Language reference
Group types
Every group type with its frame style and tone, the icon each draws for each provider, and a complete cloud architecture diagram.
TL;DR
| Question | Answer |
|---|---|
| How many group types are there? | 30: cloud, account, region, zone, network, subnet, public-subnet, private-subnet, management-subnet, isolated-subnet, resource-group, cluster, scale-group, service-plan, web-tier, app-tier, data-tier, storage-account, messaging, edge, security, identity-boundary, trust-boundary, observability, ci-cd, environment, cloud-boundary, on-premises, client-side, external-systems. |
| What does a type decide? | The icon in the corner tab, the tone, and the frame style: dashed for boundaries, solid for containers, dotted for things outside the system. |
| Which providers change the icon? | aws, gcp, azure, alibaba, oci, ibm, cloudflare, digitalocean, vercel. With none, a type draws its generic icon. |
| What is a group with no type? | A frame with only its name, in the neutral tone, unless its name gives its type for certain, such as VPC, Production or Kafka. type=none keeps it plain. |
Types
Pick the type that says what the group is, not what it looks like. The frame style carries meaning: network and trust boundaries are dashed, logical containers are solid, and things outside the system are dotted. Nesting deepens the shade, so an account, a region, and a network read as three levels. The group types guide draws every type.
type= | Use it for | Frame | Tone |
|---|---|---|---|
cloud | A provider's whole cloud: the outermost frame that holds its accounts, regions, and networks. | solid |  |
account | An account, subscription, or project: the container of one provider's resources that bills and grants access together. | solid | |
region | A geographic region of a provider, such as eu-west-1 or West Europe. | dashed | |
zone | An availability zone inside a region, drawn as a column. | dashed | |
network | A VPC, VNet, or other private network that holds subnets and resources. | dashed |  |
subnet | A subnet inside a network whose role is not public, private, management, or isolated. | solid | |
public-subnet | A subnet whose resources can be reached from the internet, such as load balancers and bastion hosts. | solid |  |
private-subnet | A subnet with no direct route from the internet, such as application servers and databases. | solid |  |
management-subnet | A subnet for administration: jump hosts, bastions, and tooling that operators use. | solid |  |
isolated-subnet | A subnet with no route in or out of the network, such as a database that only the application tier can reach. | solid |  |
resource-group | A logical group of resources that are managed together, such as an Azure resource group. | solid | |
cluster | A Kubernetes or container cluster. | solid | |
scale-group | An auto scaling group, scale set, or managed instance group of identical machines. | solid |  |
service-plan | A hosting plan that runs several apps on shared compute, such as an App Service plan. | solid | |
web-tier | The layer that faces users: web servers and the load balancer in front of them. | solid | |
app-tier | The layer that runs application code: application servers, services, or functions. | solid | |
data-tier | The layer that holds databases and caches. | solid | |
storage-account | A storage account or a set of buckets and file shares. | solid | |
messaging | Queues, topics, and event buses that decouple services. | solid |  |
edge | The public edge in front of the application: DNS, CDN, and front doors. | solid | |
security | Security services such as firewalls, web application firewalls, and key management. | solid | |
identity-boundary | The area that authenticates users and issues tokens: an identity provider and its directory. | dashed | |
trust-boundary | A line across which trust changes: what is inside is checked differently from what is outside. | dashed | |
observability | Monitoring, logging, and tracing. | solid | |
ci-cd | A build and release pipeline with its repositories. | solid | |
environment | A deployment environment such as development, staging, or production. | solid | |
cloud-boundary | The line between your own premises and the cloud: everything inside is on the cloud side. | dotted | |
on-premises | A data center or office network that you run yourself, outside any cloud. | dotted | |
client-side | Browsers, mobile apps, and devices that call the system. | dotted | |
external-systems | Third-party services and partners that you call but do not run. | dotted | |
Icons by provider
Without a provider a type draws its generic icon. With one, the type draws that provider's icon where the provider has one, and a provider with no icon of its own for a type draws the generic one. Each cell shows the icon that is drawn and its name.
type= | No provider | AWS | Azure | Google Cloud |
|---|---|---|---|---|
cloud |  lucide:cloud |  aws:cloud-group |  azure:cloud |  gcp:cloud |
account | lucide:cloud |  aws:account |  azure:subscriptions | gcp:cloud |
region |  lucide:map-pin |  aws:region | lucide:map-pin | lucide:map-pin |
zone |  lucide:layers | lucide:layers | lucide:layers | lucide:layers |
network |  lucide:network |  aws:virtual-private-cloud-vpc |  azure:virtual-network |  gcp:vpc |
subnet |  lucide:waypoints | lucide:waypoints |  azure:subnet | lucide:waypoints |
public-subnet |  lucide:lock-open |  aws:public-subnet | lucide:lock-open | lucide:lock-open |
private-subnet |  lucide:lock |  aws:private-subnet | lucide:lock | lucide:lock |
management-subnet |  lucide:settings | lucide:settings | lucide:settings | lucide:settings |
isolated-subnet |  lucide:door-closed | lucide:door-closed | lucide:door-closed | lucide:door-closed |
resource-group |  lucide:boxes | lucide:boxes |  azure:resource-groups | lucide:boxes |
cluster |  lucide:container |  aws:eks |  azure:aks |  gcp:gke |
scale-group |  lucide:server-cog |  aws:auto-scaling-group |  azure:vm-scale-sets |  gcp:compute-engine |
service-plan |  lucide:server |  aws:ecs |  azure:app-service-plans |  gcp:cloud-run |
web-tier |  lucide:monitor | lucide:monitor | lucide:monitor | lucide:monitor |
app-tier | lucide:server | lucide:server | lucide:server | lucide:server |
data-tier |  lucide:database |  aws:rds |  azure:sql-database |  gcp:cloud-sql |
storage-account |  lucide:hard-drive |  aws:s3 |  azure:blob-storage |  gcp:cloud-storage |
messaging |  lucide:send |  aws:sqs |  azure:service-bus |  gcp:pubsub |
edge |  lucide:globe |  aws:cloudfront |  azure:front-door |  gcp:cloud-cdn |
security |  lucide:shield-check |  aws:waf |  azure:firewall |  gcp:security-identity |
identity-boundary |  lucide:id-card |  aws:iam |  azure:entra-id |  gcp:iam |
trust-boundary |  lucide:shield | lucide:shield | lucide:shield | lucide:shield |
observability |  lucide:activity |  aws:cloudwatch |  azure:monitor |  gcp:observability |
ci-cd |  lucide:workflow |  aws:codepipeline |  azure:devops |  gcp:devops |
environment |  lucide:rocket | lucide:rocket | lucide:rocket | lucide:rocket |
cloud-boundary |  lucide:cable | lucide:cable | lucide:cable | lucide:cable |
on-premises |  lucide:factory |  aws:corporate-data-center | lucide:factory | lucide:factory |
client-side |  lucide:monitor-smartphone | lucide:monitor-smartphone | lucide:monitor-smartphone | lucide:monitor-smartphone |
external-systems |  lucide:plug | lucide:plug | lucide:plug | lucide:plug |
A complete example
Flow: Web application on a cloud
A complete architecture diagram. Every group has a type, every service has a provider icon, two nodes carry stack marks, and two edges are dotted.
Plotwork
flow "Web application on a cloud" provider=azure direction=down desc="Visitors load a single-page app from storage through a content delivery network and sign in through an identity service. The app calls an API on an application plan, which stores uploads, reads a database, and hands slow work to a queue that a background worker drains. A pipeline builds and deploys the API, and a monitoring service collects telemetry."
node visitors client "Visitors" sub="Browsers"
group edge "Edge" type=edge { node cdn gateway "Content delivery" icon=azure:cdn}
group sign-in "Sign-in" type=identity-boundary { node idp identity "Identity service" icon=azure:entra-id}
group files "Storage" type=storage-account { node site storage "Web app files" icon=azure:blob-storage stack=simple:react,simple:typescript node uploads storage "Uploads" icon=azure:blob-storage}
group plan "Application plan" type=service-plan { node api service "Orders API" icon=azure:app-service stack=simple:nodedotjs}
group messaging "Messaging" type=messaging { node jobs queue "Job queue" icon=azure:service-bus}
node worker function "Background worker" icon=azure:functions stack=simple:nodedotjsnode db database "Database" icon=azure:sql-database
group delivery "Delivery pipeline" type=ci-cd { node repo step "Source code" icon=lucide:git-branch node build step "Build pipeline" icon=azure:devops}
group monitoring "Monitoring" type=observability { node telemetry service "Metrics and logs" icon=azure:monitor}
visitors -> cdn : "HTTPS"visitors -> idp : "sign in" role=identitycdn -> sitecdn -> api : "API calls"api -> uploads : "store files" role=dataapi -> jobs : "enqueue" role=asyncjobs ..> worker : "event"worker -> db : "writes" role=dataapi -> db : "reads" role=datarepo -> buildbuild ..> api : "deploys image"api ..> telemetry : "telemetry"Nodes:
- Visitors (Browsers), client
- Background worker, function, stack: nodedotjs
- Database, database
- Edge: Edge
- Content delivery, gateway
- Identity: Sign-in
- Identity service, identity
- Storage: Storage
- Web app files, storage, stack: react, typescript
- Uploads, storage
- Service plan: Application plan
- Orders API, service, stack: nodedotjs
- Messaging: Messaging
- Job queue, queue
- CI and CD: Delivery pipeline
- Source code, step
- Build pipeline, step
- Observability: Monitoring
- Metrics and logs, service
Connections:
- Visitors to Content delivery: HTTPS
- Visitors to Identity service (identity line): sign in
- Content delivery to Web app files
- Content delivery to Orders API: API calls
- Orders API to Uploads (stored data line): store files
- Orders API to Job queue (asynchronous line): enqueue
- Job queue to Background worker (dotted): event
- Background worker to Database (stored data line): writes
- Orders API to Database (stored data line): reads
- Source code to Build pipeline
- Build pipeline to Orders API (dotted): deploys image
- Orders API to Metrics and logs (dotted): telemetry
See also
| Doc | Why |
|---|---|
| Language reference | Every page of the reference and what each covers |
| Groups and overlays | The options a group takes |
| Group types guide | Every type drawn on its own |
| Icon names and lookup | How to find the icon for a service |