Best AWS architecture diagram tools

“I need a diagram for tomorrow's review”: the AWS architecture diagram generator draws it from a description, then spend your hour editing instead of placing boxes. “I do not trust that our docs match production”: that is an as-built problem, so scan the account with Cloudcraft or Hava. “Our diagram is always three quarters behind”: the update loop is broken, not the drawing tool, so embed a live diagram and let the repository or your agent own the updates. “We just need boxes in a README”: Mermaid, free, in the commit. “Nobody here writes code”: draw.io if it is one diagram, Lucidchart if a dozen people need to edit it.

Most teams land on two artifacts rather than one: an as-built view straight from the account when auditing, and one explainable architecture diagram that is generated, edited, and embedded everywhere people actually look. Trying to make a single diagram do both is the most common reason AWS documentation ends up satisfying nobody. If you are choosing between drawing it by hand and describing it, the AWS diagram tool page answers the two questions that decide it: how the generator compares to draw.io, and whether it can read your AWS account.

Yes, and the three automatic routes produce genuinely different diagrams, so the choice matters more than the automation.

Scan the account. Cloudcraft and Hava assume a read-only role and call the AWS APIs, so the output is inventory: every subnet, every security group, exactly as deployed. Nothing else in this comparison can prove what is running.

Parse the infrastructure code. A read-only connection to GitHub, GitLab, or Azure DevOps reads the branch or tag you choose and parses every .tf file without running terraform init, without touching state, and without any cloud credentials. Modules are drawn as zones, per-environment counts survive, and registry modules keep their version label. The diagram and an architecture.md are regenerated daily, which the living diagram from Terraform walkthrough covers end to end.

Let the agent draw it. If Claude Code or Cursor is already editing your infrastructure code, it can draw and later update the same canvas through an MCP server in the session that made the change.

Your hands: manual editors where you place each service and draw each arrow. Total control, total maintenance burden. Your account: scanners that call the AWS APIs and render what is deployed right now. Always true, rarely readable. Your words or your repo: generators that produce the diagram from a description or from infrastructure code, which you then edit. Fast and readable, but only as complete as what you told them.

None of these is best in general; each is best against a different failure mode. The reviews below are ordered from most manual to most automated.

Free, runs in the browser or offline, and ships the complete official AWS shape libraries. For a one-off diagram where you know exactly what you want to show, it remains the default answer, and nothing about it locks you in: files are XML you can keep in the repo.

The polished commercial version of the same idea: AWS shapes, team collaboration, comments, SSO, and templates, with paid seats. Where draw.io is a file, Lucidchart is a system of record with permissions, which is what larger organizations actually buy it for. Its cloud-visualization add-on can also import from a live account into an editable canvas.

The maintenance economics stay manual: a human still owns every update, now at a per-seat price. If your organization already pays for it, the marginal cost is zero; if not, the money question is whether you need the collaboration layer or just the diagram.

Account scanners connect to AWS with a read-only role and render your real deployed infrastructure, Cloudcraft (now part of Datadog) with its signature 3D isometric view and live cost overlays, Hava with automated versioned snapshots per VPC. For an as-built audit, a security review, or the moment someone asks “what are we actually running in eu-west-1”, this category is unbeatable, because the diagram cannot lie.

Where that line falls in practice is the whole decision, so it is worth reading the side-by-side of Cloudcraft and Datadef: one reads a live AWS account, the other reads the Terraform in your repository and keeps the modules and per-environment counts you already wrote. Teams whose infrastructure is declared rather than clicked usually find the second answer closer to the diagram they wanted.

The diagrams Python library defines AWS diagrams in code with official icons; Mermaid's architecture syntax renders directly in GitHub READMEs. Both versions of diagrams-as-code share the same virtue, the diagram diffs in review and changes in the same commit as the infrastructure, which is why they pair naturally with Terraform repos.

# diagrams (mingrammer), the diagram is code
with Diagram("Ingest", show=False):
    ALB("alb") >> ECS("api") >> RDS("orders")

The cost is layout control: past a couple dozen nodes you are fighting the auto-layout, and there are no zones, no deliberate placement, and no editing by anyone who does not write code. Strong for small per-service diagrams inside repos; weak as the big picture you present.

The newest category generates the diagram from a plain-English description and gives you an editable canvas to refine. Datadef's AWS architecture diagram generator produces architectures with the real AWS service icons, the same 439-icon library you would use manually, plus zones, labeled flows, and data lineage where it applies. Eraser takes a related approach from the diagram-as-code side with AI on top.

Two properties separate this category from a ChatGPT-drawn Mermaid sketch. The output is a real editable diagram, not frozen syntax: generation gets you to 80% in a minute and the mouse gets the last 20%. And the diagram can live on: embedded by link in a README or Confluence page, it updates everywhere when the canvas changes, which is the property the docs-sync comparison shows almost nothing else has.

If your team already codes with Claude Code, Cursor, or another agent, the drawing step can disappear entirely. Datadef exposes the canvas as an MCP server: the agent reads your Terraform or CDK, draws the AWS architecture with proper icons, and, the part that changes the economics, updates the same diagram in a later session when the infrastructure changes. The agent that made the change documents the change.

Combined with live embeds, this closes the full loop that keeps AWS docs honest: repo changes, agent updates canvas, every embedded copy is current. No other category in this comparison closes that loop today.

Network diagrams are a separate decision, because the thing reviewers care about is boundaries: which subnet a resource sits in, what has a route to the internet gateway, where traffic crosses an account. Scanners are strongest here for the as-built question, Hava in particular because it snapshots and versions per VPC, so you can show what changed between two dates. Manual editors handle it well too, since draw.io and Lucidchart both have AWS group shapes for VPCs and subnets, at the usual maintenance price.

For the network you are proposing rather than the one you have, describing it is faster than drawing it. The AWS network diagram generator draws subnets, route tables, NAT and internet gateways, security groups and NACLs, Transit Gateway, VPC peering, VPC endpoints, Direct Connect, and Site-to-Site VPN as nested containers, so subnet placement is visible without reading a legend. It has no account connector, so it will not discover a live VPC on its own: the input is your description, your Terraform or CloudFormation, or an agent reading the repo.

Everything in this comparison except the code libraries runs in a browser. draw.io, Lucidchart, Cloudcraft, and Datadef need nothing installed, so an AWS architecture diagram drawn online exports as PNG or JPEG from the same tab. The Python diagrams library is the exception, needing Python and Graphviz locally, and Mermaid renders inside GitHub or any Markdown viewer rather than in a canvas.

On price, the free end is genuinely free: draw.io, Mermaid, and the Python diagrams library cost nothing at any scale, and the AWS icon set itself is free to download whatever you draw in. Lucidchart and the account scanners are per-seat or per-account subscriptions. Datadef charges for neither seats nor accounts: everything except AI generation is included, and generation is metered in credits bought once that never expire.