Skip to content
flowss
Start freeChecking your session
Cloud architecture templates

Teaching Case — Boxes Nobody Connected, Words Nobody Knows

Two quieter failures, side by side. A resource that appears in no edge is a box somebody drew and never wired — legitimate for a legend, a real omission everywhere else — and a type word this engine's vocabulary does not carry is reported as a GAP in the vocabulary rather than as a mistake by the author. The difference between those two sentences is the difference between blaming the reader and blaming the tool.

Cloud architectureArchitectureCloud architecture syntax docs
Template previewCloud architecture
Platform overview — work in progressAn AWS architecture diagram: 6 resources in 6 scopes (1 network, 0 availability zones), joined by 4 connections. Categories drawn: Compute, Databases, Networking, Clients. No error and 1 warning across 6 resources and 4 edges; 1 of the 10 checks could not run at all and 1 ran only in part.Platform overview — work in progressAWS · 6 resources · 6 scopes · 1 network · 0 zones · 4 connectionsNo error and 1 warning across 6 resources and 4 edges; 1 of the 10 checks could not run at all and 1 ran only in part.Internetintern…8AccountProduction8Regionus-east…8NetworkVPC8+SubnetApplicationprivate8+SubnetDataisolated8+Users—4+Load balanceraws4+API serveraws4+Researchclusteraws3+Databaseaws4+Warehouse, no…aws1+https 443http 8080postgres 5432grpc 9000LegendComputeDatabasesNetworkingClientsType not in this vocabularyRequest trafficChecks — what ran, and what could notWhether the internet reaches something that ho…ran over 5 subjects, found nothingWhether anything holding data at rest sits in …ran over 2 subjects, found nothingWhether anything claiming redundancy is spread…could not run here — 1 reason givenEdges that leave one network for another, or c…ran over 5 subjects, found nothingResources that appear in no edge at all. A leg…1 finding over 6 subjectsEvery id an edge or a scope names is one that …ran over 5 subjects, found nothingEach id is declared once. Two declarations mak…ran over 12 subjects, found nothingType words that did not resolve. A hole in thi…ran over 5 subjects, 1 gap — a partial passDeclared ranges: that each parses, sits inside…ran over 3 subjects, found nothingWhether every line was read and no shape cap b…ran over 12 subjects, found nothingFindings1`warehouse` is declared and appears in no edge. A legend box or an annotation is a legitimate reason; a misspelt endpoint elsewhere is the other one.in the figure: warehouse2This document declares no availability zone, so the redundancy check DID NOT RUN AT ALL: nothing here claims redundancy either, so nothing was missed. Declare thezones (`zone az-a`, `zone az-b`) and put the resources inside them, and the claim becomes checkable.3This engine's vocabulary has no word `quantum-annealer` — `lab` (line 16) was drawn as a plain box, and with no type there is no `stateful` and no `ingress`, so everycheck above had less to read about it.in the figure: lab4The walk reached 5 resources from the internet; the one that holds data at rest — `db` — sits behind an ingress.in the figure: users, lb, api, db, lab (badge 3)5Every one of the 2 datastores this check could read — `db` and `warehouse` — sits in a subnet declared private or isolated.in the figure: db (badge 4), warehouse (badge 1)6Every edge this check could read stays inside one network, stays outside all of them, or names a gateway to cross at; 5 endpoints were read across 1 declared network.in the figure: users (badge 4), lb (badge 4), api (badge 4), db (badge 4), lab (badge 3)7All 5 ids named by edges and scopes were declared somewhere in this document.in the figure: users (badge 4), lb (badge 4), api (badge 4), db (badge 4), lab (badge 3)8All 12 declared ids are distinct.in the figure: internet, prod, us-east-1, vpc, app +7 more95 of the 6 resources resolved to a type this engine knows; the rest are named in the gaps below.in the figure: users (badge 4), lb (badge 4), api (badge 4), db (badge 4), warehouse (badge 1)10No range is declared on any of the 3 networks and subnets here, so there is no addressing claim that could be wrong. `cidr <address>` on a container turns containment,overlap and capacity into checked facts.in the figure: vpc (badge 8), app (badge 8), data (badge 8)11Every line was read and no shape cap bit: the 12 declarations above are the whole document, so the counts are totals rather than floors.

Make it your own.

title "Platform overview — work in progress"
provider aws
note "Deliberately incomplete: one resource is unwired and one type word is unknown."

internet {
  user users "Users"
}

cloud prod "Production" {
  region us-east-1 {
    network vpc "VPC" {
      alb lb "Load balancer"

      subnet app "Application" private {
        ec2 api "API server"
        quantum-annealer lab "Research cluster"
      }
      subnet data "Data" isolated {
        rds db "Database"
        redshift warehouse "Warehouse, not wired up yet"
      }
    }
  }
}

users -> lb : https 443
lb -> api : http 8080
api -> db : postgres 5432
api -> lab : grpc 9000