TerraVision alternative: same source parse, but the diagram keeps itself current

The security posture is the strongest part. TerraVision runs entirely on your machine, your .tf code never leaves it, and no cloud credentials are needed to produce a diagram. For a client engagement or a regulated environment, that removes the conversation that kills most diagramming tools before the trial starts.

The output is also better than the category norm. AWS coverage is broad, with Google Cloud and Azure supported for core services, and multi-cloud stacks land on a single diagram. Relationships are found by scanning resource attributes for references to other resources, so count, for_each, and module variables are handled rather than flattened. The interactive HTML output gives clickable nodes, search, pan and zoom, and there is a draw.io export for anyone who wants to take the result into an mxGraph editor.

It was designed as a docs-as-code tool, so it slots into a pipeline stage after build and test, and it is free and open source under AGPL-3.0. Worth reading that licence before the output goes into a client deliverable, but none of the above is in dispute here.

The first is the toolchain. The project lists four prerequisites, Python 3.10 or newer, Terraform 1.x, Graphviz, and Git, and all four have to exist on every machine that wants a picture, CI runner included. That is a fine ask for the platform team and an impossible one for the product manager who wants to see how the environment is wired.

The second is artifact lifetime. The command produces a file. A file is stale the moment infrastructure merges, and it only stops being stale when a human or a pipeline regenerates it and re-commits it in the right place. Teams that set that pipeline up discover the second job: keeping the generated file from producing a noisy diff on every unrelated commit.

The third is audience. The people who need an architecture diagram most, a new joiner in week one, a security reviewer, an auditor, whoever is on call at 2am, are exactly the people who will not clone the repo and install Graphviz to look at it. A diagram that requires a toolchain to view has a small readership by construction.

Datadef parses the same thing, the source, and moves everything after the parse. You connect the repository once on GitHub, GitLab, or Azure DevOps with a read-only token (public repositories need none), pick the branch or tag that represents reality, and the diagram is generated server side. No init, no plan, no state file, no cloud credentials, nothing installed locally.

The parse resolves the same kind of structure TerraVision does, and it is worth being precise about how. A directory of .tf files is a module unit; a unit nobody references as a module source is a stack. References inside expressions resolve to the resources they reach, and variables and locals are followed rather than evaluated, so a var.subnet_id bound at a call site resolves to the subnet it points at without anything being computed. count and for_each become a real number: a literal map is counted directly, and a for_each driven by a variable is read out of the per-environment tfvars, which is where a node annotated per lakebase_projects (DEV 2, QUAL 1) comes from. A registry or git module cannot be expanded, so the call becomes one node labelled with its source and version, and its input wiring becomes the edges.

From there the diagram behaves like a service rather than a file. A daily sync re-reads the ref and regenerates the diagram and an architecture.md; commits that change nothing structural are skipped; node identity derives from Terraform addresses so a re-sync updates the picture instead of reshuffling it. You can also refresh on demand from the app or from a coding agent over MCP.

Distribution is the part a CLI cannot offer. The diagram embeds in a README, a Confluence page, or a Notion doc as a live image that follows the canvas, and viewers need no account and no toolchain. Curation happens before drawing: modules become zones, major resources keep their provider icons, and repeated minor types roll up into one node carrying the count and the member names. Role assignments, grants, IAM policies, secrets and everything from the random, null, tls and time providers are classified as wiring and never become boxes. They are counted instead, in a line that reads like 27 wiring resources not worth boxes: 14 role assignments, 8 grants, 5 secrets.

Air-gapped work, or any policy where source must not reach a third party, ends the discussion in favour of the local CLI, and rightly so. The same is true for a throwaway picture during a code review, where connecting anything is slower than typing a command.

The switch point is lifetime and audience. When the diagram has to still be true next quarter, and has to be readable by people who do not run CLIs, generation has to move off the laptop and onto a schedule.

• Terraform graph alternative
• Inframap alternative
• Visualize a Terraform repository
• Repo to diagram: repository sync
• Live embeds: one line, always current