Skip to content
flowss
Start freeChecking your session
Cloud architecture templates

Teaching Case — What "I Could Not Check That" Looks Like

The most important template in this set, and nothing in it is wrong. It is an ordinary, sensible diagram that declares no availability zones — which is what almost every real cloud diagram looks like. The availability check therefore cannot run at all, and the engine says so plainly instead of reporting a pass. That state is the one most tools never show anyone.

Cloud architectureArchitectureCloud architecture syntax docs
Template previewCloud architecture
Reporting serviceAn AWS architecture diagram: 5 resources in 6 scopes (1 network, 0 availability zones), joined by 4 connections. Categories drawn: Containers, Storage, Databases, Networking, Clients. No error or warning across 5 resources and 4 edges, every line read; 1 of the 10 checks could not run at all and 2 ran only in part — so this is a clean result on the part that could be checked, not a clean bill of health.Reporting serviceAWS · 5 resources · 6 scopes · 1 network · 0 zones · 4 connectionsNo error or warning across 5 resources and 4 edges, every line read; 1 of the 10 checks could not run at all and 2 ran only in part — so this is a cleanresult on the part that could be checked, not a clean bill of health.Internetintern…9AccountProduction9Regionus-west…9NetworkVPC10.0.0.0/169+SubnetApplicat…10.0.11.…private9+SubnetDa…10.0.21.…isolated9+Analysts—4+Load balanceraws4+Reporting APIaws4+Warehouseaws4+Reportexportsaws1+https 443http 8080sql 5439s3 apiLegendContainersStorageDatabasesNetworkingClientsRequest trafficData movementChecks — what ran, and what could notWhether the internet reaches something that ho…ran over 5 subjects, found nothingWhether anything holding data at rest sits in …ran over 1 subject, 1 gap — a partial passWhether anything claiming redundancy is spread…could not run here — 1 reason givenEdges that leave one network for another, or c…ran over 4 subjects, 1 gap — a partial passResources that appear in no edge at all. A leg…ran over 5 subjects, found nothingEvery id an edge or a scope names is one that …ran over 5 subjects, found nothingEach id is declared once. Two declarations mak…ran over 11 subjects, found nothingType words that did not resolve. A hole in thi…ran over 5 subjects, found nothingDeclared ranges: that each parses, sits inside…ran over 3 subjects, found nothingWhether every line was read and no shape cap b…ran over 11 subjects, found nothingFindings1`exports` holds data at rest and sits inside no subnet at all, so nothing in this document says whether it is publicly routable and this check had nothing to read.in the figure: exports2This document declares no availability zone, so the redundancy check DID NOT RUN AT ALL: nothing here claims redundancy either, so nothing was missed. Declare thezones (`zone az-a`, `zone az-b`) and put the resources inside them, and the claim becomes checkable.3`exports` is joined to something inside a network but sits in no network, internet or on-premises scope of its own, so whether those edges cross a boundary COULD NOTBE DECIDED.in the figure: exports (badge 1)4The walk reached 5 resources from the internet; every one of the 2 that hold data at rest — `warehouse` and `exports` — sits behind an ingress.in the figure: analysts, lb, api, warehouse, exports (badge 1)5The one datastore this check could read — `warehouse` — sits in a subnet declared private or isolated.in the figure: warehouse (badge 4)6Every edge this check could read stays inside one network, stays outside all of them, or names a gateway to cross at; 4 endpoints were read across 1 declared network.in the figure: analysts (badge 4), lb (badge 4), api (badge 4), warehouse (badge 4)7All 5 declared resources appear in at least one edge.in the figure: analysts (badge 4), lb (badge 4), api (badge 4), warehouse (badge 4), exports (badge 1)8All 5 ids named by edges and scopes were declared somewhere in this document.in the figure: analysts (badge 4), lb (badge 4), api (badge 4), warehouse (badge 4), exports (badge 1)9All 11 declared ids are distinct.in the figure: internet, prod, us-west-2, vpc, app +6 more10All 5 resources resolved to a type this engine knows, so every check above had the full vocabulary to read.in the figure: analysts (badge 4), lb (badge 4), api (badge 4), warehouse (badge 4), exports (badge 1)11All 3 declared ranges parse, each of the 2 drawn inside an addressed network sits inside it, and no two ranges under one parent share an address. The 2 subnets thathave instances drawn in them hold them. Ranges under different parents were not compared — two networks numbered alike is ordinary and correct.in the figure: vpc (badge 9), app (badge 9), data (badge 9)12Every line was read and no shape cap bit: the 11 declarations above are the whole document, so the counts are totals rather than floors.

Make it your own.

title "Reporting service"
provider aws
note "Declares no zones, so the redundancy check cannot run. That is stated, not passed over."

internet {
  user analysts "Analysts"
}

cloud prod "Production" {
  region us-west-2 {
    network vpc "VPC" cidr 10.0.0.0/16 {
      alb lb "Load balancer"

      subnet app "Application" private cidr 10.0.11.0/24 {
        ecs api "Reporting API"
      }
      subnet data "Data" isolated cidr 10.0.21.0/24 {
        redshift warehouse "Warehouse"
      }
    }
    s3 exports "Report exports"
  }
}

analysts -> lb : https 443
lb -> api : http 8080
api -> warehouse : sql 5439
api => exports : s3 api