Map your AWS architecture — interactive diagram & AI audit for Mac
A native macOS app that scans 33+ AWS services, renders your infrastructure as an interactive architecture diagram, and runs an AI audit across security, cost, reliability, and performance — using your own OpenAI or Anthropic account. Everything runs on your Mac; credentials never leave your Keychain.
Per-project. Encrypted by Apple.
Only Describe* / List* API calls.
Your infrastructure stays on your laptop.
Thirty-three-plus AWS services,
one architecture diagram.
AWSAnalyze calls the Describe/List APIs across every major category and stitches the results into a single graph — no gaps, no console tab-hopping. A complete visualization of your AWS account in under a minute.
Everything the AWS console won't show you, in one view.
Pan, zoom, and click any resource.
VPCs contain subnets contain instances — the hierarchy AWS never shows you, rendered as an actual graph.
- ▸Smooth pan and zoom across your account’s resources.
- ▸Service-type highlighting dims unrelated nodes to 30%.
- ▸Hierarchical VPC → Subnet → Resource containers.
- ▸Public vs. private subnet color coding.
One-click filtering by service.
Eleven categories. Click DynamoDB, see only DynamoDB — the rest of the graph dims to 30% so you don’t lose spatial context.
- ▸Per-service counts shown inline in the sidebar.
- ▸Click the active row again (or “Show All”) to clear the filter.
- ▸The full graph stays visible — nothing is hidden, just dimmed.
Every property, parent, child, and association.
Click a node to open the inspector. See what VPC and subnet it lives in, which security groups attach to it, every tag, every property AWS returns.
- ▸Every ID, ARN, and CIDR is selectable — ⌘C to copy.
- ▸Parent (VPC / subnet) and child resources listed in the side panel.
- ▸Associated resources (security groups, target groups, …) shown next to the properties.
EC2 · api-worker-03
Associations
Security, Cost, Reliability, Performance — reviewed by the AI you pick.
Get a severity-ranked review of your account with prioritized remediation actions. Plug in your own OpenAI account (OAuth or API key) or your own Anthropic account (API key, Claude Sonnet 4.6). Either way, the request goes straight from your Mac to the provider — nothing touches our infrastructure, because there isn’t any.
- ▸Executive summary + four pillar reports: security, cost, reliability, performance.
- ▸Findings grouped by severity: critical · warning · info.
- ▸Ranked priority actions with impact statements.
- ▸Assessment cached on the project — run once, review later.
- ▸Zero vendor lock-in: switch providers without re-scanning.
Ship your scan as code or a PDF.
Emit CloudFormation or Terraform for the core networking + compute layer, or save the map as a PDF you can hand to an auditor.
- ▸CloudFormation / Terraform cover the core resources: VPC, subnets, security groups, EC2, RDS, Lambda, S3, ELB, NAT, IGW.
- ▸Output is sorted deterministically — friendly to git diffs.
- ▸PDF captures the rendered map, ready to print or attach.
Multiple accounts. Vaulted separately.
One app, every environment. Each project is scoped to a single region and gets its own Keychain entry — staging can’t read production. Scan another region by spinning up a second project.
Looking for a Cloudcraft, Hava, or AWS Perspective alternative?
AWSAnalyze is the only tool in this category that runs natively on macOS, ships with an AI audit out of the box, and keeps every byte of your infrastructure on your Mac. Here’s how it differs from the usual cloud-diagram tools.
Native macOS, not a web app.
Cloudcraft, Hava, and AWS Perspective all run in the browser against a hosted backend. AWSAnalyze is a Swift app you install via Homebrew — no account, no subscription, no browser tab, no company sitting between you and your AWS data.
AI audit across four pillars.
The other tools render diagrams. AWSAnalyze renders the diagram and runs an AI audit across security, cost, reliability, and performance — using your own OpenAI or Anthropic account. No other AWS visualization tool in this category ships a built-in AI audit.
Credentials never leave your Mac.
Web-based diagram tools require you to upload AWS credentials, or role-assume into their account, so their backend can render your infrastructure. AWSAnalyze reads the account directly from your laptop via the AWS SDK, vaults keys in the macOS Keychain, and ships zero bytes of telemetry.
Where the web-based tools still win: team collaboration on a shared live diagram, multi-account / multi-region merged into a single view, and integration with cloud-billing data. If those are blockers for you, Cloudcraft and Hava remain solid choices. If they’re not, you save the subscription and keep your AWS data local.
Your AWS keys never leave your Mac.
AWSAnalyze is architected so there is nothing for us to leak. No account, no backend, no telemetry pipeline — the server simply doesn't exist.
Keychain-vaulted credentials
Stored per-project using Apple's Security framework. Unlocks require device authentication.
Read-only scans
The app only invokes Describe* and List* APIs. No writes, ever. Bring a policy-scoped IAM user.
No backend, no account
AWSAnalyze runs entirely on your machine. There is no server, no user database, no analytics pipeline.
Three steps. No account required.
Install
Run brew install --cask itsfreddyrb/awsanalyze/awsanalyze in your terminal. Homebrew downloads, verifies the signature, installs to Applications, and opens cleanly on first launch — no Gatekeeper dance.
Enter AWS credentials
Paste an access key ID and secret. A read-only IAM user is recommended — ViewOnlyAccess is a good baseline. Credentials are stored in your Keychain.
Scan and explore
Pick a region, hit scan. Resources populate the graph when the scan completes. Each project scans one region — create another for a different region.
Built by one developer.
Payments go a long way.
AWSAnalyze is free and always will be. If it saved you an afternoon of clicking through the AWS console, a small contribution goes directly to a Venezuelan developer. PayPal handles everything — no account required on your side.
Opens PayPal in a new tab · no PayPal account needed · card checkout supported.
The practical details.
Question didn’t make the FAQ?
Email hello@awsanalyze.app — it goes straight to the one person who makes this. Usually a reply within a day. Bug reports with a screenshot get bumped to the front of the line.