What a drawn line actually means, why the diagram is a snapshot, and the toggles that make a large environment readable.
Architecture diagrams
The Architecture view on Resources draws what can reach what, discovered from your providers' real configuration.
A line is never a guess
An edge between two resources is drawn only when the provider's own configuration says so, and the
line carries the reason as its tooltip — for example sg-0db allows tcp/5432 from sg-0app.
Sharing a VPC or a subnet is never enough on its own. A forty-resource VPC would otherwise draw sixteen hundred meaningless lines, and a diagram that says everything reaches everything says nothing. Direction comes from the rule itself, because an ingress rule states who may connect to whom — nothing infers it.
A rule whose source is an address range rather than another resource cannot name a source resource, so it becomes an exposure on the node instead — which in the Flow layout is what draws the arrow from the public internet.
It is a snapshot
The scan runs on demand and stores its result, so the diagram loads instantly and still renders when a connection's credentials are broken. The age of the scan is on the toolbar and turns amber past a week.
The shape is as of the scan. A resource's own name and status are always as of now, a resource you untracked since the scan is dropped, and one imported since is reported as missing from the snapshot rather than invented — its placement is genuinely unknown until you rescan.
A connection the scan could not fully read yields a partial graph with the gap stated, never a failed scan.
Two layouts
Diagram nests each resource inside the network boundary it really lives in — VPC, then subnet. It answers "where is this deployed".
Flow ranks the same graph left to right as a request path: internet in, front doors, services, data, and back out. It answers "how does a request get here".
Switching between them makes no request — it is the same snapshot, rendered differently.
Making a large environment readable
Past roughly thirty boxes, an environment with a hundred permitted reaches genuinely is a hundred lines, and no amount of routing makes all of them individually readable at once. The controls that help, all in the Display panel:
Hover a box. Everything it does not touch fades, and everything it does thickens. One hop, not transitive — "what can this eventually reach" lights up nearly everything, which is the same as lighting up nothing.
Group identical folds structurally identical siblings into one stacked card. "Identical" is strict: same type, and the same set of drawn connections. Twelve Lambdas behind one gateway become one card; an eleventh that also reaches a database stays its own card, because it genuinely is different.
Network only re-anchors every edge onto the boundary each end sits in, answering "how does traffic move between these networks" instead of "which resource may reach which".
Security groups draws the permitting group as its own box in front of what it protects — the view to turn on for a firewall review, and off the rest of the time.
Find dims everything but a name match and centres the view on each hit, which is a different question from the screen's filters: filtering removes the neighbours that make the answer mean anything.
Arranging is shared with your team and survives every rescan — drag a box and it stays where you put it. Arrange styles only move the boxes nobody has placed by hand, which is what makes trying them safe.
Declaring what the scan cannot see
A dependency no provider configuration states — a partner's API, a third-party webhook, a service in somebody else's account — is recorded by hand, either from the resource's own panel or by clicking "Declare by clicking" on the canvas and picking both ends. Declared edges are drawn dashed, so a stated connection is never mistaken for a discovered one, and they survive every rescan.
Exporting
Both canvases export SVG, PNG or JPEG, generated from the layout rather than screenshotted — so the export always matches what is on screen, minus the things that only make sense on screen (hover highlighting, the minimap). It is always light-themed and at full size, whatever your theme or zoom.
There is also a Mermaid export, for pasting the graph into a document that renders it.