

## TL;DR

| Question | Answer |
|---|---|
| What is here? | Every built-in architecture pattern, each drawn in every provider it comes in, light and dark. |
| Where do they come from? | The engine's own pattern library, the same one `find_pattern` searches and the portal's starter picker shows. Nothing here is drawn by hand. |
| How do I use one? | Copy the prompt into your agent, or copy the text into a `diagram` fence and change the names. |
| Can I change the provider? | Yes. Pick Neutral, AWS, Azure or Google Cloud on the open diagram; the parts and the layout stay, the icons change. |
| Can my organisation add its own? | Yes, on Enterprise. See [Approved patterns](https://docs.plotwork.dev/approved-patterns.md). |

## The gallery

| Category | Pattern | Use it for | Id | Flavours |
|---|---|---|---|---|
| Infrastructure and networks | Three-tier network behind load balancers | An office network joins a cloud network through a VPN gateway, and three tiers each put a load balancer in front of a redundant set of machines. | `three-tier-network` | Neutral, Azure |
| Infrastructure and networks | Two-zone network with a replicated database | A network spans two availability zones, each with a public, a private, and an isolated subnet, joined by one balancer set, one scaling group, and a replicated database. | `two-zone-network` | Neutral, AWS |
| Infrastructure and networks | Hub and spoke network | A hub network with a firewall and shared services links an office to several isolated spoke networks, so all traffic between them passes one place. | `hub-and-spoke-network` | Neutral, AWS, Azure, Google Cloud |
| Infrastructure and networks | Multi-region failover | A global routing service sends users to a primary region and fails over to a standby region, which holds replicated data and an identical stack. | `multi-region-failover` | Neutral, AWS, Azure, Google Cloud |
| Infrastructure and networks | Web application on a cloud | A single-page app is served through a CDN, backed by an API on a hosting plan, a database, a queue and worker, identity, storage, a delivery pipeline, and monitoring. | `web-app-on-cloud` | Neutral, Azure |
| Infrastructure and networks | Three-tier web app behind a WAF | Users reach a web tier through DNS, a CDN, a web application firewall, and a load balancer, and an app tier behind it uses a primary database with a read replica, a cache, object storage, a secrets store, and monitoring. | `web-app-behind-waf` | Neutral, AWS, Azure, Google Cloud |
| Infrastructure and networks | Static site behind a CDN | Visitors resolve a name through DNS and reach a content delivery network with a certificate, which serves files from a storage bucket that a build pipeline updates and clears from the cache. | `static-site-cdn` | Neutral, AWS |
| Infrastructure and networks | Container platform | A delivery pipeline pushes images to a registry, and a managed cluster runs three services on a redundant node pool behind an ingress, with configuration, secrets, and monitoring. | `container-platform` | Neutral, Google Cloud |
| Applications | Serverless API | A client calls an API gateway that checks sign-in and routes to three functions, which keep records in a managed database and files in object storage. | `serverless-api` | Neutral, AWS, Google Cloud |
| Applications | Microservices behind an API gateway | Clients call one API gateway that checks identity and routes to small services, which talk to each other through a message bus and each keep their own database. | `microservices-gateway` | Neutral, AWS, Azure, Google Cloud |
| Applications | Queue and worker pool | A web API puts jobs on a queue, a pool of workers takes them and writes results to a database, failed jobs go to a dead-letter queue, and an alarm watches the queue depth. | `queue-worker` | Neutral, AWS |
| Applications | Event-driven pipeline | Several services publish events to an event bus, three independent consumers react to them, and events that keep failing go to a dead-letter queue. | `event-driven-pipeline` | Neutral, AWS, Azure, Google Cloud |
| Applications | Retrieval-augmented AI application | An app sends prompts through an AI gateway and input guardrails to a retrieval service, which adds the nearest chunks from a vector store before a managed model answers, with output guardrails on the answer and an audit log of every prompt and answer. | `ai-rag-application` | Neutral, AWS, Azure, Google Cloud |
| Applications | Internal developer platform | Developers create a service from a golden-path template in a portal, and its code and infrastructure reach development, staging, and production clusters through continuous integration and policy checks, with shared secrets, observability, and cost reporting. | `internal-developer-platform` | Neutral, AWS, Azure, Google Cloud |
| Data | Multi-tenant application schema | Organizations own projects and an audit log, and users join organizations through a memberships table that carries a role. | `database-schema-starter` | Neutral |
| Data | Data lake and analytics | Sources feed an ingestion stage into a raw zone, a processing stage cleans the data into a curated zone, and a warehouse serves analysts through dashboards, with a catalog that describes the datasets. | `data-lake-analytics` | Neutral, AWS, Azure, Google Cloud |
| Security and identity | Zero trust access to private apps | People on managed devices reach private apps only through an identity-aware access proxy, whose policy engine checks the user, multi-factor sign-in, and device health on every request and logs each decision to a SIEM. | `zero-trust-access` | Neutral, AWS, Azure, Google Cloud |
| Security and identity | Single sign-on and SCIM provisioning | A customer's identity provider signs people in to a SaaS app with SAML or OIDC and creates, updates, and deactivates their accounts over SCIM, while the app maps groups to roles and audits every change. | `sso-scim-integration` | Neutral, AWS, Azure, Google Cloud |
| Security and identity | Sign-in with an authorization code and proof key | A browser app signs a person in through an identity provider with the authorization code flow and a proof key, calls a backend API with the access token, and refreshes it when it expires. | `sign-in-token-flow` | Neutral |
| Security and identity | Segmented cardholder data environment | Card payments pass a web application firewall and a DMZ, then a segmentation firewall into a small cardholder data environment that tokenises card numbers and keeps them in an encrypted vault, so the rest of the company only ever sees tokens. | `pci-cardholder-data-environment` | Neutral, AWS, Azure, Google Cloud |
| Delivery and operations | CI/CD delivery pipeline with an approval gate | A commit is built, tested, scanned, and stored as an image, then deployed to staging, held for an approval, and released to production. | `ci-cd-delivery-pipeline` | Neutral, Azure |
| Delivery and operations | GitOps delivery to clusters | A pipeline builds, tests, and scans an image and writes its tag to a config repository, and a GitOps controller syncs the development, staging, and production clusters from it, with a promotion and an approval on the way. | `gitops-kubernetes-delivery` | Neutral, AWS, Azure, Google Cloud |
| Delivery and operations | Monitoring and observability stack | Applications and hosts send metrics, logs, and traces through one OpenTelemetry collector to a store for each signal, which dashboards read and alert rules watch to page the on-call engineer. | `observability-stack` | Neutral, AWS, Azure, Google Cloud |

## See also

| Page | What it covers |
|---|---|
| [Architecture patterns](https://docs.plotwork.dev/architecture-patterns.md) | Every pattern's slots, what to keep, what to rename and when to split it |
| [Architecture gallery](https://docs.plotwork.dev/cloud-architecture/gallery.md) | Five full-size cloud and network architectures, with the text that makes each |
| [Examples to copy](https://docs.plotwork.dev/examples.md) | Small examples of each kind of diagram |
| [Approved patterns](https://docs.plotwork.dev/approved-patterns.md) | Your organisation's own patterns, offered to its agents first |