Always use when user asks to create, generate, or build an AWS architecture diagram, cloud infrastructure diagram, or system diagram with AWS services. Also activates for draw.io diagrams mentioning AWS services like Lambda, DynamoDB, S3, API Gateway, etc.

AWS Architecture Diagram Skill Generate AWS architecture diagrams as native .drawio files using official AWS Architecture Icons. Optionally export to PNG, SVG, or PDF with embedded XML (so exported files remain editable in draw.io). How to create a diagram 1. Generate draw.io XML in mxGraphModel format following the rules below 2. Write the XML to a .drawio file using the Write tool 3. If the user requested an export format (png, svg, pdf), export using the draw.io CLI (see Export section) 4. Open the result with open (macOS), xdg open (Linux), or print the path Layout Rules Left to right flow for data/request path UI/Frontend on the LEFT (users access from left side) Data sources / external systems on the RIGHT Use horizontal lanes for parallel paths (top lane, bottom lane) Minimum 220px horizontal spacing between icons (room for edge labels) Minimum 250px vertical spacing between lanes Secondary/auxiliary services (monitoring, DLQ) go BELOW main flow with 280px+ gap Canvas: pageWidth="2400" pageHeight="1400" , viewport dx="2800" dy="1600" Always include a title block after the background rectangle: Icon Style Icons are from draw.io's built in mxgraph.aws4 stencil library — the official AWS Architecture Icons (https://aws.amazon.com/architecture/icons/) Icon size: 78x78px for main services, 65x65px for secondary Use sketch=0 on all icons Use strokeColor= ffffff on all AWS service icons Font size: 12px for labels NO colored backgrounds on group boxes — always fillColor=none 3D / Isometric Diagrams — use a different icon library If the user asks for a 3D , isometric , or "AWS 3D" diagram, do NOT fake it by placing flat aws4 icons on hand built platform/pedestal shapes. draw.io has a real, separate built in library for this: mxgraph.aws3d. . Load references/aws icons 3d.md before picking any icon — it has the verified shape table, style prefix, sizes, and the native isometricEdgeStyle edge templates. This library is a legacy pre 2019 icon set with much smaller coverage than aws4 (no API Gateway, ECS/EKS/Fargate, Step Functions, EventBridge, SNS, Aurora, CloudWatch, IAM, etc.). Check the gap table in that reference file before assuming an icon exists, and flag substitutions to the user rather than guessing a stencil name. For generic hardware (clients, on prem servers, racks, switches) with no AWS specific icon, see references/aws icons allied telesis.md — a separate bundled isometric image library that fills that gap. These icons are already 3D on their own — arrange them in an ascending isometric staircase (diagonal offsets between nodes), don't add fake platforms underneath. Use edgeStyle=isometricEdgeStyle (with endArrow=block override for reliable arrowheads) instead of orthogonalEdgeStyle for connectors. Edge Style — CRITICAL FOR CLEAN DIAGRAMS Base edge style: Edge label rules: Keep labels SHORT (1 2 words max). Detail goes in icon labels, not edge labels. Always add labelBackgroundColor= F5F5F5;fontSize=11; to edges with labels For edges WITHOUT labels: omit value entirely When NOT to label: if the flow is obvious (Lambda → DynamoDB doesn't need "Write") For edges to services ABOVE or BELOW main flow, use explicit exit/entry points: Exit bottom: exitX=0.5;exitY=1;exitDx=0;exitDy=0; Enter top: entryX=0.5;entryY=0;entryDx=0;entryDy=0; This prevents draw.io from routing lines through other icons Edge types: Solid ( strokeWidth=2 ): primary data flow Dashed ( strokeWidth=2;dashed=1; ): optional/async Red dashed ( strokeWidth=2;dashed=1;strokeColor= DD344C; ): error path Edge attachment (CRITICAL — fixes "green cross" problem): Every edge MUST have both source="<cell id " and target="<cell id " attributes referencing valid cell IDs NEVER create floating/unattached edges — all edges must be bound to shapes at both ends Always include exitX/exitY and entryX/entryY to define exact connection points on the shape perimeter Cross container edges: When source and target are in different containers, set the edge's parent="1" Visual Quality: straight arrows, no overlaps, professional layout A diagram with correct icons but a messy layout still reads as unprofessional. Check every diagram against these rules before finishing — they're deliberately concrete/checkable, not vague "make it look nice" advice: Align nodes to a consistent axis so edges are single, straight segments. Keep the horizontal or vertical delta between adjacent nodes in a flow constant (same lane y coordinate, same column spacing) so connecting edges render as one clean line instead of a dogleg. Align branch/secondary nodes on the exact same centerline as their parent. If a node branches off vertically (e.g. an auxiliary service below the main flow), its horizontal center must match its parent's horizontal center exactly — compute child.x = parent.center x child.width/2 , don't eyeball it. A few pixels of misalignment turns a "straight down" edge into a visibly crooked diagonal. One bend maximum per edge, ideally zero. If a computed edge path would need more than one bend to avoid an obstacle, the layout is wrong — move the node, don't add more bends to route around the problem. No edge may cross through an unrelated icon's bounding box. Before finalizing coordinates, check each edge's path against every icon's (x, y, width, height) rectangle it isn't connected to. If it would cross one, move the node or add an explicit exit/entry point to route around it. No two edges may run on top of each other or visually merge. If two edges would travel the same corridor (e.g. two parallel flows between the same pair of lanes), offset them — different exit/entry points, or an explicit waypoint — so there's a visible gap between them. Minimize edge crossings overall. Order nodes in the direction the data actually flows so edges rarely need to cross each other. If a crossing is unavoidable (e.g. a feedback/response path), route it with a visible offset rather than letting it overlap another edge. Keep spacing consistent, not just "enough." Use the same minimum step size between every pair of adjacent nodes in a flow — a diagram where some gaps are 400px and others are 250px reads as sloppy even if nothing technically overlaps. Balance the composition on the canvas. Don't leave one half of the page dense and the other empty; size the canvas to the actual content plus a consistent margin. Self check before finishing: after placing every coordinate, mentally trace each edge from source to target and verify (1) it doesn't cross any icon, (2) it doesn't overlap another edge, (3) it has at most one bend, (4) its endpoints are flush with the icons it connects. Fix the layout, not just the intent, if any check fails. PNG Export Background First element after root cells (lowest z order): AWS Icon Patterns (VERIFIED WORKING) resourceIcon (78x78, colored square frame) Service resIcon fillColor Lambda mxgraph.aws4.lambda ED7100 API Gateway mxgraph.aws4.api gateway E7157B EventBridge mxgraph.aws4.eventbridge E7157B SNS mxgraph.aws4.sns E7157B SES mxgraph.aws4.simple email service DD344C Step Functions mxgraph.aws4.step functions E7157B DynamoDB mxgraph.aws4.dynamodb C925D1 RDS mxgraph.aws4.rds C925D1 S3 mxgraph.aws4.s3 7AA116 CloudFront mxgraph.aws4.cloudfront 8C4FFF Route 53 mxgraph.aws4.route 53 8C4FFF ECS mxgraph.aws4.ecs ED7100 EC2 mxgraph.aws4.ec2 ED7100 Style template: productIcon (70x100, taller with service header bar) Service prIcon SQS mxgraph.aws4.sqs Style template: Standalone shapes (no resIcon needed) Shape shape value fillColor Client/Browser mxgraph.aws4.client 232F3D Traditional Server mxgraph.aws4.traditional server 232F3D Firewall mxgraph.aws4.generic firewall 232F3D ALB mxgraph.aws4.application load balancer 8C4FFF NLB mxgraph.aws4.network load balancer 8C4FFF VPC Endpoint mxgraph.aws4.endpoints 8C4FFF Group boundaries Group grIcon strokeColor AWS Cloud mxgraph.aws4.group aws cloud alt 232F3E Account mxgraph.aws4.group account CD2264 On premise mxgraph.aws4.group on premise 5A6C86 Corporate DC mxgraph.aws4.group corporate data center 388E3C VPC mxgraph.aws4.group vpc2 8C4FFF Subnet (public) mxgraph.aws4.group security group 7AA116 Subnet (private) mxgraph.aws4.group security group 147EBA Container nesting (CRITICAL for grouping): ALL group/boundary shapes MUST include container=1;dropTarget=1; in their style Child cells inside a boundary MUST set parent="<boundary cell id " instead of parent="1" This ensures moving a boundary moves all its children together Child geometry coordinates are relative to the parent container , not the canvas Cross container edges: When source and target are in different containers, set the edge's parent="1" BROKEN Icons — DO NOT USE resIcon=mxgraph.aws4.dynamodb table — renders as empty colored square resIcon=mxgraph.aws4.dynamodb stream — renders as empty colored square resIcon=mxgraph.aws4.general saml token — renders as black square resIcon=mxgraph.aws4.endpoint — may not render resIcon=mxgraph.aws4.kinesis data streams — unreliable Alternatives: DynamoDB tables/streams → use resIcon=mxgraph.aws4.dynamodb with descriptive labels External systems → use shape=mxgraph.aws4.traditional server Browsers/clients → use shape=mxgraph.aws4.client Audience Mode Before generating, assess the target audience: Technical : Use service names, protocol labels (HTTPS, gRPC), CIDR blocks, instance types Non technical : Use action labels ("Store Data", "Send Notification"), hide implementation details, use numbered flow (① ② ③) If unclear, ask: "Technical audience or executive/non technical?" Numbered flow edges (for non technical mode) Instead of technical labels, show flow order with circled numbers: Flow A: ① → ② → ③ → ④ (white circled numbers) Flow B: ❶ → ❷ → ❸ → ❹ (black circled numbers for second flow) Use edge labels: value="①" with fontSize=14;fontStyle=1;labelBackgroundColor= ffffff; Companion Guide After generating the .drawio file, also generate a markdown guide: Same filename with .md extension Contents: diagram title, flow description (numbered steps), service list with purpose, key design decisions Two Step Edit Approach After generating the initial .drawio file: 1. Export to PNG using the draw.io CLI (see Export section) 2. Review the PNG visually — check for empty/broken icons, overlapping edges, misaligned labels 3. Fix issues in the .drawio XML and re export This catches rendering problems (wrong stencil names, broken styles) that are invisible in raw XML. Icon Name Gotchas — CRITICAL draw.io stencil names do NOT always match current AWS service names. Services that were renamed keep their legacy stencil names: AWS Service Name draw.io resIcon name Why Amazon OpenSearch Service elasticsearch service Renamed from Elasticsearch in 2021; opensearch service also works Amazon EventBridge eventbridge Was CloudWatch Events AWS Fargate fargate Correct VPC Peering peering Resource level: shape=mxgraph.aws4.peering;strokeColor=none — NOT vpc peering or peering connection (those render as blank squares) Amazon MSK managed streaming for kafka NOT msk (renders as blank square) IAM Identity Center single sign on NOT iam identity center (renders as blank square) Rule: Always verify icon names

aws-architecture-diagram