ArchDocs
Start free

Import cloud infrastructure

Import infrastructure when you want a diagram to start with the resources you already run. ArchDocs creates reusable objects from the import; it doesn't provision or change your infrastructure.

Cloud import requires the Business plan or above. Setting up connections and running imports requires cloud:manage. Viewing connections requires cloud:read.

Connect an AWS account

  1. Open the organization name in the sidebar, then select Organization Settings > Cloud connections.
  2. Select Add connection. Keep AWS as the Provider, choose Single account, and enter a Name, such as production.
  3. Under Credentials, choose IAM role (recommended). Keep this dialog open while you follow its setup guide. The generated External ID is already included in the displayed trust policy.
  4. In the guide's Create a read-only permissions policy step, use the IAM permissions policy. In Create the role with this trust policy, use the Trust policy.
  5. Follow Paste the role ARN into the form: enter the new role's ARN in Role ARN, then select Add connection.

The guide also has a CloudFormation template (single account) that creates the role and policies together. If you use it, paste its DiscoveryRoleArn output into Role ARN. For Access keys, follow the guide to create a read-only IAM user, then fill in Access key ID and Secret access key.

AWS discovery reads across enabled regions. Region doesn't limit the import. ArchDocs uses it only when it can't list your enabled regions.

Import an AWS organization

  1. In Add connection, choose AWS and Whole organization.
  2. Follow Deploy this StackSet from the management account. Copy the CloudFormation StackSet template and supply the management account ID. Deploy it to the management account and to the member accounts.
  3. Follow Paste the management role ARN into the form. The template defines an organization-read role for the management account and a read-only discovery role for member accounts. Paste the organization-read role's ARN into Management role ARN.
  4. Enter a Name and select Add connection.

After the first import, open Accounts on the connection. Uncheck accounts you want to skip, then select Save exclusions. The exclusions apply to the next import.

Connect more cloud accounts

For Azure:

  1. Select Add connection, choose Azure, and enter a Name and Subscription ID.
  2. Follow Create a read-only service principal in the setup guide. Use the displayed command with the Reader role on that subscription.
  3. Copy appId into Client ID, password into Client secret, and tenant into Tenant ID.
  4. Enter comma-separated Resource groups to restrict discovery, or leave it empty for the whole subscription. Select Add connection.

For Google Cloud:

  1. Select Add connection, choose Google Cloud, and enter a Name.
  2. Choose Project, Folder, or Organization. Project scope uses the project in the service account key; the other scopes need Folder ID or Organization ID.
  3. Follow the setup guide: Create the discovery service account, grant the displayed read-only IAM binding at your chosen scope, then Create and download a key. The binding uses roles/viewer.
  4. Paste the key into Service account key JSON and select Add connection.

Connect Kubernetes

  1. Select Add connection, choose Kubernetes, and enter a Name.
  2. Choose Kubeconfig to upload a Kubeconfig file or paste its contents. Set Context name if you need a context other than current-context.
  3. Alternatively, choose Service account token and fill in Kubernetes API server, Service account token, and any Certificate authority data. The API server must use HTTPS and be reachable by ArchDocs.
  4. Select Add connection.

Use read-only cluster credentials. Kubeconfigs that depend on local credential plugins or local certificate files aren't supported. Use inline credentials instead. ArchDocs doesn't read Kubernetes Secret values; it imports Secret reference names.

Upload Terraform state

Terraform import reads an uploaded snapshot. It doesn't run Terraform or connect to your cloud account.

  1. On Cloud connections, find Terraform / IaC sources.
  2. Enter Source name, such as Infrastructure, and select Add source.
  3. Select Upload .tfstate on the source and choose your state file.

The upload accepts JSON state format version 4, up to 10 MB. Managed resources are imported; data sources are skipped. Fields with recognized secret names are redacted before storage. Re-upload a newer state file to refresh the objects.

Run an import and build a diagram

For a live connection, wait for Connected, then select Import on its Import tab. If the connection shows Error, check its credentials and setup permissions before importing.

An import processes up to 5,000 resources. Select Build diagram after it finishes, or use the connection's Build diagram icon later. Each build creates a new document with up to 500 resources; it doesn't redraw a document you've already edited. The result reports resources omitted by the diagram cap.

The imported resources are objects you can reference in other documents.

Re-sync and inspect drift

Open Drift on a live connection. Set Auto re-sync to Daily or Weekly, or keep Manual and run imports yourself. The panel shows the last sync and an estimate of the next run.

A re-sync compares tracked resource fields with the previous import. Expand an item to inspect the before and after values. Resources missing from discovery appear as Removed in cloud.

Select Acknowledge after reviewing a change. This closes the drift item; it doesn't change the cloud resource. Removed resources don't have an acknowledgement action.

Inspect AWS costs

Cost data is available for AWS connections only. Reading it requires ce:GetCostAndUsage, which the AWS setup policy includes as optional access.

On a canvas containing imported AWS resource references, select the dollar-sign Toggle cost heatmap icon, then Refresh costs. The legend distinguishes estimates and resources with No data. Where resource-level costs aren't available, ArchDocs can estimate a share of service and region costs. Check the As of: date before treating the amounts as current.

Remove imported resources or a connection

To purge imported objects while keeping the connection, select its Remove imported resources icon. Review the count and any warning about objects used in other documents, then select Remove resources. References to those objects will show as deleted. You can import again later.

To stop using the connection, select its trash icon. In Delete connection, leave Also remove the … imported objects unchecked if you want to keep them, then select Delete. Neither action deletes infrastructure in your cloud account.