# Group types

> Page: https://docs.plotwork.dev/reference/language/group-types. Index of every page: https://docs.plotwork.dev/llms.txt

Every group type with its frame style and tone, the icon each draws for each provider, and a complete cloud architecture diagram.

## TL;DR

| Question | Answer |
|---|---|
| How many group types are there? | 30: `cloud`, `account`, `region`, `zone`, `network`, `subnet`, `public-subnet`, `private-subnet`, `management-subnet`, `isolated-subnet`, `resource-group`, `cluster`, `scale-group`, `service-plan`, `web-tier`, `app-tier`, `data-tier`, `storage-account`, `messaging`, `edge`, `security`, `identity-boundary`, `trust-boundary`, `observability`, `ci-cd`, `environment`, `cloud-boundary`, `on-premises`, `client-side`, `external-systems`. |
| What does a type decide? | The icon in the corner tab, the tone, and the frame style: dashed for boundaries, solid for containers, dotted for things outside the system. |
| Which providers change the icon? | `aws`, `gcp`, `azure`, `alibaba`, `oci`, `ibm`, `cloudflare`, `digitalocean`, `vercel`. With none, a type draws its generic icon. |
| What is a group with no type? | A frame with only its name, in the `neutral` tone, unless its name gives its type for certain, such as `VPC`, `Production` or `Kafka`. `type=none` keeps it plain. |

## Types

Pick the type that says what the group is, not what it looks like. The frame style carries meaning: network and trust boundaries are dashed, logical containers are solid, and things outside the system are dotted. Nesting deepens the shade, so an account, a region, and a network read as three levels. The [group types guide](https://docs.plotwork.dev/cloud-architecture/group-types.md) draws every type.

| `type=` | Use it for | Frame | Tone |
|---|---|---|---|
| `cloud` | A provider's whole cloud: the outermost frame that holds its accounts, regions, and networks. | solid |  neutral |
| `account` | An account, subscription, or project: the container of one provider's resources that bills and grants access together. | solid |  neutral |
| `region` | A geographic region of a provider, such as eu-west-1 or West Europe. | dashed |  neutral |
| `zone` | An availability zone inside a region, drawn as a column. | dashed |  neutral |
| `network` | A VPC, VNet, or other private network that holds subnets and resources. | dashed |  blue |
| `subnet` | A subnet inside a network whose role is not public, private, management, or isolated. | solid |  neutral |
| `public-subnet` | A subnet whose resources can be reached from the internet, such as load balancers and bastion hosts. | solid |  green |
| `private-subnet` | A subnet with no direct route from the internet, such as application servers and databases. | solid |  violet |
| `management-subnet` | A subnet for administration: jump hosts, bastions, and tooling that operators use. | solid |  amber |
| `isolated-subnet` | A subnet with no route in or out of the network, such as a database that only the application tier can reach. | solid |  red |
| `resource-group` | A logical group of resources that are managed together, such as an Azure resource group. | solid |  neutral |
| `cluster` | A Kubernetes or container cluster. | solid |  violet |
| `scale-group` | An auto scaling group, scale set, or managed instance group of identical machines. | solid |  aqua |
| `service-plan` | A hosting plan that runs several apps on shared compute, such as an App Service plan. | solid |  violet |
| `web-tier` | The layer that faces users: web servers and the load balancer in front of them. | solid |  blue |
| `app-tier` | The layer that runs application code: application servers, services, or functions. | solid |  violet |
| `data-tier` | The layer that holds databases and caches. | solid |  aqua |
| `storage-account` | A storage account or a set of buckets and file shares. | solid |  amber |
| `messaging` | Queues, topics, and event buses that decouple services. | solid |  orange |
| `edge` | The public edge in front of the application: DNS, CDN, and front doors. | solid |  blue |
| `security` | Security services such as firewalls, web application firewalls, and key management. | solid |  red |
| `identity-boundary` | The area that authenticates users and issues tokens: an identity provider and its directory. | dashed |  violet |
| `trust-boundary` | A line across which trust changes: what is inside is checked differently from what is outside. | dashed |  neutral |
| `observability` | Monitoring, logging, and tracing. | solid |  aqua |
| `ci-cd` | A build and release pipeline with its repositories. | solid |  violet |
| `environment` | A deployment environment such as development, staging, or production. | solid |  amber |
| `cloud-boundary` | The line between your own premises and the cloud: everything inside is on the cloud side. | dotted |  blue |
| `on-premises` | A data center or office network that you run yourself, outside any cloud. | dotted |  neutral |
| `client-side` | Browsers, mobile apps, and devices that call the system. | dotted |  neutral |
| `external-systems` | Third-party services and partners that you call but do not run. | dotted |  neutral |

## Icons by provider

Without a provider a type draws its generic icon. With one, the type draws that provider's icon where the provider has one, and a provider with no icon of its own for a type draws the generic one. Each cell shows the icon that is drawn and its name.

| `type=` | No provider | AWS | Azure | Google Cloud |
|---|---|---|---|---|
| `cloud` |  `lucide:cloud` |  `aws:cloud-group` |  `azure:cloud` |  `gcp:cloud` |
| `account` |  `lucide:cloud` |  `aws:account` |  `azure:subscriptions` |  `gcp:cloud` |
| `region` |  `lucide:map-pin` |  `aws:region` |  `lucide:map-pin` |  `lucide:map-pin` |
| `zone` |  `lucide:layers` |  `lucide:layers` |  `lucide:layers` |  `lucide:layers` |
| `network` |  `lucide:network` |  `aws:virtual-private-cloud-vpc` |  `azure:virtual-network` |  `gcp:vpc` |
| `subnet` |  `lucide:waypoints` |  `lucide:waypoints` |  `azure:subnet` |  `lucide:waypoints` |
| `public-subnet` |  `lucide:lock-open` |  `aws:public-subnet` |  `lucide:lock-open` |  `lucide:lock-open` |
| `private-subnet` |  `lucide:lock` |  `aws:private-subnet` |  `lucide:lock` |  `lucide:lock` |
| `management-subnet` |  `lucide:settings` |  `lucide:settings` |  `lucide:settings` |  `lucide:settings` |
| `isolated-subnet` |  `lucide:door-closed` |  `lucide:door-closed` |  `lucide:door-closed` |  `lucide:door-closed` |
| `resource-group` |  `lucide:boxes` |  `lucide:boxes` |  `azure:resource-groups` |  `lucide:boxes` |
| `cluster` |  `lucide:container` |  `aws:eks` |  `azure:aks` |  `gcp:gke` |
| `scale-group` |  `lucide:server-cog` |  `aws:auto-scaling-group` |  `azure:vm-scale-sets` |  `gcp:compute-engine` |
| `service-plan` |  `lucide:server` |  `aws:ecs` |  `azure:app-service-plans` |  `gcp:cloud-run` |
| `web-tier` |  `lucide:monitor` |  `lucide:monitor` |  `lucide:monitor` |  `lucide:monitor` |
| `app-tier` |  `lucide:server` |  `lucide:server` |  `lucide:server` |  `lucide:server` |
| `data-tier` |  `lucide:database` |  `aws:rds` |  `azure:sql-database` |  `gcp:cloud-sql` |
| `storage-account` |  `lucide:hard-drive` |  `aws:s3` |  `azure:blob-storage` |  `gcp:cloud-storage` |
| `messaging` |  `lucide:send` |  `aws:sqs` |  `azure:service-bus` |  `gcp:pubsub` |
| `edge` |  `lucide:globe` |  `aws:cloudfront` |  `azure:front-door` |  `gcp:cloud-cdn` |
| `security` |  `lucide:shield-check` |  `aws:waf` |  `azure:firewall` |  `gcp:security-identity` |
| `identity-boundary` |  `lucide:id-card` |  `aws:iam` |  `azure:entra-id` |  `gcp:iam` |
| `trust-boundary` |  `lucide:shield` |  `lucide:shield` |  `lucide:shield` |  `lucide:shield` |
| `observability` |  `lucide:activity` |  `aws:cloudwatch` |  `azure:monitor` |  `gcp:observability` |
| `ci-cd` |  `lucide:workflow` |  `aws:codepipeline` |  `azure:devops` |  `gcp:devops` |
| `environment` |  `lucide:rocket` |  `lucide:rocket` |  `lucide:rocket` |  `lucide:rocket` |
| `cloud-boundary` |  `lucide:cable` |  `lucide:cable` |  `lucide:cable` |  `lucide:cable` |
| `on-premises` |  `lucide:factory` |  `aws:corporate-data-center` |  `lucide:factory` |  `lucide:factory` |
| `client-side` |  `lucide:monitor-smartphone` |  `lucide:monitor-smartphone` |  `lucide:monitor-smartphone` |  `lucide:monitor-smartphone` |
| `external-systems` |  `lucide:plug` |  `lucide:plug` |  `lucide:plug` |  `lucide:plug` |

## A complete example

### Flow: Web application on a cloud

A complete architecture diagram. Every group has a type, every service has a provider icon, two nodes carry stack marks, and two edges are dotted.

**Diagram source**

```diagram
flow "Web application on a cloud" provider=azure direction=down desc="Visitors load a single-page app from storage through a content delivery network and sign in through an identity service. The app calls an API on an application plan, which stores uploads, reads a database, and hands slow work to a queue that a background worker drains. A pipeline builds and deploys the API, and a monitoring service collects telemetry."

node visitors client "Visitors" sub="Browsers"

group edge "Edge" type=edge {
  node cdn gateway "Content delivery" icon=azure:cdn
}

group sign-in "Sign-in" type=identity-boundary {
  node idp identity "Identity service" icon=azure:entra-id
}

group files "Storage" type=storage-account {
  node site storage "Web app files" icon=azure:blob-storage stack=simple:react,simple:typescript
  node uploads storage "Uploads" icon=azure:blob-storage
}

group plan "Application plan" type=service-plan {
  node api service "Orders API" icon=azure:app-service stack=simple:nodedotjs
}

group messaging "Messaging" type=messaging {
  node jobs queue "Job queue" icon=azure:service-bus
}

node worker function "Background worker" icon=azure:functions stack=simple:nodedotjs
node db database "Database" icon=azure:sql-database

group delivery "Delivery pipeline" type=ci-cd {
  node repo step "Source code" icon=lucide:git-branch
  node build step "Build pipeline" icon=azure:devops
}

group monitoring "Monitoring" type=observability {
  node telemetry service "Metrics and logs" icon=azure:monitor
}

visitors -> cdn : "HTTPS"
visitors -> idp : "sign in" role=identity
cdn -> site
cdn -> api : "API calls"
api -> uploads : "store files" role=data
api -> jobs : "enqueue" role=async
jobs ..> worker : "event"
worker -> db : "writes" role=data
api -> db : "reads" role=data
repo -> build
build ..> api : "deploys image"
api ..> telemetry : "telemetry"
```

*Picture: Web application on a cloud: 12 nodes, 12 connections. Visitors load a single-page app from storage through a content delivery network and sign in through an identity service. The app calls an API on an application plan, which stores uploads, reads a database, and hands slow work to a queue that a background worker drains. A pipeline builds and deploys the API, and a monitoring service collects telemetry.*

**Text description**

**Nodes:**

- Visitors (Browsers), client
- Background worker, function, stack: nodedotjs
- Database, database
- Edge: Edge
  - Content delivery, gateway
- Identity: Sign-in
  - Identity service, identity
- Storage: Storage
  - Web app files, storage, stack: react, typescript
  - Uploads, storage
- Service plan: Application plan
  - Orders API, service, stack: nodedotjs
- Messaging: Messaging
  - Job queue, queue
- CI and CD: Delivery pipeline
  - Source code, step
  - Build pipeline, step
- Observability: Monitoring
  - Metrics and logs, service

**Connections:**

- Visitors to Content delivery: HTTPS
- Visitors to Identity service (identity line): sign in
- Content delivery to Web app files
- Content delivery to Orders API: API calls
- Orders API to Uploads (stored data line): store files
- Orders API to Job queue (asynchronous line): enqueue
- Job queue to Background worker (dotted): event
- Background worker to Database (stored data line): writes
- Orders API to Database (stored data line): reads
- Source code to Build pipeline
- Build pipeline to Orders API (dotted): deploys image
- Orders API to Metrics and logs (dotted): telemetry

## See also

| Doc | Why |
|---|---|
| [Language reference](https://docs.plotwork.dev/reference/language.md) | Every page of the reference and what each covers |
| [Groups and overlays](https://docs.plotwork.dev/reference/language/groups.md) | The options a group takes |
| [Group types guide](https://docs.plotwork.dev/cloud-architecture/group-types.md) | Every type drawn on its own |
| [Icon names and lookup](https://docs.plotwork.dev/cloud-architecture/icon-names.md) | How to find the icon for a service |