The map

Start at stage 0 and grow the map, or follow one request with a flow. Boxes show where each piece lives: outside AWS, in the VPC’s public or private subnets, or in an AWS-managed service outside the VPC. Select a piece to zoom and open its explanation. Use Fit to return to the overview.

List viewMap view

Stage 24 of 24

−+

CloudWatch alarms · Alerts SNS topic · CloudWatch dashboard

Show later stages

Find a piece

Connection layers Network · Security · IAM · Secrets · Data

Show connections

Network routesSecurity groupsIAM permissionsSecretsData flow

71 pieces introduced · 25 off in committed config · 3 new at this stage

Follow a flowExplore freelyOne booking, end to endSearch as you typeA failing email: retries, the DLQ and the alarmSale dayA deploy, from push to running tasksWhy can the api connect to Postgres?

Choose a flow to follow one connection at a time. Or click any piece on the map.

+−FitResetFull screen

71 pieces. Boxes show where each piece lives. Arrows appear for the selected piece, a role's permission statements or the current flow step; hover a line for its rule. Drag, scroll or pinch to move and zoom; on the map, + and − zoom, 0 fits and the arrow keys move.

Built before this stageNew at this stagePlanned / later stageOff in committed configPublic subnetsPrivate subnetsAWS-managed, outside the VPCSecurity group the piece usesNetworkSecurity group ruleIAM / permission statementSecretData flowConditional Deny

Click a role to highlight what its statements cover, or a resource to highlight its callers. The panel gives the exact scope and conditions. This map describes the code; it does not check live AWS state.