What tools can scan an AWS account and create an infrastructure report or diagram?

Be careful not to treat an automatically generated diagram as the source of truth. These tools can show infrastructure relationships, but they usually can’t tell you why a resource exists, which application depends on it, or whether it’s still important. A good workflow is cost and usage analysis first, then resource discovery, followed by a focused diagram of the active systems. AI-assisted tools can help produce an HTML report or draft diagrams, but their findings should be verified against the account.

Start with AWS Cost Explorer, grouped by service, region, and tags if available. A discovery scan may list every resource that was created, including abandoned or inactive ones, while billing data shows what is currently generating costs. After that, use a scanner for things Cost Explorer won’t show well, such as IAM, security groups, DNS, and other free or low-usage resources. A practical first pass is VPC, EC2, Lambda, DynamoDB, RDS, Route 53, CloudWatch, CloudTrail, IAM, and IAM Identity Center.

AWS Config can make the inventory easier if it’s already enabled. For visual diagrams, Cloudcraft and Lucidscale can both create diagrams from discovered AWS resources, although the results usually need cleanup and won’t explain the application’s business logic. AWS’s DevOps Agent is another option that can help with automatic discovery, depending on your support and account setup.

Steampipe is good for querying AWS infrastructure at scale, and Powerpipe can turn that information into dashboards for configuration drift and compliance. It’s more of an investigation and reporting toolkit than a one-click architecture scanner, so you need to decide what to query. For a quick visual map, a dedicated diagramming tool may be easier.

Former2 is a useful free starting point. It can inspect existing AWS resources and generate infrastructure-as-code templates, including CloudFormation and Terraform, which gives you a structured inventory even if the account has no documentation. You’ll still need to manually trace the main networking and IAM paths afterward.