Guide
Best cloud diagram tools in 2026
Compare Eraser, Cloudcraft, Lucid Cloud Accelerator (formerly Lucidscale), and Hava on coverage, AI scoping, refresh, editing, and agent access.
Every team running on AWS, Azure, or Google Cloud eventually needs a picture of what is actually deployed – for onboarding, a design review, an audit, or an incident. Drawing it by hand is slow, and the result drifts from reality as soon as someone ships. Cloud diagram tools connect to your accounts and draw from the infrastructure itself. The real decision is which one gives you a diagram you can use: current enough to trust, scoped to the question you are asking, and editorialized enough to put in front of people.
This guide compares four options: Eraser, Cloudcraft, Lucid Cloud Accelerator (formerly Lucidscale), and Hava.
What is a cloud diagram tool?
A cloud diagram tool reads a cloud account through read-only access and draws architecture diagrams from the resources actually deployed there, rather than from someone’s memory of them. It builds an inventory of what exists and how it connects, then turns some part of that inventory into a diagram. The tools differ in how you choose that part, how often the inventory is refreshed, and what you can do with the diagram afterwards.
Diagrams generated from Terraform or other infrastructure as code show what the code declares; a cloud diagram tool shows what is actually running, including any ClickOps.
Why use a cloud diagram tool?
- Start from what is deployed. A generated diagram reflects the account, including the resources nobody remembered to draw.
- Skip the drawing. A diagram of a whole VPC takes minutes rather than an afternoon of placing icons.
- Keep documentation current. Refreshing from the account is cheaper than redrawing, so diagrams get updated instead of abandoned.
- Answer specific questions. Network paths, security groups, and access are easier to review on a diagram than across console pages.
- See what changed. Some tools keep versions of an environment, so you can compare two points in time.
The best cloud diagram tools in 2026
All four read your accounts with read-only credentials and draw diagrams from what they find. Where they differ is in how you get from a full inventory to a diagram someone can read, how they stay current, and what you can do with the result.
| Compare | Eraser | Cloudcraft | Lucid Cloud Accelerator | Hava |
|---|---|---|---|---|
| Clouds scanned |
|
|
|
|
| Organization-wide connection |
|
|
|
|
| Diagram from a prompt | YesAny connected cloud | No | PartialAWS only, in beta | No |
| Automatic refresh | YesConfigurable | YesLive diagrams update when opened | YesDaily to yearly schedule | YesEvery 24 hours |
| Inventory view | YesModel viewer | PartialResource list in the Live tab | YesResource inventory view | YesList view |
| Design before deploying | YesPrompt or diagram-as-code | YesStandalone app, AWS and Azure | YesIn Lucidchart | No |
| Editing the result | YesCanvas and diagram-as-code | PartialEdits stop live updates | YesRearrange by hand in Lucidchart | NoCustom connections and spacing only |
| Diagram from IaC | YesTerraform, CloudFormation, Bicep, Pulumi, Kubernetes | No | NoGenerates Terraform from diagrams, in beta | No |
| External editable exports |
|
|
|
|
| Agent access |
|
|
|
|
The comparison reflects each product’s documentation in September 2026. Cloudcraft is now offered in two editions – the standalone app and Cloudcraft in Datadog – and the table describes the standalone app.
1. Eraser
Eraser connects to AWS accounts and organizations, Azure tenants, and Google Cloud projects, organizations, and folders, and scans them into an inventory of resources and the relationships between them. You then ask for the diagram you want in AI chat, with the environment attached: the whole account, one VPC with its subnets and load balancers, one workload and everything it talks to, or the answer to a question such as “what has access to the production database?” The cloud diagrams documentation walks through it.
The scan records more than containment. Eraser derives relationships from routing, security-group rules, IAM grants, and configuration such as environment variables, so a prompt can ask about reachability and access, not only about what sits inside which VPC. Several environments can go into one prompt, which covers architectures that span accounts or clouds.
The result is an ordinary Eraser diagram – an AI diagram with an editable diagram-as-code definition and canvas, drawn with AWS, Azure, and Google Cloud icons. Keep prompting to refine it, apply your team’s AI presets and styles, and export it like any other diagram.
Features
- Prompt-scoped diagrams. Ask for an account, a VPC, a region, a workload, or a question about access; the AI selects the resources and lays them out.
- Relationship mapping. Network paths, security-group reachability, IAM access, and configuration references, most detailed on AWS.
- Multi-cloud prompts. Attach several accounts, subscriptions, or projects to one prompt and draw them together.
- Scheduled scans. Rescan each environment on a schedule you configure, or on demand.
- Model viewer. Browse the scanned inventory directly, not only the diagrams drawn from it.
- Agent access. Work with connected cloud environments from agents through Eraser’s API and MCP server.
- Future-state design. Draw architecture that is not deployed yet, from a prompt or as diagram-as-code.
- Diagrams from infrastructure as code. Paste Terraform, CloudFormation, Bicep, Pulumi, or Kubernetes files, or reference a connected GitHub, GitLab, or Azure DevOps repository, and Eraser draws the architecture they declare.
- Editable exports. PNG, SVG, and PDF, plus draw.io, Visio, PowerPoint, and Google Slides.
Best for
- Engineering and platform teams that need a specific diagram for a specific question – a design review, an onboarding doc, an incident write-up.
- Teams documenting what is deployed and what they plan to build in the same place.
- Architects who want a generated diagram to be a starting point they can edit, not a fixed view.
Limitations
Eraser does not estimate cost. Its cloud diagrams show what is deployed and how it connects, not what it costs, so spend still comes from your cloud provider’s billing tools.
2. Cloudcraft
Cloudcraft, owned by Datadog, is best known for its 3D isometric AWS diagrams, and now comes in two editions. The standalone app is a diagram editor that can also scan AWS and Azure accounts: live diagrams are laid out automatically, filtered by resource type and tag, and grouped by region, VPC, subnet, or security group. Every diagram carries a budget estimated from its components.
Cloudcraft in Datadog is a read-only map inside Datadog, built from the resources Datadog’s cloud integrations already collect. It covers AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, and vSphere, and overlays monitoring, security, and billed-cost data on the diagram. At the time of writing, Cloudcraft’s pricing page describes it as free with any Datadog subscription and sends new sign-ups to Datadog.
Features
- 2D and 3D isometric views, with AWS and Azure component libraries for designing by hand.
- Live scans of AWS and Azure with auto layout, filters, and Infrastructure, Network, and Security group-by presets.
- Budget estimates on every diagram, exportable through the API.
- Datadog edition: five platforms, with Infrastructure, Observability, Security, Cloud Cost Management, and Monitors overlays.
- PNG, SVG, and PDF export, a 2D export to draw.io, a REST API, and a Confluence app.
Best for
- Teams already on Datadog that want a live, read-only map of their estate with operational data on top.
- AWS and Azure teams that want polished 3D diagrams with cost estimates for planning.
Limitations
The standalone app scans AWS and Azure only. Editing a live diagram turns it into a snapshot that no longer updates, and switching back to live discards the edits. Version history keeps earlier diagrams but does not diff them. The Datadog edition is read-only, so it cannot be used to design or annotate. Neither edition generates diagrams from a prompt, and Terraform export was removed.
3. Lucid Cloud Accelerator (formerly Lucidscale)
Lucidscale’s functionality has moved into Lucidchart, where it is sold as the Cloud Accelerator add-on for Lucid Enterprise accounts. It imports AWS, Azure, and Google Cloud through a read-only role, service principal, or service account – or from a JSON file produced by Lucid’s CLI script – and draws the result as a cloud frame inside a Lucidchart document.
Views do the scoping. Templates such as Summarized, Security, Compliance, Resource inventory, and Cost savings decide what is shown; filters, grouping by account, region, VPC, and subnet, and conditional formatting refine it. Imports refresh on a schedule, and Cloud Version Compare highlights what was added, modified, or removed since the last saved state.
Features
- Scheduled refresh – daily, weekly, monthly, or yearly – with documents that can sync automatically.
- View templates, metadata filters, and conditional formatting.
- Cloud Version Compare, coloring added, modified, and removed resources.
- A Cloud Agent, in beta and AWS-only, that builds targeted diagrams from a prompt.
- A Cloud API for registering credentials, importing accounts, and generating and syncing cloud diagrams.
- AWS cost modeling from list prices, and Terraform generated from Lucidchart diagrams, in beta.
- Export to PNG, SVG, PDF, and Visio, plus CSV and JSON inventories.
Best for
- Organizations standardized on Lucid Enterprise that want cloud diagrams alongside the rest of their Lucidchart documents.
- Teams that need scheduled imports and security or compliance views across a multi-cloud estate.
Limitations
The Cloud Accelerator is an Enterprise add-on bought through Lucid’s sales team. Each document holds one cloud frame, and Version Compare only compares against the most recent saved state. Lines appear only where resource metadata links two resources, and they disappear when shapes are summarized. The Cloud Agent covers AWS only. The move from Lucidscale is recent, and Lucid’s older documentation now lives in a legacy Lucidscale post.
4. Hava
Hava generates diagrams from AWS, Azure, and Google Cloud automatically and keeps them current without anyone in the loop. By default it draws one diagram per VPC and re-syncs every 24 hours. Search filters – by tag, region, subnet, resource type, or account – define custom environments, including ones that span accounts and clouds.
Its strength is tracking change over time. Each sync that finds a difference creates a new version, Compare Revisions shows what was added and removed between any two versions, and monitoring alerts email a diff diagram when an environment changes or a new service appears.
Features
- Infrastructure, Extended, List, Security Group, and Container views.
- Daily automatic sync, with manual sync from the UI, API, CLI, or a GitHub Action.
- Version history, Compare Revisions, and email alerts on change.
- Estimated monthly cost per resource and per environment.
- Embeds that update themselves and need no Hava login, a Confluence macro, and a REST API.
- PNG, PDF, Visio, CSV, and JSON export, and a self-hosted option on the Enterprise plan.
Best for
- Compliance, audit, and operations teams that want hands-off documentation of what is deployed and a record of how it changed.
- Organizations that need to run the diagramming tool inside their own infrastructure.
Limitations
Hava’s documentation is direct about it: “The one thing Hava is NOT is a drag and drop tool.” You cannot design an architecture that is not deployed, and beyond drawing custom connections and adjusting spacing, editing means exporting a Visio file and opening it in Visio or draw.io. Only connections Hava can determine from configuration are drawn, so application-level links – code reading from an S3 bucket, say – have to be added by hand. Cost estimates use on-demand list prices, and Kubernetes support is in private beta.
Key features to look for
Coverage of your estate
Start with the clouds and account structures you run. All four read AWS and Azure, and all but Cloudcraft’s standalone app read Google Cloud. Check whether a tool can connect at the organization or tenant level, so new accounts are picked up without another setup: Eraser and Lucid can on all three clouds, Hava can for Google Cloud and, through its Control Tower integration, AWS, and Cloudcraft’s standalone app adds accounts one at a time. Also check whether Kubernetes is a source in its own right or only a set of resource types inside each provider.
Scoping to the diagram you need
A diagram of an entire account is an inventory, not an explanation. The useful diagram usually answers a narrower question – one workload, one VPC, the path from the internet to a database. Filter-based tools get there through views, tags, and group-by settings, which works well when tagging is consistent. Eraser takes the question as a prompt and selects the resources itself, which helps most when the boundary you care about is not encoded in tags. Lucid’s Cloud Agent offers prompts for AWS.
Freshness
Decide how current the diagram needs to be and what triggers an update. Hava re-syncs daily and Lucid imports on a schedule; Cloudcraft’s live diagrams refresh when opened. Eraser rescans on a schedule you configure. Also check what a refresh does to your edits: in Cloudcraft, an edited diagram stops updating.
Relationships, not just containment
Nesting resources inside VPCs and subnets is the easy part; the lines are where cloud diagrams go wrong. Ask each tool how it decides two resources are connected. Lucid draws a line only where resource metadata links two resources, and Hava only where it can determine the connection from configuration. Eraser also infers relationships from security-group rules, IAM grants, and environment variables, which is what lets it answer “what can reach this database?” Inferred links deserve the same review as any generated diagram.
Change tracking and cost
If audits or change reviews drive the need, version comparison matters more than layout. Hava compares any two versions and emails alerts, Lucid compares against the last saved state, and Cloudcraft keeps versions without a diff. For cost, Cloudcraft and Hava estimate from resource configuration, Cloudcraft in Datadog shows billed cost, and Lucid offers a savings view and AWS list-price modeling. Eraser offers neither.
Editing and future-state design
A generated diagram is rarely the last word. Check whether you can rearrange it, annotate it, and add what the scanner cannot see, and whether you can draw architecture that does not exist yet – a proposed migration, a new region. Eraser and Cloudcraft’s standalone app handle both, though editing a live Cloudcraft diagram stops its updates; Lucid does it in Lucidchart; Hava relies on exporting to another editor. If your team keeps its architecture in code, Eraser can also draw from it – see the Terraform diagram generator.
Export and sharing
Look at where the diagram has to end up. Visio and draw.io exports keep it editable in other tools, PowerPoint and Google Slides exports matter for presentations, and embeds matter for wikis. Hava’s embeds update themselves as the environment changes.
Choosing a cloud diagram tool
Start with the questions the diagrams have to answer and who reads them. An auditor needs a complete, dated record; an engineer in a design review needs one workload, clearly laid out; a leadership update needs a slide. Weigh freshness, scoping, and editing against those needs. In short:
- Eraser – you want the specific diagram a question calls for, drawn from what is deployed, then refined by prompt, edited, and exported like any other diagram – alongside the architecture you have not built yet.
- Cloudcraft – you already run Datadog and want a live, read-only map with monitoring, security, and cost overlays, or you want 3D isometric AWS and Azure diagrams with budget estimates.
- Lucid Cloud Accelerator – your organization is standardized on Lucid Enterprise and wants scheduled imports, compliance views, and version comparison inside Lucidchart.
- Hava – you need hands-off documentation that re-syncs daily, emails you when an environment changes, and can run self-hosted.
Connect a non-production account to each tool on your shortlist and generate the diagrams you actually need: the whole account, one workload, one security question. Change something, refresh, and see what happens to the diagram and to any edits you made. The tool whose output needs the least correction before you would share it is usually the right one.
If you are designing rather than documenting, the AWS diagram generator draws architecture from a description. And if diagrams need to be created and read by agents rather than people, compare agentic diagramming platforms or diagramming MCP servers instead.