Cloud architecture diagram template
A three-tier cloud workload drawn as a UML deployment diagram: nodes, the artifact that runs on one of them, and every path labelled with the protocol and port.
Notation: UML 2.5.1Diagram: Deployment diagram
Open this template in Archyno
It opens as an editable model, not an image. Change it in the browser, then export to PNG, SVG, Mermaid, XMI, or a Sparx .qea file.
Open this templateWhat is on this diagram
- Cloud region
- The boundary. Everything inside it is billed to you.
- Browser
- The only device outside the boundary, and the only untrusted one.
- CDN + object store
- The static edge. Rename to CloudFront, Cloudflare or your own.
- Load balancer
- The single entry point. Where TLS usually terminates.
- Application runtime
- Where your code runs. ECS, Cloud Run, a VM - the box is the same.
- app.jar
- The artifact. A deployment diagram without one is a network diagram.
- Managed database
- The store. Note the port: it is what the review will ask about.
How to make it yours
- Rename the nodes to your provider's services, and keep the stereotypes - device and executionEnvironment are the distinction that matters.
- Put the real protocol and port on every path. An unlabelled line is the one nobody can audit.
- Add a second boundary for the private subnet if anything must not be publicly reachable.
- Keep exactly one artifact per runtime node. Two means you have two deployables and should say so.
- Delete the cache before you delete anything else - most first drafts do not have one yet.
Common questions
Should an AWS architecture diagram use service icons?
It depends what the diagram is for. An icon diagram names the products and is the right choice for a sales deck; a deployment diagram names the paths, ports and artifacts, and is the one that survives a security review or an incident. This template is the second kind.
What is the difference between a node and an artifact?
A node is somewhere things run - a device or an execution environment. An artifact is the thing that runs there: a jar, a container image, a binary. A deployment diagram with nodes and no artifacts has drawn the infrastructure and left out the software.
How do I show a private subnet?
Nest a second boundary inside the region and put the runtime and database in it, leaving the load balancer outside. The nesting is the claim that nothing outside can reach in, which is exactly the claim worth writing down and checking.
Read the notation
AWS example
A worked AWS architecture example in UML: the deployment topology with real protocols and ports, and the component view where the vendor names turn back into contracts.
Deployment diagrams
How to read and draw a UML deployment diagram: nodes, devices and execution environments, artifacts, communication paths, and the deploy relationship.
Microservices example
A worked microservices architecture example: where to put synchronous contracts, where to publish events instead, and how to spot a distributed monolith on paper.