公有云网络分区. Copy the source, paste into the official playground, done. No coordinates — every position is stated relative to something else.
node inet "Internet"
node alb "ALB" below inet
node app1 "app-1" below-left of alb
node app2 "app-2" below-right of alb
node db "Database" below app1 level with app2
edge inet -> alb
edge alb -> app1
edge alb -> app2
edge app1 -> db from: bottom
edge app2 -> db from: bottomnpx reladraw vpc-network.reladraw -o out.svgThe cloud-network-zone layout: internet into an ALB, two app servers behind it, one database below. Use it for cloud onboarding and security reviews — the placement makes the trust boundary readable: what is reachable from the internet, what is not.
node priv.app1 "app-1" and node priv.db "Database" — the priv prefix groups the private tier.node bastion "Bastion" left of alb and edge bastion -> priv.db "ssh" from: left.node nat "NAT" right of alb and edge priv.app1 -> nat "egress" from: right.One node per resource, compound ids (pub.alb, priv.app) as subnet containers, edges only where security groups allow. This template shows the standard edge-to-private layout.
Group resources with dotted ids — pub.* renders as one container and priv.* as another. The visual split is what security reviewers look for first.
Yes: give each VPC its own prefix (vpc1.app, vpc2.app) and draw the peering edge between two members. Multi-region follows the same pattern with region prefixes.