CloudStack Canvas (CSC) is a browser-based visual designer for AWS infrastructure. You drag services onto an infinite canvas, connect them, configure properties, and export production-ready Infrastructure as Code — no YAML hand-authoring required.

The canvas understands AWS architecture rules: it automatically places resources inside the correct containers (EC2 instances go inside Subnets, Subnets inside VPCs), generates the dependent resources you need (IAM roles, Security Groups), and validates placement before letting you drop.

1. 1

   Create a project

   From the Dashboard, click "+ New Project". Choose Simple mode to get auto-wiring or Advanced mode for full control.

2. 2

   Add resources from the palette

   The left panel lists all available AWS services grouped by category. Drag any service onto the canvas to place it.

3. 3

   Connect resources

   Hover over a node until you see the connection handle (a small circle on the edge). Click and drag to another node to draw an edge.

4. 4

   Configure properties

   Click any node to open the Properties panel on the right. Change the label, instance type, storage size, or any resource-specific setting.

5. 5

   Export your infrastructure

   Click "Export IaC" in the toolbar. Choose CloudFormation JSON or CloudFormation YAML (Terraform is coming soon). The file downloads immediately.

The canvas is an infinite, pannable workspace. All standard React Flow navigation gestures apply:

The left sidebar lists every supported AWS service, organized into categories: Compute, Storage, Database, Networking, Security, Messaging, and more. Use the search box at the top to filter by name or keyword.

Dropping a resource

Drag any service icon from the palette and drop it onto the canvas. CSC checks placement rules before adding the node:

• Resources that require a VPC (EC2, RDS, ECS, etc.) are automatically placed inside one. If no VPC exists yet, CSC creates one for you.
• Resources that require a Subnet are placed inside a Subnet inside the VPC.
• If a required container doesn't exist, CSC creates the full hierarchy automatically.

Auto-generated dependencies

Many services create companion resources automatically. For example, dropping an EC2 instance also generates:

• An EC2 Security Group (inside the Security Zone)
• An IAM Instance Role (inside the IAM Zone)

These auto-generated nodes are linked visually and included in all IaC exports. You can hide them with the layer toggles if they clutter the view.

Every project runs in one of two modes. You choose when creating the project. You can switch a project's mode at any time using the toolbar button in the editor. You can also set a default mode for new canvases in Settings → Canvas Defaults.

CSC uses container nodes to represent AWS grouping constructs. Child resources live visually inside their parent containers, and this hierarchy is reflected in the IaC output.

Resizing containers

Hover over the edge or corner of any container (VPC, Subnet, etc.) to reveal the resize handle. Drag to expand or contract. The canvas enforces a minimum size so children are never clipped. Resizing is undoable with Ctrl+Z.

Security Zone and IAM Zone

These two zone types are CSC-only organizational containers. They do not map to an AWS resource and are excluded from IaC exports. They exist solely to keep Security Groups and IAM Roles visually separated from your main architecture.

Edges represent relationships between resources (data flow, network access, IAM trust, etc.). In the exported IaC they become references or dependency declarations between resources.

1. 1

   Hover over a node

   A small circle (connection handle) appears on the edges of the node.

2. 2

   Click and drag the handle

   Pull to another node. A preview edge follows your cursor.

3. 3

   Release on the target node

   CSC resolves the relationship type automatically based on both resource types. For example, EC2 → S3 generates "S3 Access" — scoped IAM actions on the instance role plus an S3 Gateway VPC endpoint. When a connection is ambiguous (e.g. CloudFront → S3 could mean "S3 Origin" or "Access Logs"), a dialog appears asking you to choose.

Deleting an edge

Click an edge to select it (it turns highlighted), then press Delete or Backspace.

Click any node to open the Properties panel on the right side of the canvas. The panel shows fields specific to that resource type.

Common fields

• Label — the display name shown on the canvas node. Editable inline by double-clicking the node label.
• Resource-specific fields — instance type, engine version, storage class, memory size, etc.

Naming configuration

In Simple mode, all resource names follow the pattern {prefix}-{project}-{environment}-{resource}. Change the environment, project name, and prefix in the canvas toolbar's naming settings.

Templates give you a pre-wired starting point for common architectures. Access them via the Templates button in the canvas toolbar.

CSC maintains a 50-step history for every canvas change: adding/removing resources, connecting nodes, moving nodes, resizing containers, editing labels, and changing properties.

Each logical action is one undo step. Dragging a node across the canvas is one step, not one step per pixel. Dropping a resource that auto-creates dependencies (VPC + Subnet + SG + IAM role) is also a single undo step.

The toolbar contains five layer toggles that let you hide categories of nodes without removing them from the canvas. Hidden nodes are still included in all IaC exports.

Adding annotations

Use the toolbar buttons to add text labels and labeled group or boundary boxes to your diagram. These annotations help document your architecture but are not included in the IaC export.

All shortcuts work when focus is on the canvas (not inside a text input).

The bottom-right corner of the canvas shows the minimap — a scaled overview of all nodes. Click anywhere on the minimap to jump the viewport to that location. Colored squares on the minimap match the primary color of each resource node.

Hiding the minimap

The minimap visibility is controlled by your user settings. Go to Settings → Canvas Defaults and toggle the minimap option.

Controls panel

The Controls panel (bottom-left) provides three buttons that are always visible:

• Zoom In — increase zoom level
• Zoom Out — decrease zoom level
• Fit View — zoom and pan to show all nodes

Create read-only share links for any project to let stakeholders, teammates, or clients review your architecture without needing a CloudStack Canvas account. Share links are free on all plans.

1. 1

   Open your project on the dashboard

   Navigate to your Dashboard and find the project card you want to share.

2. 2

   Click the share icon

   On the project card, click the share icon (or the menu button and select "Create share link"). CSC generates a unique URL.

3. 3

   Copy the link

   The link is displayed — copy it to your clipboard. The URL is long, random, and unguessable.

4. 4

   Revoke when needed

   Return to the project card and click "Revoke link" to kill all access. Revoking immediately breaks the shared URL — anyone with it loses access.

What viewers see

• Full canvas view — resources, connections, layout, everything you've designed
• Read-only — they cannot edit, add nodes, or export
• No account required — the link works in any browser
• No login needed — the share link grants instant access

The findings panel surfaces deploy-readiness and security risks as you design — public buckets, overly permissive IAM policies, world-open security groups. Findings are live, appearing on the canvas as you add and connect resources.

Accessing the panel

A floating Findings pill appears at the bottom-right of the canvas. Click it to expand the findings panel showing all current deploy-readiness and security issues, organized by severity. The pill shows the count of all findings.

What is checked

• S3 public access — S3 buckets with public read or write permissions
• Wildcard IAM policies — IAM roles or policies with * actions or resources
• Open security groups — security groups allowing inbound from 0.0.0.0/0 on sensitive ports
• Missing encryption — databases or storage without encryption enabled
• Publicly accessible databases — databases with PubliclyAccessible enabled

Plan access

The findings panel is mounted on all plans. Free plan users see the finding count and an upgrade CTA to view details.Pro and Team users see the full finding details, remediation guidance, and can click findings to jump to the offending resource on the canvas.

Taking action

Click any finding to jump to the offending resource on the canvas and open its property panel (Pro/Team only). Fix the issue (tighten IAM, restrict the security group, enable encryption, disable public access) and the finding disappears from the panel in real time.

CloudFormation export is available on all plans. CSC generates a complete, deployable CloudFormation template from your canvas.

1. 1

   Click "Export IaC" in the toolbar

   The export dialog opens showing available formats for your plan.

2. 2

   Choose JSON or YAML

   Both formats are identical in content. JSON is the default; YAML is more human-readable for version control.

3. 3

   Download

   The file downloads as {project-slug}-cloudformation.json or {project-slug}-cloudformation.yaml (e.g. my-project-cloudformation.yaml). Deploy it with the AWS Console, CLI, or CDK.

What gets exported

• All resource nodes on the canvas (including hidden layer nodes)
• All edges as DependsOn or reference properties
• Resource properties set in the Properties panel
• Naming config (prefix, environment, project)

What is excluded

• Security Zone and IAM Zone containers (CSC-only organizational nodes)
• Canvas metadata (positions, colors, labels used only for display)

Deploying with the AWS CLI

Terraform HCL import is available today as a partial single-file preview. Use Import Template on the New Canvas screen or the Import IaC button on the canvas toolbar to visualize resource blocks from a.tffile. Modules, data sources, variables, and connections are not imported. This is a design-time preview to help you visualize existing infrastructure; it is not a full round-trip conversion.

Terraform HCL export is on the roadmap. We're expanding coverage so every service on the canvas emits a complete, deploy-readymain.tf— not just a subset — before we turn it on.

Free, Pro, and Team plans export production-ready CloudFormation in JSON and YAML. Pro adds bidirectional IaC sync for keeping your codebase in sync with the canvas. When Terraform export ships it will be included in Pro and Team plans at no extra cost.

The Git/PR export feature (Pro plan) lets you push CloudFormation directly to a GitHub repository branch and open a pull request — all without leaving the canvas.

Set up GitHub integration

1. 1

   Go to Settings → Integrations

   Navigate to your Settings page and open the Integrations tab.

2. 2

   Click "Connect GitHub"

   A GitHub authorization dialog opens. Authorize CloudStack Canvas to access your repositories.

3. 3

   Select a repository

   Choose which repository CSC should push to (you can change this per export).

Export to a branch and PR

1. 1

   Click "Export IaC" on the canvas

   The export modal opens, showing CloudFormation JSON and YAML options as usual.

2. 2

   Select "Push to GitHub"

   Choose the GitHub option (visible only if you've connected GitHub in Settings). Optionally select a different repository or change the branch name.

3. 3

   Confirm

   CSC creates a new branch, commits the CloudFormation file, and pushes it to your repository.

4. 4

   Open PR

   You'll see a link to open a pull request on GitHub. Click it, add a description, and your code review flow begins — all your CloudFormation changes are now in version control with team review.

About the GitHub authorization

When you authorize CloudStack Canvas to access GitHub, you're granting access through a dedicated OAuth app — separate from the “Sign in with GitHub” option. This OAuth app is scoped to exactly one feature: Git/PR export.

CloudStack Canvas requests the repo scope, which allows read and write access to all your repositories (including private ones). We use this scope only to: create a branch named cloudstack-canvas/{project}, commit ONE file named cloudstackcanvas/{project}.template.json, and open or reuse a pull request. We never list repos, read code, set up webhooks, or delete anything.

Your GitHub token is encrypted with AES-256-GCM and stored server-side, one row per user. When you disconnect (Settings → Integrations → Disconnect), the token is permanently deleted. You can also revoke access anytime at github.com → Settings → Applications → Authorized OAuth Apps — if you revoke there, the UI will ask you to reconnect the next time you try to export.

Export quotas are enforced per calendar month and reset on the 1st of each month.

If you deployed a CSC-generated template as a CloudFormation stack, tearing it down is a single command. CloudFormation tracks every physical resource it created — VPC IDs, subnet IDs, ARNs — and deletes them in the correct reverse-dependency order automatically.

Via the AWS CLI

Via the AWS Console

1. 1

   Open CloudFormation

   Go to the AWS Console → CloudFormation → Stacks. Find the stack you deployed (it uses the stack name you provided at deploy time).

2. 2

   Select the stack

   Click the stack name to open its detail view.

3. 3

   Click Delete

   Click the "Delete" button at the top right. Confirm the prompt. CloudFormation will delete all resources in dependency order — subnets before VPCs, instances before security groups, etc.

4. 4

   Monitor progress

   The Events tab shows deletion progress in real time. The stack disappears from the list once all resources are removed.

Partial teardown

If you want to remove specific resources without deleting the entire stack, update the template — remove those nodes in CSC, re-export, and redeploy. CloudFormation will delete only the resources that were removed from the template.

Every resource CloudStack Canvas generates — EC2 instances, Lambda functions, S3 buckets, RDS databases, IAM roles, NAT Gateways, VPCs, and every other CloudFormation resource in your exported template — is automatically tagged with:

This tag is present on every single resource in every template — including auto-generated sub-resources like Internet Gateways, NAT Gateways, route tables, CloudWatch log groups, SQS dead-letter queues, and IAM roles. If CSC generated it, it has the tag.

Finding your deployed resources

You can use ManagedBy = CloudStackCanvas as a filter in any AWS service that supports tag-based filtering.

AWS Resource Groups

Create a tag-based Resource Group to see everything CSC has deployed in one place:

AWS Cost Explorer

Filter or group your AWS bill by ManagedBy to see exactly what CSC-deployed infrastructure costs vs resources you created manually or with other tools.

AWS CLI — find all tagged resources

AWS Config

Use AWS Config rules or conformance packs to audit CSC-deployed resources. For example, require that all resources tagged ManagedBy=CloudStackCanvas have encryption enabled or Multi-AZ turned on.

IAM — restrict who can modify CSC resources

Add a tag-based condition to IAM policies to prevent engineers from manually modifying resources that should only be changed through CloudStack Canvas:

Overriding the tag

If your organization uses a different tagging standard (for example managed-by instead of ManagedBy), you can add your own tag with the same key in the canvas Tags panel — user-set tags always override the CSC defaults. The CSC default tag will be replaced by your version.

You can also add additional identifying tags (team name, project, cost centre) per resource in the Tags panel in Advanced mode, or globally via the Naming Config section.

What is not tagged

A small number of AWS resource types do not support tags at all — notablyAWS::ApiGateway::Deployment,AWS::ApiGateway::Stage method settings, and some networking entries. These are edge cases in the AWS tagging API — the parent resources (the API Gateway itself, the VPC) are always tagged.

The AWS CLI (Command Line Interface) is a program you install on your computer that lets you control AWS directly from your terminal — deploying templates, checking resource status, and more. You need it to follow the CLI paths in the per-template deployment guides. The Console path works without it.

macOS

Recommended: download the installer — no extra tools required.

If you already use Homebrew (a Mac package manager), you can also run: brew install awscli

Windows

Download the installer file (.msi = a standard Windows installer, like .exe) and double-click to run it.

After installing, open a new PowerShell or Command Prompt window before continuing.

Linux

Verify the installation worked

Open a new terminal window and run:

The AWS CLI needs credentials to make API calls on your behalf. The recommended approach is to create a dedicated IAM user with programmatic access, then run aws configure.

Console — create access keys

1. 1

   Open IAM in the AWS Console

   Navigate to IAM → Users → select your user (or create one — see IAM Permissions section below).

2. 2

   Create access key

   Click Security credentials → Create access key → choose "Command Line Interface (CLI)" → Next → Create.

3. 3

   Download credentials

   Copy the Access Key ID and Secret Access Key. You cannot retrieve the secret again after closing this dialog.

Configure the CLI

Run aws configure in your terminal. It will ask you four questions — paste or type your answers:

Your credentials are saved automatically in a file on your computer. You will not need to run this again unless you create new keys.

Verify credentials are working

Using named profiles (optional)

If you manage multiple AWS accounts, use named profiles instead of the default:

Your IAM user needs specific permissions to deploy CloudFormation templates and the AWS resources inside them. The safest approach is to create a dedicated deployment user with a scoped policy.

Minimum permissions for CSC templates

Console — steps to create a deployment IAM user

1. 1

   Go to IAM → Users → Create user

   Enter a name like "csc-deploy". Do not enable Console access — this user only needs programmatic (CLI) access.

2. 2

   Attach permissions

   Choose "Attach policies directly". Search for and attach PowerUserAccess + IAMFullAccess, or create a custom policy scoped to the services your templates use.

3. 3

   Create access keys

   After creating the user, go to Security credentials → Create access key → CLI → create. Copy the keys and run aws configure.

When a CloudFormation deployment fails, the stack enters ROLLBACK_COMPLETE or CREATE_FAILED state and automatically undoes any resources it created. Here is how to diagnose and fix failures.

Step 1 — Find the root cause

Console: In the AWS Console, go to CloudFormation (search for it in the top bar). Click on your stack name in the list. At the top of the stack detail page, click the Events tab. The list shows newest events at the top — scroll to the bottom to find the oldest (first) failure. Red rows are failures. Read the Status reason column — that is your error message.

CLI:

Common errors and fixes

Step 2 — Delete a failed stack before redeploying

Step 3 — Fix the issue in CloudStack Canvas

Most failures come from one of: a missing required property, a name collision, or a missing IAM permission. Fix the root cause in the CSC property panel, re-export the template, then redeploy. Do not try to deploy the same template twice without fixing the issue — CloudFormation will reject it.

CloudFormation Console walkthrough (for all templates)

1. 1

   Open CloudFormation in the AWS Console

   Navigate to CloudFormation using the search bar. Make sure your region (top-right) matches where you want to deploy — most CSC templates use us-east-1.

2. 2

   Create stack

   Click "Create stack" → "With new resources (standard)". Under "Specify template", choose "Upload a template file". Click "Choose file" and select the JSON or YAML file exported from CloudStack Canvas.

3. 3

   Name the stack

   Enter a stack name (e.g. csc-static-site). Names must be unique per region. Click Next.

4. 4

   Fill in parameters

   If the template has parameters (visible in the Parameters section of the export modal), fill them in here. Leave environment as "dev" unless you are deploying to staging or production.

5. 5

   Configure stack options

   Leave defaults. Optionally add tags. Click Next.

6. 6

   Review and acknowledge IAM

   At the bottom of the review page, check the box: "I acknowledge that AWS CloudFormation might create IAM resources with custom names." Click Submit.

7. 7

   Monitor the Events tab

   Watch the Events tab as resources are created. Green = success, red = failure. If any resource fails, read the Status reason — this is your error message.

8. 8

   Check Outputs after completion

   When the stack status changes to CREATE_COMPLETE (shown in green), click the Outputs tab. This is a list of key information about your deployed resources — URLs, connection strings, resource names — that CloudFormation surfaces so you don't have to go hunting. You will need these values to configure your application.

Organizations let Team plan users share projects under a single workspace. All members of an organization can see and open org projects from their dashboard.

1. 1

   Open Settings → Organization

   Navigate to Settings and select the Organization tab, or follow the Set up Org prompt on your dashboard if you're on a Team plan with no organization yet.

2. 2

   Create an Organization

   Click Create Organization. Enter a unique name — this becomes your org's display name and slug used in the system.

3. 3

   Invite Members

   Once created, use the Invite member field under your org to add teammates by email. Invited users must already have a CloudStack Canvas account. They will receive a pending invite on their dashboard that they can accept or decline, which includes an expiration date.

4. 4

   Share Projects

   Create new projects inside the org from your dashboard (the + New Org Project card), or move an existing personal project into the org using the Move to Org button (double-arrow icon) on any personal project card.

Every org member has one of four roles. Roles are ranked — higher ranks can only be assigned by someone of equal or higher rank.

An Owner cannot leave an organization unless they first transfer ownership or delete the org. Admins can invite members, change roles below their own rank, and remove editors/viewers.

Org projects are visible to all members of the organization regardless of who created them.

• Create — click + New Org Project on the dashboard (editors and above).
• Move — transfer a personal project into an org via the double-arrow icon on any personal project card.
• Open — any org member can open and view an org project.
• Edit — editors, admins, and owners can make and save changes.
• Delete — owners and admins can delete org projects from the dashboard (the trash icon appears for eligible roles only).

Team plan users have real-time collaboration on saved projects (not the unsaved editor at /canvas/editor). Multiple team members can work on the same project simultaneously.

Collaboration uses a Server-Sent Events (SSE) stream from the server to each connected client, plus lightweight REST calls from clients to the server. No WebSocket server is required.

What syncs in real time

• Cursor positions (throttled to 20 updates/second per user)
• Node selection (which node each user has clicked)
• Node moves (when a user finishes dragging a node)

What does not sync automatically

• Adding or removing resources — these appear after the next auto-save cycle
• Property changes — same, reflected after auto-save

When collaborators are on the same canvas, their cursors appear as colored SVG pointers with their name. Each user gets a unique color assigned automatically.

Selected nodes show a colored ring matching the collaborator's color, so you can see what each person is working on at a glance.

The cost estimation engine computes a projected monthly AWS bill for the resources on your canvas based on AWS public pricing. Estimates are updated each time you open the cost panel or add/remove resources.

Costs use the following default assumptions:

• Region: us-east-1 (prices vary by region)
• On-Demand pricing (no Reserved or Savings Plan discounts)
• 730 hours / month for compute resources
• Data transfer within the same region is free
• Coverage: the estimator covers common services (EC2, RDS, Lambda, S3, CloudFront, DynamoDB, and more), but some services are not yet priced

Click the floating Est. cost pill at the bottom-right of the canvas to expand the cost panel in place.

Panel layout

• Total monthly estimate — sum of all nodes in large text at the top
• Per-resource breakdown — each node with its estimated monthly cost and a line-item breakdown (compute, storage, etc.)
• Pricing data source — the month (e.g. us-east-1 list prices updated July 2026) shown in the footer; rates refresh monthly from the AWS Price List API

Resources with no pricing data (IAM Roles, Security Groups, VPCs) show $0.00 since they have no direct cost. Some services are also not yet priced in the estimator (SSM Parameter, Step Functions, EFS, Redshift, and a few others) and show $0.

The Billing Alarm template (Pro and Team plans) deploys four CloudWatch alarms that notify you when your AWS spend crosses configurable thresholds — protecting you from unexpected charges.

What gets deployed

All thresholds are editable in the property panel before you export. Click any alarm node and change the Alarm Threshold field.

Before you deploy

• Enable billing alerts in your AWS account — go to Billing → Billing Preferences → Receive Billing Alerts and save. Without this, CloudWatch never receives billing data and all alarms stay in INSUFFICIENT_DATA.
• Deploy in us-east-1 — AWS billing metrics are only published to us-east-1 regardless of where your other resources live.
• Enter a notification email on the SNS node in the property panel before exporting. CloudFormation creates the subscription automatically and AWS sends a confirmation link to that address.

Email subscription

Select the Billing Alerts SNS node on the canvas and enter your email in the Notification Email field. When you deploy the exported template, CloudFormation creates an AWS::SNS::Subscription resource that triggers AWS to send a confirmation email. Check your inbox — the email comes from no-reply@sns.amazonaws.com with subject "AWS Notification - Subscription Confirmation".

How the Daily Spend alarm works

AWS publishes your total month-to-date spend to CloudWatch once every 24 hours. By itself that number grows throughout the month, so a simple threshold alarm would fire every day once your monthly total crosses it — not useful.

The Daily Spend alarm solves this by calculating how much your bill grew since yesterday. For example: if your month-to-date total was $12 yesterday and is $19 today, the daily spend is $7. If your threshold is $5, the alarm fires. If the bill grew by only $3 today, the alarm stays quiet. This catches sudden spikes — like a runaway process or an accidental large resource — that the monthly alarms would not catch until later in the month.

The Free plan is permanent — no credit card required, no trial expiry.

Pro unlocks the full canvas experience for individual developers. Billed monthly or annually ($32.50/mo billed annually = 2 months free).

• Unlimited projects, 200 nodes per canvas
• Unlimited CloudFormation JSON & YAML exports
• Cost estimation panel
• All AWS services in the palette
• Bidirectional IaC sync

Team plan removes all limits and adds real-time collaboration for your entire team at a flat price.

• Unlimited projects and nodes (500 per canvas)
• Up to 10 team members — members join free, only the workspace owner pays
• Up to 5 concurrent editors per project
• Unlimited exports (CloudFormation JSON & YAML)
• Cost estimation & bidirectional IaC sync
• Priority support & onboarding