Your AWS architecture, drawn from the source of truth.
Connect an AWS account, scan it with a read-only role, and get a live interactive diagram of what is actually running. Then design changes on the same canvas, with AI to draft them and a review step before anything is written back.
“Add a read replica for core-db in a second AZ.” One RDS instance added, no existing resources modified. Estimated +$212/mo.
Read what exists. Draw what should. Let AI do the first draft.
The same canvas serves all three. Nothing you draw touches AWS until a plan is reviewed and approved.
A read-only scan builds the diagram: VPCs, subnets, security groups, compute, data, edge. Grouped the way AWS actually nests them, with per-resource cost and security findings on the node.
Move, add and remove resources on the canvas. CloudAtlas keeps a diff against what is live and turns it into a reviewable plan with cost delta, blast radius and the exact IAM actions required.
Describe the change in plain language against your real topology. You get a proposed diagram, a cost estimate and the permissions it needs. It arrives as a draft plan, never as a live change.
From credentials to a diagram, then to a reviewed change.
Four steps. The first three are read-only, and the fourth cannot start without a human approval.
Connect an AWS account
Launch a CloudFormation stack that creates a read-only IAM role scoped to describe and list calls, or paste an existing role ARN. Revoke it at any time from AWS.
"Action": [
"ec2:Describe*",
"rds:Describe*",
"elasticloadbalancing:Describe*"
]
Scan and get your diagram
CloudAtlas walks the account region by region and lays out what it finds. Re-scan on demand to pick up drift, or let a schedule keep the diagram current.
Design the change and send it for review
Edit the canvas by hand or ask AI for a draft. The result is a plan: what is added, changed and destroyed, the cost delta, and the permissions it would need. Reviewers comment or approve.
Provision after approval
PRIVATE BETAWrite-back is in private beta and off by default. It needs a separate, scoped write role, an approved plan frozen by content hash, and a dry run that passes. Destructive changes require a second approver.
Read-only by default. Nothing is written without review and approval.
The connection you start with cannot change your infrastructure. Write access is a separate, explicit step with its own role, its own approval, and a full audit trail.
A published read-only policy
The role grants describe and list calls only. The policy document is public, so you can diff it before you trust it.
No data plane access
Resource configuration and topology, never object contents, database rows or logs. No agents to install.
TLS 1.3 and AES-256
TLS 1.3 in transit, AES-256 at rest. Credentials are stored encrypted and scoped to a single workspace.
Approval is immutable
An approved plan is frozen by content hash. Any edit voids the approval and sends it back to draft.
Built for the parts of the job that are not drawing boxes.
Cost on the diagram
Monthly cost per resource on the node, rolled up per subnet, VPC and account, so the expensive part of the architecture is visible where you are looking.
Security findings in place
Open ports, public buckets and over-broad security groups flagged on the resource itself, with the rule that triggered it.
Drift detection
Re-scan and see what changed since the last snapshot, including changes made outside CloudAtlas by hand or by CI.
Multi-account workspaces
One workspace per client or environment, each with its own credentials, members and diagram history. Nothing leaks across them.
Roles and client views
Owner, admin, editor, viewer and client viewer. Clients see the diagram and nothing else; approval rights are granted deliberately.
Audit log
Every scan, plan, approval and execution recorded with actor, timestamp and the plan hash it acted on. Exportable.
Export and share
PNG and SVG for docs and decks, JSON for your own tooling, and a read-only link for people who should not have an account.
Templates
Start from a known-good pattern: three-tier web app, static site with CDN, queue-backed workers, or save your own.
GCP and Azure
AWS is what ships today. GCP and Azure scanning are on the roadmap and not yet available.
COMING SOONThree jobs, one diagram.
Know what you are paying for
You built the account over eighteen months of late nights and nobody has a picture of it. Scan it, see the cost per resource, and find the NAT gateway you forgot about.
Review architecture, not screenshots
Proposed changes arrive as a plan with a diff, a cost delta and a blast radius, so the design conversation happens before the pull request, not after the incident.
One workspace per client
Onboard a new account in minutes, hand the client a read-only view of their own architecture, and keep an audit trail of every change your team proposed.
Start free on one account.
Scanning and visualization are free forever on a single account. Paid plans add accounts, seats, AI and history.
For one account and one person who wants to see the picture.
For a product team running its own infrastructure.
For consultancies and MSPs managing other people's accounts.
The ones engineers ask first.
Can CloudAtlas change my infrastructure?
Not with the role you connect for scanning. It grants describe and list calls only. Write-back is a separate opt-in with its own scoped role, an approved plan and a passing dry run.
What data leaves my account?
Resource metadata and configuration: types, identifiers, tags, relationships, sizes. No object contents, no database rows, no application logs.
Does the AI have access to my account?
No. It reads the diagram CloudAtlas has already built and writes back a draft plan. It holds no credentials and cannot call AWS.
How is this different from a diagramming tool?
The diagram is generated from your account, so it does not go stale the week after you draw it. Changes you make are diffed against what is actually live.
Does it replace Terraform or CDK?
No. It sits earlier: understanding what exists and agreeing on what should change. Teams with IaC use it to see and review the architecture their code produced.
GCP or Azure?
Not yet. AWS is the only cloud CloudAtlas scans today. GCP and Azure are on the roadmap and we will not pretend otherwise on this page.
See your account as a diagram in the next five minutes.
Connect a read-only role, run a scan, and decide from there. Free on one account, no card.