Available For: Business, Enterprise, and Education plans
Miro’s AWS Cloud View app allows you to generate a diagram of your AWS infrastructure by importing the data from an AWS account.
There are two ways to generate this diagram:
- Linking a Cross-account role: connect your AWS account with Miro using a cross-account role and automatically visualize the AWS account
- Uploading a JSON file generated by running the script in your AWS CLI (Command Line Interface)
Linking a Cross-account role
Miro uses a cross-account role to securely access your AWS account. You need to create a ReadOnly role in your AWS account that is specifically created for Miro to access your account. Then you can use the ARN of that role to connect Miro with your AWS account.
Use the AWS Cloud View app by following these steps:
- Click the Tools, Media and Integrations (+) Icon at the bottom of the Miro toolbar and search for AWS Cloud View.
- Launch the app from the search results.
- From the modal dialog, choose the tab Link a cross-account role.
Linking a Cross-account role - Follow the steps in the dialog to setup a new cross-account role in your AWS console.
- Once the role is created in AWS, enter the ARN for the role in the Role ARN field.
Where to find the ARN field in AWS - Give a name to the new AWS account you are adding.
- Click Add and import.
- The recently added AWS account will be shown in the next step where accounts are listed.
Selecting your AWS account - Select the account you want to visualize and click Next.
- Select the region(s) you want to visualize. Note that selecting multiple regions can make the visualization process slower.
Select regions to import -
On the next screen, apply any filters to your diagram that are needed, using either the type of resource or tags. (Note that filters can be applied or edited after the diagram has been created via the context menu.)
💡 It's highly recommended to use filters to reduce the size of the diagram. A smaller diagram is faster to generate and easier to use.
You can apply two different types of filters at this step:
- Resources: For example, select “EC2 Instances” to only view EC2 instances in that AWS account.
- Tags: If your AWS resources are tagged, you may use the Tags (key and value pair) filter in addition to the Resources filter. For example, search for tag key “Owner” and choose a value, say “CheckoutStream”.
- Click Visualize to create your diagram
The diagram for the AWS Account will be generated.
Example of an AWS infrastructure diagram generated by the Cloud View app
Uploading a JSON file
You can run a script in your AWS CLI (Command Line Interface) that uses read-only permissions to securely save the data of your cloud resources into a JSON file.
Once you’ve used AWS Cloud View to visualize your AWS infrastructure in Miro, you can make edits to the diagram created, such as adding connections, adding additional shapes or objects like sticky notes, or use the AWS Cost Calculator app to see the costs the new design will incur.
Use the AWS Cloud View app with a JSON file by following these steps:
- Click the Tools, Media and Integrations (+) Icon at the bottom of the Miro toolbar and search for AWS Cloud View
- Launch the app.
- From the modal dialog, follow the instructions to set up the environment to run a script in AWS.
Uploading a JSON file
✏️ You’ll need Node.js on your machine and the AWS CLI (Command Line Interface) set up before proceeding.
- Select your AWS profile in your Terminal.
- Copy the command and run it in your Terminal.
Run the copied command in your Terminal - A JSON file containing data about your AWS resources will be generated.
- Upload the JSON file in the same modal dialog within Miro.
- Miro will generate a visualization of your AWS infrastructure.
Example of an AWS infrastructure diagram generated by the Cloud View app
Please note that the AWS Cloud View app, developed by Miro, is in beta release. We’re looking for customers to provide feedback that will inform future developments and improvements to this experience. Please share your feedback using this Typeform.
Frequently asked questions
Security
When creating a new AWS role to grant access to Miro, you use the link provided in the Cloud View modal. This link contains both an Account ID and an External ID. The External ID is derived from an internal ID and a Miro-managed secret key in a one-way cryptographic scheme. It ensures that each Miro organization has its own distinct External ID, and makes it impossible for anyone outside of your organization to claim your ID to access your AWS infrastructure.
The External ID is a hash generated using a mechanism managed by AWS and it guarantees that connections are exclusive to your Miro organization.
Assigning Role ARNs
In addition to the External ID, users need to assign the Role ARN of the created role to connect to the AWS environment and scan resources. Assigning the Role ARN is entirely the customer’s responsibility and is managed by their AWS administrator. The administrator decides who to assign the Role ARN to, allowing them to control access to the role. The same Role ARN can be assigned to multiple Miro users, and anyone assigned to both the Role ARN and the corresponding Miro organization can connect to the AWS environment. However, this access remains strictly restricted to that specific Miro organization by validating the External ID during each authentication process.
Customer Security Responsibilities
To maintain the security of your AWS resources when using Cloud View, please be aware of the following responsibilities:
- Limit Organization Membership: When giving wider access, it's advisable to create a dedicated Miro organization in your account specifically for cloud visualization. By limiting the number of organization members, you can ensure that only specific authorized users have access to your sensitive cloud information.
- Careful Assignment of Role ARN: When granting access to larger Miro organizations, be careful about how you assign the created role’s ARN. Only assign the ARN to those who need the access. This decision is up to you, as you may want to provide broader access to a small Miro organization while limited access for a test AWS account with larger Miro organizations.
By following these practices and leveraging Miro's secure access framework, you can confidently use Cloud View to manage your AWS resources.
Linking a Cross-account role
- Athena Named Queries
- Auto Scaling Groups
- CloudTrail Trails
- CloudWatch Metric Alarms
- CloudWatch Metric Streams
- DynamoDB Tables
- EC2 Instances
- EC2 VPCs
- EC2 VPC Endpoints
- EC2 Subnets
- EC2 Route Tables
- EC2 Internet Gateways
- EC2 NAT Gateways
- EC2 Transit Gateways
- EC2 Volumes
- EC2 Network ACLs
- EC2 VPN Gateways
- EC2 Network Interfaces
- ECS Resources
- EFS File Systems
- ElastiCache Clusters
- ELBv2 Load Balancers
- ELBv2 Target Groups
- ELBv1 Load Balancers
- EKS Clusters
- Lambda Functions
- Redshift Clusters
- RDS Instances
- RDS Clusters
- RDS Proxies
- Route 53 Hosted Zones
- S3 Buckets
- SNS Topics
- SQS Queues
JSON Upload
You can set a custom policy to the role and limit Miro to specific resources or regions if desired. Miro scans for the resources mentioned on this page by default. If you have set a custom policy the script will only scan within the scope it has access to.
Running the app against your infrastructure will use some of your service’s quota during the specific time when the app is scanning resources. Resource scanning happens when you link a new AWS account or when you run the script in your AWS CLI to generate JSON output. It’s usually better to scan the infrastructure when there are not already heavy loads on your infrastructure.
Alternatively, you can reduce the amount of requests we make per second to a lower number using when using the AWS CLI script using --call-rate-rps. For example, you may run the script with --call-rate-rps 1 which only makes one request per second to the services, which ensures fair usage rates.
The script is equipped with an exponential backoff strategy meaning that it retries failed requests with bigger and bigger delays in between, which is the standard suggested method by AWS.