Available For: Business, Enterprise (Accelerate license)
Miro’s AWS Cloud View app allows you to generate a diagram of your AWS infrastructure by importing the data from an AWS account.
✏️ (Enterprise) CloudView integration is available only with Accelerate licenses. For more information, see Understanding Enterprise licenses.
There are two ways to generate this diagram:
- Linking a Cross-account role: connect your AWS account with Miro using a cross-account role and automatically visualize the AWS account
- Uploading a JSON file generated by running the script in your AWS CLI (Command Line Interface)
Linking a Cross-account role
Miro uses a cross-account role to securely access your AWS account. You need to create a ReadOnly role in your AWS account that is specifically created for Miro to access your account. Then you can use the ARN of that role to connect Miro with your AWS account.
Use the AWS Cloud View app by following these steps:
- Click the Tools, Media and Integrations (+) at the bottom of the Miro toolbar and search for AWS Cloud View.
- Launch the app from the search results.
-
From the modal dialog, choose the tab Link a cross-account role.
Linking a Cross-account role -
Follow the steps in the dialog to setup a new cross-account role in your AWS console.
-
Once the role is created in AWS, enter the ARN for the role in the Role ARN field.
Where to find the ARN field in AWS -
Give a name to the new AWS account you are adding.
- Click Add and import.
-
The recently added AWS account will be shown in the next step where accounts are listed.
Selecting your AWS account -
Select the account you want to visualize and click Next.
-
Select the region(s) you want to visualize. Note that selecting multiple regions can make the visualization process slower.
Select regions to import -
On the next screen, apply any filters to your diagram that are needed, using either the type of resource or tags. (Note that filters can be applied or edited after the diagram has been created via the context menu.)
Use filters to reduce the size of the diagram. A smaller diagram is faster to generate and easier to use.
You can apply two different types of filters at this step:
-
Resources: For example, select “EC2 Instances” to only view EC2 instances in that AWS account.
- Tags: If your AWS resources are tagged, you may use the Tags (key and value pair) filter in addition to the Resources filter. For example, search for tag key “Owner” and choose a value, say “CheckoutStream”.
- Click Visualize to create your diagram
The diagram for the AWS Account will be generated.
Example of an AWS infrastructure diagram generated by the Cloud View app
Uploading a JSON file
You can run a script in your AWS CLI (Command Line Interface) that uses read-only permissions to securely save the data of your cloud resources into a JSON file.
Once you’ve used AWS Cloud View to visualize your AWS infrastructure in Miro, you can make edits to the diagram created, such as adding connections, adding additional shapes or objects like sticky notes, or use the AWS Cost Calculator app to see the costs the new design will incur.
Use the AWS Cloud View app with a JSON file by following these steps:
- Click the Tools, Media and Integrations (+) Icon at the bottom of the Miro toolbar and search for AWS Cloud View.
- Launch the app.
- From the modal dialog, follow the instructions to set up the environment to run a script in AWS.
Uploading a JSON file
✏️ You need Node.js on your machine and the AWS CLI (Command Line Interface) set up before proceeding.
- Select your AWS profile in your Terminal.
-
Copy the command and run it in your Terminal.
Run the copied command in your Terminal -
A JSON file containing data about your AWS resources will be generated.
- Upload the JSON file in the same modal dialog within Miro.
- Miro will generate a visualization of your AWS infrastructure.
Example of an AWS infrastructure diagram generated by the Cloud View app
💡 You can change the color of AWS icons directly in the CloudView app for Miro. This option is unavailable for icons pre-2025.
Frequently asked questions
Security
When creating a new AWS role to grant access to Miro, you use the link provided in the Cloud View modal. This link contains both an Account ID and an External ID. The External ID is derived from an internal ID and a Miro-managed secret key in a one-way cryptographic scheme. It ensures that each Miro organization has its own distinct External ID, and makes it impossible for anyone outside of your organization to claim your ID to access your AWS infrastructure.
The External ID is a hash generated using a mechanism managed by AWS and it guarantees that connections are exclusive to your Miro organization.
Assigning Role ARNs
In addition to the External ID, users need to assign the Role ARN of the created role to connect to the AWS environment and scan resources. Assigning the Role ARN is entirely the customer’s responsibility and is managed by their AWS administrator. The administrator decides who to assign the Role ARN to, allowing them to control access to the role. The same Role ARN can be assigned to multiple Miro users, and anyone assigned to both the Role ARN and the corresponding Miro organization can connect to the AWS environment. However, this access remains strictly restricted to that specific Miro organization by validating the External ID during each authentication process.
Customer Security Responsibilities
To maintain the security of your AWS resources when using Cloud View, please be aware of the following responsibilities:
- Limit Organization Membership: When giving wider access, it's advisable to create a dedicated Miro organization in your account specifically for cloud visualization. By limiting the number of organization members, you can ensure that only specific authorized users have access to your sensitive cloud information.
- Careful Assignment of Role ARN: When granting access to larger Miro organizations, be careful about how you assign the created role’s ARN. Only assign the ARN to those who need the access. This decision is up to you, as you may want to provide broader access to a small Miro organization while limited access for a test AWS account with larger Miro organizations.
By following these practices and leveraging Miro's secure access framework, you can confidently use Cloud View to manage your AWS resources.
When you connect Miro to your AWS environment using a Role ARN, only you can view, visualize and manage data through that specific connection. Others in your Miro organization can add the same Role ARN to establish their own connections, if needed.
You can view details about our commitment to data privacy and security (including the specific controls and policies implemented by our teams) in Miro’s Trust Center. For more detailed questions, please reach out to your account team or raise a support ticket.
Linking a Cross-account role
Not yet. Currently, Miro doesn't provide API access for programmatic diagram creation or updates.
No, the AWS Cloud View app currently doesn't allow for updating AWS account data. This functionality will be supported in future.
There are no hard limits on the number of resources that can be visualized in a diagram. However, diagrams with a large number of resources may take longer to load and render.
We care about data privacy and security and strive to keep our security practices on par with industry leaders. Read our most frequently asked questions about data privacy and security.
Not yet. All rendered diagrams are static. Users can create new diagrams after updating data and place them next to older versions for comparison.
Not yet. Currently, Miro only supports importing data from AWS.
- Athena Named Queries
- Auto Scaling Groups
- CloudTrail Trails
- CloudWatch Metric Alarms
- CloudWatch Metric Streams
- DynamoDB Tables
- EC2 Instances
- EC2 VPCs
- EC2 VPC Endpoints
- EC2 Subnets
- EC2 Route Tables
- EC2 Internet Gateways
- EC2 NAT Gateways
- EC2 Transit Gateways
- EC2 Volumes
- EC2 Network ACLs
- EC2 VPN Gateways
- EC2 Network Interfaces
- ECS Resources
- EFS File Systems
- ElastiCache Clusters
- ELBv2 Load Balancers
- ELBv2 Target Groups
- ELBv1 Load Balancers
- EKS Clusters
- Lambda Functions
- Redshift Clusters
- RDS Instances
- RDS Clusters
- RDS Proxies
- Route 53 Hosted Zones
- S3 Buckets
- SNS Topics
- SQS Queues
Miro connects through a cross-account role that you or your AWS administrator creates. This role should point to Miro's AWS account and use a unique external ID that Miro provides. Miro safely stores and uses this external ID to assume the role and retrieve data. Miro then scans all the regions and resources it can access. This allows you to see your AWS setup as easy-to-understand diagrams.
The role can be created using a link within the Cloud Data Import app’s modal dialog that contains all the necessary information to create the role. Users can use this link to create a new role directly or share it with their administrator if they don't have the required permissions.
Miro attaches the "ReadOnly - job function" policy to the role. For a more restrictive approach, you can attach a custom policy with specific permissions. Miro will then scan everything it has access to. Miro doesn’t need any form of write access.
Miro can scan your infrastructure without adding extra costs to your AWS account. Keep in mind that fetching data requires making requests to your services, which temporarily uses rate limit quotas. These quotas apply on a per-minute basis, so they return to normal once the discovery job is complete.
You can view and delete the links to your AWS account from the three dots (...) menu on the Select AWS account screen. Deleting the link doesn't affect your existing diagrams in Miro.
It’s not possible to share the account via the user interface at this moment. But beware that all people within the same organization can add the same Role ARN to access the data if you share the Role ARN with them. Nobody outside your Miro organization can access the data via the Role ARN.
When you generate a diagram on a board, it’s accessible to everybody who has access to that board. You can share the board to specific people.
It's common for not everyone in an AWS account to have permission to create a new IAM role. If this applies to you, ask your AWS administrator to open the AWS Data Import app modal dialog and set up an IAM role using the provided link. Your administrator may have already created a specific role with certain permissions and might only share the ARN of that role with you.
To scan your infrastructure Miro sends multiple requests to various services on your aws infrastructure and this is probably what is causing the alerts. Please let your security team know about this and ask them to configure the alert in a way that they expect such integration to exist.
When you visualize an AWS diagram on a board, you’re basically creating a static diagram representing your infrastructure. By sharing the board you’re not sharing any credentials or access information with others. Still, it’s important to be aware who you’re sharing the infrastructure visualization with.
JSON Upload
You’ll need Node.js installed on your machine and the AWS CLI (Command Line Interface) set up.
The script requires “ReadOnly - job function” policy (arn:aws:iam::aws:policy/ReadOnlyAccess).
You can set a custom policy to the role and limit Miro to specific resources or regions if desired. Miro scans for the resources mentioned on this page by default. If you have set a custom policy the script will only scan within the scope it has access to.
The script is open source, so you can review the discovery mechanism, and even comment out resources you don’t need to employ.
No, for now Miro doesn’t store the information.
You can use AWS Cloud View app without incurring any additional costs.
Running the app against your infrastructure will use some of your service’s quota during the specific time when the app is scanning resources. Resource scanning happens when you link a new AWS account or when you run the script in your AWS CLI to generate JSON output. It’s usually better to scan the infrastructure when there aren't already heavy loads on your infrastructure.
Alternatively, you can reduce the amount of requests we make per second to a lower number using when using the AWS CLI script using --call-rate-rps. For example, you may run the script with --call-rate-rps 1 which only makes one request per second to the services, which ensures fair usage rates.
The script is equipped with an exponential backoff strategy meaning that it retries failed requests with bigger and bigger delays in between, which is the standard suggested method by AWS.
You can make suggestions about adding support for specific services on Github. Once there, click on "Request Cloud Resource/Service Support”.