Skip to main content

Architecture & Model Export

Generate publication-quality diagrams, MBSE models, and rebuildable infrastructure code directly from your live asset graph. Available in Topology → Architecture Diagrams.

This is an export/documentation capability — it does not change the interactive Topology view.

Scope​

Every export runs against one of two scopes:

  • Current Selection — the subgraph currently loaded in Explorer (pick a root node and relationship depth). Best for focused, readable diagrams.
  • Full System — the entire tenant graph. Text formats (Terraform, SysML, PlantUML) handle this at scale. Diagram and draw.io exports of very large estates are built as background jobs rather than in a single request.

Formats​

Terraform (rebuildable)​

Apply-grade Terraform that aims to rebuild the infrastructure that can be rebuilt — not just an inventory dump.

  • Modular layout: modules/<provider>/<region>/<vpc>/ — navigable at any scale instead of one giant main.tf.
  • Graph-driven references: resources reference each other (aws_subnet.x.id) using the discovered relationship graph, so the bundle reconstructs real dependencies.
  • UNMANAGED.md manifest: resources that cannot faithfully round-trip (stateful data such as RDS, IAM trust policies, secrets) are flagged and emitted as commented import-stubs — never silently dropped, and never as broken HCL.
  • Generated bundles are designed to pass terraform validate.

AWS core (VPC/subnet/security groups/EC2/S3/ALB/IGW/NAT/Route53) is apply-grade today. Apply-grade fidelity for Azure/GCP/on-prem is on the roadmap; those resources are currently emitted as best-effort placeholders and listed in UNMANAGED.md.

terraform init
terraform validate
terraform plan      # review UNMANAGED.md items before applying

D2 diagram​

A modern architecture diagram (architecture.d2):

  • Color-coded containers per cloud/provider (AWS, Azure, GCP, VMware, M365, Cisco, Palo Alto, Active Directory, on-prem).
  • Resources grouped by VPC/VNet; internet-exposed resources called out.
  • Attack paths highlighted in red — the security story rendered visually, which generic cloud-icon tools cannot express.

Rendered live in the app. The Architecture Diagrams tab renders D2 to an interactive diagram right in your browser (zoom, pan, light/dark themes, source toggle, one-click SVG download) — no CLI required. You can still export the architecture.d2 source and render it anywhere with the D2 CLI: d2 architecture.d2 out.svg.

You can also export the same diagram from the Architecture Export bundle and render it in your own pipeline, so the diagram in a review deck is generated from the same source of truth as the one on screen.

Diagrams in generated documents

The D2 diagram described here is the interactive, in-app view. Generated documents (As-Built, SSP, compliance packages) embed their own figures — including the Authorization Boundary figure — rendered specifically for print and for offline review.

They are built from the same discovered inventory, but they are laid out differently on purpose: a document figure has a fixed page size, needs to stay legible in greyscale, and is read by an assessor who cannot zoom or pan. Expect the same resources and relationships, not a pixel-identical picture.

SysML v2 (MBSE)​

A SysML v2 textual model (model.sysml) for model-based systems engineering:

  • Resource types become part def definitions; resources become part instances with ports and attributes.
  • Relationships become connections.
  • Attack paths are expressed as constraint and requirement violations — making reachability risk first-class in the systems-engineering model. Complements the DoDAF export for defense/government programs.

PlantUML​

A PlantUML block diagram (model.puml) for quick rendering in any PlantUML viewer.

Preview before download​

The Architecture Diagrams tab includes a Preview button. For the D2 format it renders a fully interactive diagram (zoom/pan/themes/SVG download). For text formats (Terraform, SysML v2, PlantUML) it renders the primary generated artifact source so you can eyeball output before downloading the full ZIP bundle.

How the D2 preview is rendered:

  • Desktop browsers render in-browser with a single shared diagram engine. If the engine fails to start or times out, the preview retries once on a fresh engine and then falls back to server-side rendering.
  • Phones and tablets (including iPadOS) render server-side — the in-browser engine is too heavy for mobile browsers. The server builds the diagram from your tenant's own graph; the browser sends only the scope and selected resource IDs.
  • Large scopes (for example Full System after an all-regions scan) preview as a summary view: resources grouped by region, network and type, with counts. Every resource is counted exactly once and attack-path edges stay highlighted. The diagram is labelled "Summary view: N resources". The downloaded .d2 file is never summarised — it always contains every resource.

Large estates: background exports​

Diagram and draw.io exports are built in memory. For very large estates, Infracast runs them as background export jobs instead of holding a single request open: you start a job, check its status, and download the finished file when it is ready.

  • Up to 500 nodes: the topology export endpoints (GET /api/v1/tenants/{tenantID}/topology/export/diagram and .../topology/export/drawio) behave as before and return the file directly.
  • Above 500 nodes: when artifact storage is configured, those same endpoints return 202 Accepted with a Location header pointing at the job's status URL, plus a JSON body containing job_id, status_url and reason. Clients must poll the status URL and then download the result.
  • Artifact storage not configured: exports stay synchronous at every size.
  • Duplicate requests: an identical request made while one is already queued or running returns the existing job (already_active: true) instead of starting a second one.
  • Retention: finished files are kept for 7 days, then deleted. Downloading an expired job returns 410 Gone.
  • Failures: if a worker stops mid-job the job is retried automatically (up to 3 attempts), then marked failed with a reason.

Background exports are currently available via the API only; a UI for them is coming. See the Exports API for endpoints and examples.

Other exports — document preview, package bundles and remediation export — are still synchronous today.

Notes​

  • Architecture Export bundles download as a .zip.
  • Diagram output is densest at full-system scale — for readable diagrams, prefer a Selection scope; for text/model/IaC formats, full-system scale is fine.