AWS architecture builder
Draw an AWS architecture on an interactive diagram — VPCs, subnets and 40 services, from web tiers to data lakes, warehouses, stream processing and search — configure each service, see a rough monthly cost, and download a TypeScript AWS CDK app that synthesises.
Added
Works with
- System design interviews Interview prepreference architectures to rebuild here with real AWS services
How to use it
An architecture-diagram editor for AWS that knows what the boxes mean. Drag services onto the
canvas, drop servers and databases into the subnets of a VPC, and connect them: each connection
is checked (an API Gateway can invoke a Lambda function; S3 can’t write to DynamoDB by itself) and
becomes code — least-privilege grant* permissions, event sources, security-group rules, alias
records. Alongside the diagram you get a live TypeScript AWS CDK v2 app, a monthly cost estimate
with editable usage assumptions, and a list of checks (a public bucket, a single-AZ database in
production, a queue without a dead-letter queue, a port open to the internet). Nothing is sent
anywhere: the builder never talks to AWS, and your designs stay in this browser.
How to use it
Start from one of twenty-three example architectures (Examples ▾), grouped as websites and web apps, serverless APIs, events and jobs, data and streaming, data and analytics, and containers; each shows a one-line summary and its rough monthly cost. Every example has a hand-made layout, sensible settings and usage assumptions; with nothing selected, the inspector explains what the example shows and why it is built that way (Linking to an example, below, lists them all). Or choose Design ▾ → New empty design.
Add services by dragging them from the palette on the left onto the diagram, or tap one to drop it in the middle of the view. On a phone, ＋ Add opens the palette as a sheet. Services are colour-coded by category with simple generic glyphs (they are not AWS’s official icons).
VPCs are containers. A VPC is drawn with a band per subnet tier — public, private (out to the internet through a NAT gateway) and isolated (no internet at all) — and a column per Availability Zone. Drop EC2 instances, Auto Scaling groups, load balancers, ECS services, EKS clusters, databases, caches, EFS, MSK, Redshift, OpenSearch domains and Airflow into the band where they belong; the band decides the subnets in the code. Multi-AZ services (load balancers, Fargate services, Auto Scaling groups, RDS Multi-AZ, Aurora) spread across every AZ of their tier; a single EC2 instance uses the AZ column it sits in. Lambda functions sit outside the VPC unless you drop them into a private subnet (they need to be inside to reach a database); the same goes for Flink applications and EMR Serverless, and an OpenSearch domain outside a VPC gets a public endpoint (and a warning). Drag a VPC by its border to move it with everything in it, and by its corner to resize it.
Connect two services by dragging from the arrow handle of the selected service (or any of the four ports that appear on hover) to another service. The status line tells you, before you let go, whether the connection is allowed and what it will mean; an invalid one explains why and suggests what to do instead. Connections have kinds — routes to, invokes, reads/writes, reads, writes, triggers (an event source), publishes/subscribes, mounts, attached, monitors — and some let you choose (a function can read, write or read and write a table). Select a connection to change its kind and its details: an API route path, an S3 key prefix/suffix filter, an EventBridge event pattern or schedule, a DNS record name, a load-balancer path rule, a WebSocket route key. A few connections need a setting first: a function posts back to clients only through an API Gateway of type WebSocket API; EventBridge rules and Step Functions start a Fargate service whose Runs as is On-demand task (it then has no long-running service, and its cost is runs × minutes); and Cognito connected to an Application Load Balancer makes every visitor sign in before a request reaches a target, which needs the load balancer’s HTTPS listener. On a phone, select a service and use Connect, then tap the target — or turn on ⤳ Connect mode.
Configure a service by selecting it: the inspector shows the settings that matter (instance
types, memory and timeouts, Multi-AZ, capacity modes, encryption, retention…) with defaults and a
short explanation, the security-group rules derived from its connections (and a box for extra
rules such as 10.0.0.0/16 5432), its connections, and its usage assumptions and monthly cost.
Hover over anything for a summary.
Move around: drag the background to pan, use the wheel or pinch to zoom (a trackpad’s two-finger scroll pans), Shift-drag to select several services, ⊞ Layout to arrange everything left to right by request flow and ⤢ Fit to zoom to fit. ▶ Request path animates a request from the Users node through the architecture (with reduced motion it simply highlights the path). $ shows each service’s monthly cost on the diagram and Aa toggles the connection labels. Drag the diagram’s bottom edge to make it taller (double-click the edge to go back to the default, which follows the height of the window); the height is remembered.
Full screen: ⛶ Full screen at the top right (or F) gives the whole tool the screen — the diagram, the CDK code, the cost and the checks — using the browser’s full-screen mode, or filling the window where the browser can’t (an iPhone). The diagram takes all the room left and refits to it; ◧ Services and Inspector ◨ (or [ and ]) hide and show the side panels, so the diagram can run edge to edge, and the choice is remembered. Esc or ✕ Exit leaves, back where you were on the page.
Keyboard: Delete removes the selection, ⌘Z / ⇧⌘Z undo and redo, ⌘D duplicates, ⌘A selects all, arrow keys nudge (Shift for bigger steps), C connect mode, L layout, 0 zoom to fit, 1 actual size, F full screen, [ / ] side panels (in full screen), P request path, G snap to grid, +/− zoom, Esc cancels (and leaves full screen). ? lists them.
Data & analytics: warehouse, batch, streams and the service tier
The Streaming, Data lake & warehouse and Batch & orchestration palette groups, plus the search services under Databases, caches & search, cover a whole data platform:
-
Stream processing — Kinesis Data Streams and MSK (provisioned brokers or Serverless, IAM auth) as sources; Managed Service for Apache Flink (parallelism, KPUs, autoscaling, checkpointing, snapshots; in or out of the VPC) reads Kinesis or MSK and writes S3, OpenSearch, Kinesis, Firehose or DynamoDB; Data Firehose reads a Kinesis stream (or takes direct puts) and delivers buffered batches to S3 — optionally converted to Parquet against a Glue table it creates, with Hive-style date partitions that Athena projects — or to an OpenSearch domain (VPC delivery) or collection, with an error/backup prefix.
-
Data lake and warehouse — the Glue Data Catalog (a database, the format and partitioning of its data, and an optional scheduled crawler over the buckets it catalogs); Athena (a workgroup with an enforced results location, encryption and a per-query scan limit, and a query role analysts assume); Redshift — Serverless (namespace + workgroup, base and maximum RPUs) or a provisioned RA3/DC2 cluster — which loads from S3 with COPY, queries the lake in place with Spectrum over the catalog, and ingests a Kinesis stream directly.
-
Batch and orchestration — Glue ETL jobs (Glue 6.0 or 5.0, worker type and count, Flex, bookmarks, an optional schedule), EMR Serverless (Spark or Hive, arm64 or x86, a capacity ceiling, auto-stop) and MWAA (Apache Airflow, with a versioned DAG bucket). Step Functions runs Glue jobs and EMR Serverless jobs and waits for them, and starts crawlers; EventBridge schedules Step Functions (it can’t start a Glue job directly).
-
Service tier — an OpenSearch Service domain (data node type and count, dedicated masters, zone awareness, Multi-AZ with standby, gp3 storage, encryption, fine-grained access control), an OpenSearch Serverless collection (search, time series or vector; standby replicas), and ElastiCache (Valkey or Redis OSS, nodes with replicas and cluster-mode shards, or Serverless) for the cached results in front of them.
Connecting Athena or Redshift to a catalog also grants read access to the buckets behind its tables (the buckets it catalogs and the Firehose destinations that write tables into it), so a diagram needs no extra lines for that. Checks cover the usual traps: an OpenSearch domain outside a VPC, without fine-grained access control or encryption, single-AZ in production, or with data nodes that don’t divide over its AZs; a publicly accessible Redshift; Redshift Serverless with enhanced VPC routing in fewer than three AZs; Athena over un-partitioned or row-format data or without a scan limit; a Firehose stream with no error prefix, two destinations, a Kinesis source plus direct writers, or Parquet without a catalog or a 64 MB buffer; Flink without checkpointing; Glue jobs without bookmarks or with Flex on G.4X/G.8X; Airflow with an unversioned DAG bucket; and ElastiCache cluster mode without replicas.
The CDK code
The CDK code tab shows the generated app, highlighted, file by file: bin/<name>.ts,
lib/<name>-stack.ts, package.json, cdk.json (with the feature flags cdk init writes),
tsconfig.json, a README with the resource list, cost and checks, and a stub handler in
lambda/<function>/ for every Lambda function. Download .zip gives you the whole project;
npm install && npx cdk synth builds it. Show code in the inspector (or Jump to service)
highlights the lines a service produced.
The code uses L2 constructs from aws-cdk-lib wherever they exist — including the OpenSearch
domain and the Firehose stream to S3 with Parquet conversion — and L1 (Cfn…) resources for
ElastiCache, MSK, WAF, Redshift, Glue, Athena, EMR Serverless, Managed Flink, MWAA, OpenSearch
Serverless and Firehose to OpenSearch, which have no stable L2 (the Glue, Redshift and Flink L2s
are still alpha modules). Glue jobs, EMR jobs and Flink applications get stub code under
glue/, emr/ and flink/, uploaded as S3 assets. Each connection becomes a grant* call (grantReadWriteData,
grantSendMessages, grantPublish, grantPull…), an event source, a subscription, an
EventBridge rule, a target-group target, a CloudFront origin, an alias record or a security-group
rule, and functions and containers get environment variables naming what they are connected to.
Where CDK has no grant method — the Glue Data Catalog, Athena, the Redshift Data API, MSK,
OpenSearch Serverless, Airflow’s execution role, EMR Serverless job runs, VPC access for Flink
and Firehose — the code adds explicit iam.Grant.addToPrincipal statements scoped to the one
database, workgroup, cluster or application they are for (the few actions AWS only allows on
, such as Data API statement calls, say so in a comment). Every VPC resource gets its own
security group. The *Dev/Prod switch picks the removal
policies explicitly — dev destroys everything with the stack, prod retains data, snapshots
databases and turns on deletion protection — and makes the checks stricter. The stack is pinned
to the chosen region but not to an account, and the VPC names its Availability Zones, so
cdk synth needs no AWS credentials or context lookups.
All twenty-three examples — and a design that uses every data & analytics service at once — are
checked by actually synthesising them with aws-cdk-lib 2.273 and no AWS credentials or context
lookups, type-checking with TypeScript 5.9, and requiring a clean
report from the CloudFormation template validation that cdk synth runs. Generated code is a
starting point: read it, run cdk diff, and only then deploy.
Cost estimates
The Cost tab totals a rough monthly cost per service with a bar chart, the biggest cost drivers, and the charges that are easy to overlook — NAT gateways (about $33 a month each before any traffic, plus $0.045 per GB), public IPv4 addresses ($0.005 an hour each, including the ones behind an internet-facing load balancer), cross-AZ traffic and data transfer to the internet — and the floors and minimums of the data services: OpenSearch Serverless bills at least 2 OCUs (about $350 a month; 1 OCU without standby replicas) however idle it is, Redshift Serverless bills at least its base RPUs while any query runs (60 seconds minimum), a Flink application pays one extra KPU around the clock, MWAA bills its environment every hour, ElastiCache Serverless bills at least 100 MB (Valkey) or 1 GB (Redis OSS), Athena scans of un-partitioned data, and MSK clients talking to brokers in other AZs. Expand a row to edit its usage assumptions (requests, GB stored or transferred, average duration, read and write units, average tasks or instances…) and to see each line as quantity × rate.
Prices are public on-demand list prices for us-east-1, read on 14 October 2026 from AWS’s public price-list files and pricing pages (every row links to its page, e.g. https://aws.amazon.com/lambda/pricing/). The other regions — us-west-2, eu-west-1, eu-central-1, ap-southeast-2 and ap-northeast-1 — multiply them by a ratio measured from the same files per family (EC2, Fargate, databases, storage, serverless, API Gateway, NAT, data transfer…). Apply always-free allowances subtracts the always-free tier (1M Lambda requests and 400,000 GB-s, 1M SQS requests and SNS publishes, 25 GB of DynamoDB, 1 TB and 10M requests of CloudFront, 100 GB of data out, 10,000 Cognito users…), shared across the design. The 12-month trials and the credit-based free plan for accounts created after July 2025 are not modelled. The data & analytics prices (Redshift $0.375 per RPU-hour and RA3 node-hours, Athena and Spectrum $5 per TB scanned, Glue $0.44 per DPU-hour — $0.308 on Glue 6.0, Flex $0.29/$0.203 — and crawlers at $0.44 with a 10-minute minimum, EMR Serverless per vCPU- and GB-hour, Flink $0.11 per KPU-hour, Firehose $0.029 per GB plus $0.018 for Parquet conversion, OpenSearch instance-hours and $0.122 per GB of gp3, OpenSearch Serverless $0.24 per OCU-hour, MWAA environment- and worker-hours, MSK broker-hours and storage) were read on 15 October 2026 from the same public price-list files; the Glue Data Catalog’s first million objects and requests are always free. Treat the total as a rough estimate and check it with the AWS Pricing Calculator.
Checks and designs
The Checks tab lists errors (things that won’t deploy or are unsafe), warnings and notes, with Fix buttons where the fix is a setting, plus the inbound network rules of every security group. Badges on the diagram show which service has a problem.
Designs autosave in this browser (localStorage) as you work; keep several with Design ▾ (new, duplicate, rename, delete), and move them between machines with Export JSON / Import JSON. Export diagram as SVG/PNG saves a light-theme picture of the diagram. Share link packs the current design into the link — designs hold settings and names only, never secrets.
Limits
-
About 40 services, each with the settings that matter most — not every option. No Elastic Beanstalk, AppSync, Batch, SageMaker, EMR on EC2 or EKS, DynamoDB DAX, Lake Formation (grant access with IAM here; add Lake Formation permissions on top if you use it), Redshift data sharing, OpenSearch Ingestion, MSK Connect, VPC peering, Transit Gateway, multiple regions or multiple stacks, and no Route 53 health checks or failover records: the high-availability example survives the loss of an Availability Zone, not of a region.
-
WebSocket APIs route messages to Lambda functions only, with no Cognito authorizer (check the token in the
$connectfunction). SNS mobile push and SES email are not modelled — the chat and fan-out examples only show where they would go. -
Cognito sign-in on a load balancer needs a domain you own (for the certificate) and a Cognito domain prefix that is unique in the region; the generated one is a guess.
-
Lambda stubs are Node.js or Python (inline-buildable runtimes); EKS workloads are deployed with kubectl or Helm, not here; ECS images come from a public registry or a connected ECR repository (push your image before deploying).
-
A WAF for CloudFront and a CloudFront certificate for a custom domain must be created in us-east-1; in other regions the code leaves them out with a comment. HTTPS on an ALB needs a Route 53 zone connected to it for DNS validation, and you must own the domain.
-
Security groups allow all outbound traffic. Interface VPC endpoints are costed but not generated.
-
Costs ignore Savings Plans, Reserved Instances, Spot, volume tiers beyond the first, taxes and support, and assume 730 hours a month. Regional prices are ratios, not per-region tables. ElastiCache Serverless is priced at Valkey rates.
-
Data services: Glue, EMR and Flink code is a stub to replace; Flink runs PyFlink (add your connector JARs); Firehose delivers to S3 or OpenSearch only (Redshift needs a public endpoint, so load from S3 or use streaming ingestion instead) and doesn’t model dynamic partitioning or Lambda transforms; OpenSearch Serverless gets a public, IAM-signed endpoint (no VPC endpoint) and the classic minimum-OCU collections; MWAA is costed without extra schedulers or web servers. With fine-grained access control, map the callers' IAM roles to OpenSearch roles after deploying; the domain needs the OpenSearch service-linked role in the account. Redshift Serverless needs subnets in at least two AZs (three with enhanced VPC routing).
-
No Python CDK output (TypeScript only).
Related: DevOps YAML, Kafka, simulated, latency numbers, cron expressions.
Linking to an example
?example=<preset> opens an example as a new design in your browser (your other designs are
kept); add a tab after #: diagram (the default), code, cost or checks. Share link
writes your own design into a packed ?s= parameter.
| Parameter | Meaning | Example |
|---|---|---|
|
One of the presets below |
|
|
A packed design (made by Share link) |
— |
The rough monthly costs are for us-east-1 with each example’s usage assumptions (shown in the inspector), as of the price date above; (free tier) means the always-free allowances are applied.
| Preset | What it is | ≈ per month |
|---|---|---|
Websites and web apps |
||
S3 bucket (private, Origin Access Control) behind CloudFront, with a Route 53 alias and certificate |
$11 |
|
One CloudFront domain: the single-page app from S3 and |
$13 |
|
WordPress (or any PHP CMS) on an EC2 Auto Scaling group behind CloudFront and an ALB, sharing |
$214 |
|
CloudFront → ALB → ECS Fargate → RDS PostgreSQL Multi-AZ in a two-AZ VPC with one NAT gateway (prod) |
$217 |
|
High availability across three AZs: CloudFront with a WAF, an ALB, three Fargate tasks, Aurora with two readers, a replicated cache, a NAT gateway per AZ (prod) |
$1,179 |
|
Staff-only app: an internal ALB with Cognito sign-in (MFA required) and a WAF, Fargate, RDS and S3 encrypted with a customer managed key, flow logs, no public endpoint (prod) |
$197 |
|
Serverless APIs and apps |
||
Hobby project on the always-free tier: CloudFront, a private S3 site, one Lambda function (function URL) and an on-demand DynamoDB table |
$0.11 (free tier) |
|
HTTP API with a Cognito authorizer, two Lambda functions and a DynamoDB table, with alarms |
$11 |
|
Multi-tenant SaaS: REST API with a WAF and Cognito, a single-table DynamoDB design encrypted with KMS, EventBridge for usage metering and webhooks (with a DLQ) (prod) |
$172 |
|
WebSocket API with |
$49 |
|
Events, queues and jobs |
||
S3 upload → Lambda → SQS (with DLQ) → Lambda → DynamoDB, and EventBridge → Lambda → SNS |
$9.65 |
|
SNS → three SQS queues (each with a DLQ and alarms) → three Lambda consumers |
$17 |
|
EventBridge schedules: a nightly report and a 5-minute uptime check on Lambda (with DLQs and alarms), a weekly clean-up as a Fargate task |
$2.80 |
|
S3 events → EventBridge → Step Functions: transcode in a Fargate task, thumbnails in Lambda, a DynamoDB catalog, an SNS notice; CloudFront serves the renditions |
$82 |
|
Data and streaming |
||
Devices → Kinesis on-demand → Lambda → S3 data lake, with alarms |
$67 |
|
Devices → HTTP API → Lambda → Kinesis → Lambda → DynamoDB (latest state), S3 (archive) and SNS (anomalies) |
$91 |
|
Batch ETL: clickstream through Kinesis into a raw S3 zone; a nightly Step Functions workflow transforms it into a curated zone and records partitions |
$81 |
|
Data and analytics |
||
API → Kinesis; Flink aggregates into OpenSearch behind a Valkey-cached search API; Firehose lands Parquet in an S3 lake; a nightly Glue job curates it for Redshift Serverless and Athena (prod) |
$865 |
|
Devices → Kinesis → Flink: live aggregates into an OpenSearch Serverless time-series collection for dashboards, raw records archived to S3 |
$472 |
|
Product search service tier: Lambda → OpenSearch and a Valkey cache, DynamoDB as the source of truth with a stream-driven indexer (prod) |
$338 |
|
S3 raw and curated zones, a nightly Step Functions run of a Spark job on EMR Serverless and a Glue crawler, Athena and Redshift Serverless Spectrum over the catalog |
$204 |
|
Containers |
||
ECS Fargate services behind an HTTPS ALB with path routing, SQS between Orders and Fulfilment, Aurora Serverless v2, DynamoDB and a Valkey cache (prod) |
$463 |
|
EKS with a managed Graviton node group, ECR, Aurora Serverless v2, Valkey and S3 in a three-AZ VPC (prod) |
$517 |
|
For example the three-tier app’s costs or the WebSocket chat’s CDK code.
Feedback is a gift. Something to improve, a feature to add, or a bug? Tell me.
Runs entirely in your browser; nothing you type leaves this page.