Should I vibe code
Interactive AWS and Azure architecture diagrams with live components
“Read-only” is not “harmless”. ReadOnlyAccess includes s3:GetObject, and your weekend diagram tool now holds it.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Two products share this page and only one of them is a diagram tool. The canvas with isometric AWS icons is a pleasant weekend on top of an existing renderer. The other product is a thing that assumes a role in your production account, walks every region, and writes down what it finds — and that is not a drawing app, it is an inventory service with credentials. Cloudcraft's own defaults tell you where the sharp edge is: the role it creates carries the AWS-managed ReadOnlyAccess policy, they offer a stricter minimal policy specifically to reduce what that role could theoretically reach, they always use an external ID against confused-deputy attacks, and they explicitly do not persist the scanned data. Your version will do none of those things by default. It will cache the scan, because re-scanning is slow, and the cache is a complete map of your estate — account ids, subnet layout, security group rules, which buckets are public — sitting in a database behind whatever auth an agent generated on a Friday. Build the canvas. Let something else hold the keys.
What actually breaks
not "if". the specific failures.
- The cached scan, which is a reconnaissance report on your production estate stored in a side project's database
- Role assumption without an external ID, which is the confused-deputy hole Cloudcraft names on its own security page and yours will not have
- Static access keys in a .env file, because that is what an agent reaches for when cross-account role assumption is fiddly, and keys do not expire on their own
- Coverage, permanently. AWS ships services faster than you will draw icons for them, and an architecture diagram missing a service is worse than no diagram
- Rate limits, the first time you walk every region of a large account and the describe calls start returning throttling errors halfway through
- The share link, once a diagram containing account ids and open ingress rules is one forwarded message from being outside the company
- Cost estimation, which looks like arithmetic and is actually a pricing API, reserved instances, savings plans and per-region variance
The Slack message arrives on a Thursday from someone in security, and it is a screenshot of your own tool. They found it during an external attack-surface review: a subdomain nobody had inventoried, serving a rendered architecture diagram to anyone who asked, because the share feature defaulted to public links and the diagram id was sequential. The picture is good. That is the problem. It shows the VPC layout, the account number in the corner of every node, which RDS instance is not in a private subnet, the security group that still allows 0.0.0.0/0 on 5432 from that migration in March, and the name of the S3 bucket holding customer exports. None of it is a vulnerability by itself. All of it together is the first two weeks of an attacker's work, done accurately, by you, and published. The scan itself was fine — read-only, revocable, exactly as advertised. What was never fine was writing the results down somewhere that had a URL.
Is that you?
the verdict is a default, not a law
- It draws from a file you maintain by hand or from your Terraform state, and it never holds a cloud credential
- The whole thing runs on your laptop, reads with a short-lived session from your own SSO login, and writes a PNG
- You are visualising a sandbox account with nothing real in it
- It stores long-lived AWS access keys anywhere, including an environment variable on a box you administer alone
- Scan results are persisted and reachable over the internet, which turns a diagram tool into an inventory of your attack surface
- The account it reads is production and belongs to an employer who has not been told this exists
- You would have to write the sharing feature, because sharing is the part that converts a private map into a public one
If you build it anyway
the checklist, then the prompt that enforces it
- Read from infrastructure-as-code first. Terraform state and CloudFormation templates describe the same topology with no credential and no API call, and they are the version you were supposed to have anyway.
- If you must call the cloud API, use short-lived credentials from an SSO session or a role assumed with an external ID. Never a long-lived access key, never a key in a repo, never a key in a hosted environment variable.
- Do not persist the scan. Render from a fresh read, hold it in memory, and let it disappear when the process exits — which is exactly what Cloudcraft says it does, and for exactly this reason.
- If you do cache, encrypt it, give it a short TTL, and treat that store with the same seriousness as the credential itself. It is a map of everything worth attacking.
- Scope the policy to describe and list calls for the specific services you render. The AWS-managed ReadOnlyAccess policy includes object-level reads; it is read-only in the sense that it changes nothing, not in the sense that it sees nothing.
- Redact account ids, ARNs and CIDR blocks from any exported image by default, and make showing them a deliberate toggle.
- There is no public sharing. If a diagram needs to leave the building, it leaves as a file that a human chose to send.
I am building a tool that draws my AWS architecture. Treat the cloud-access half as a credential system, not a drawing feature, and push back where noted.
1. Before any code, ask me where the topology comes from. Default hard to reading Terraform
state or CloudFormation templates, which need no credential at all. Only fall back to
live API calls if I say the estate is not fully in code.
2. If we do call AWS, credentials come from the local credential chain — an SSO session or
an assumed role with an external ID. If I suggest putting an access key in .env or in a
hosting provider's environment variables, refuse and explain that a long-lived key in a
side project is the whole incident.
3. Write the IAM policy as an explicit allowlist of Describe and List actions for the
services we actually render. Do not attach the AWS-managed ReadOnlyAccess policy, and
tell me plainly that it includes object-level reads such as s3:GetObject.
4. Do not persist scan results. Fetch, render, discard. If I ask for caching, implement it
as encrypted-at-rest with a TTL measured in minutes, and say out loud that the cache is
a complete map of my attack surface.
5. Assume localhost. No hosting, no accounts, no share links. If I ask to deploy this, stop
and require authentication in front of every route as part of the same change.
6. Handle throttling and pagination before you handle layout. A partial scan that renders
anyway produces a confidently wrong diagram, which is worse than an error.
7. Every rendered node must carry a freshness timestamp from the scan that produced it. A
stale architecture diagram is how people make decisions about infrastructure that no
longer exists.
8. Redact account ids, ARNs and CIDR blocks in exports by default. Make revealing them an
explicit flag with a warning.
9. Build export before interaction: SVG and PNG on disk, from the command line, no UI. If
the tool never becomes an app, that is a success.
10. Deliberately out of scope: cost estimation, Azure and GCP, multi-account org rollups,
live-updating dashboards, embeds. Each of those is a separate project.
11. Finish by telling me which guardrails you skipped, and that Cloudcraft charges per seat
partly because someone else carries the risk of holding a role in my production account.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
Anyone but you will look at the diagrams, or the account being scanned is production. Ninety-nine dollars a seat is a lot until you price the alternative: an internal service holding a role in your production account, maintained by one person, with no threat model and no security review. What you are buying is a vendor who has already answered the external-id, minimal-policy and do-not-persist questions in writing, and who is contractually on the hook for the answers.
$99/mo is cheaper than your weekend.
Keep the source of truth outside the tool. If the diagram is generated from Terraform state or from a checked-in topology file, then deleting the project costs you a renderer and nothing else — regenerate with anything, including a whiteboard. Export SVG on every run and commit it next to the code that produced it, so the last known-good picture survives even if the generator does not. What you must not do is let the tool's own database become the only record of what the estate looks like, because unpicking that means writing an exporter for a schema you invented under time pressure.
AWS's own solution for scanning accounts and visualising workloads, deployed inside your account so the credentials never leave it.
Diagram-as-code in Python with full AWS, Azure and GCP icon sets, so the architecture picture lives in version control and needs no cloud access.
Questions
The role is read-only. What is the actual risk?
Two things. First, "read-only" describes what the role can change, not what it can see — the AWS-managed ReadOnlyAccess policy that Cloudcraft attaches by default includes object-level reads, which is why they also publish a minimal-access alternative. Second, the risk usually is not the role at all, it is what your app does with the answers. A cached scan is an inventory of every account id, subnet, security group rule and public bucket you own, and it is now sitting behind whatever authentication a weekend project got.
Can I build the drawing part and skip the scanning part?
Yes, and that is the honest recommendation. A canvas with isometric cloud icons on top of tldraw or Excalidraw is a good weekend and carries none of this. Better still, generate the picture from Terraform state or from a diagram-as-code file, which gives you the accuracy that made live scanning appealing without ever holding a credential.
Why is this harsher than the other diagramming entries on this site?
Because the other diagramming tools hold drawings. This one holds a key to production. Whimsical and Lucidchart fail by being annoying to maintain; this one fails by publishing a map of your infrastructure, and the failure lands on colleagues and customers who never saw the repo.
- AWS managed policy reference — ReadOnlyAccess
- Cloudcraft — security (cross-account role, external ID, minimal access policy, data not stored)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Boxes and arrows is an afternoon. Arrows that stay attached when you move the box is a career.
Multiplayer is not a feature you bolt on later. It is a document model, and you picked one on day one.
Mermaid is MIT and already renders in your README. The subscription is a login screen around a Markdown feature.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice