Self-Hosted draw.io Diagram Editor on AWS User Guide

Overview

This guide covers deploying and using a self-hosted draw.io / diagrams.net diagram editor on AWS from the cloudimg AWS Marketplace AMI. draw.io is a popular open source diagram editor for flowcharts, UML, entity-relationship, network, BPMN, org-chart, mind-map and wireframe diagrams. The editor runs client-side in your browser; this appliance hosts the draw.io web application and serves it to you over HTTPS. draw.io is released under the Apache-2.0 licence.

Because the editor runs in the browser, your diagram data stays with you - in your browser, on your device, or in whatever storage you choose to connect (local files, or your own Google Drive, OneDrive or GitHub). The server keeps no diagrams and has no database. It is a stateless editor host.

draw.io itself has no login of its own. This image hardens the runtime and fronts it with HTTPS rather than exposing an unauthenticated administrative surface:

• The official draw.io web application (v30.3.14) is deployed on Apache Tomcat 9 (the runtime the draw.io project itself ships) on OpenJDK 17, bound to the loopback interface only (127.0.0.1:8080).
• The stock Tomcat manager and host-manager applications are removed, the Tomcat users file is empty, and the shutdown port is disabled - so there is no administrative console and no shared password baked into the image.
• nginx on port 443 terminates HTTPS with a self-signed TLS certificate that is regenerated uniquely on each instance's first boot, and reverse-proxies to the loopback-bound application. Port 80 serves an unauthenticated /healthz and redirects everything else to HTTPS.
• Instances require IMDSv2, and the build verifies on every image that the app's built-in image-import proxy does not expose the instance metadata endpoint.

What is included:

• draw.io / diagrams.net v30.3.14 (Apache-2.0), the official draw.war deployed as the root web application on Apache Tomcat 9.0.120
• drawio.service systemd unit running Tomcat bound to the loopback interface only, restarted automatically on failure
• drawio-server-firstboot.service systemd oneshot that regenerates the per-instance self-signed TLS certificate, starts the editor, proves a known editor asset loads, and writes a secret-free access note to /root/drawio-server-credentials.txt
• nginx on port 443 (HTTPS) reverse-proxying to the loopback-bound editor, with an unauthenticated /healthz for load-balancer probes; port 80 serves the same health endpoint and redirects everything else to HTTPS
• A hardened Tomcat: manager/host-manager applications removed, empty users file, shutdown port disabled, loopback bind
• Ubuntu 24.04 LTS base with the latest security patches

Connecting to your instance

Connect over SSH on port 22 as your operating-system variant's default login user:

draw.io has no login of its own - you do not sign in to use the editor. Open it in a browser at https://<public-ip>/ and accept the per-instance self-signed certificate.

Prerequisites

• An AWS account subscribed to this product
• An EC2 key pair for SSH access
• A Security Group allowing inbound TCP 22 (SSH), 80 and 443 (HTTPS) - ideally restricted to your own IP range, because the editor has no login of its own
• A modern web browser

Step 1: Launch from the AWS Console

1. Open the product in AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.
2. Choose an instance type (any current-generation type works; the app is lightweight because rendering happens in the browser).
3. Select your key pair and a Security Group allowing inbound 22, 80 and 443.
4. Launch, and note the instance's public IP address.

Step 2: Launch from the AWS CLI

aws ec2 run-instances \
  --image-id <ami-id-from-listing> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=drawio-server}]'

Step 3: Verify the services are running

SSH in and confirm both services are active:

sudo systemctl is-active drawio nginx

active
active

Step 4: Inspect the runtime and listeners

The editor's Tomcat listener is bound to the loopback interface only - only nginx (ports 80 and 443) is reachable from the network:

sudo ss -tlnp | grep -E ':(80|443|8080) '

LISTEN 0 511  0.0.0.0:80    0.0.0.0:* users:(("nginx",...))
LISTEN 0 511  0.0.0.0:443   0.0.0.0:* users:(("nginx",...))
LISTEN 0 100  [::ffff:127.0.0.1]:8080 *:* users:(("java",...))

Port 8080 (Tomcat) answers on 127.0.0.1 only. Confirm the baked version and licence:

cat /opt/tomcat/DRAWIO_VERSION

drawio_version=30.3.14
drawio_war_sha256=f46acbc76273bece778a39c4dda63261c10d7326160b3ffb231cb784e9b0a9eb
drawio_license=Apache-2.0
tomcat_version=9.0.120
baked_at=2026-07-24T02:07:26Z

Step 5: Read the access note

draw.io ships no credentials. A secret-free access note records the editor URL:

sudo cat /root/drawio-server-credentials.txt

# draw.io — Access Notes
# Generated on first boot by drawio-server-firstboot.service
#
# draw.io (diagrams.net) is a client-side diagram editor. It has NO admin UI,
# login or password: diagrams live in YOUR BROWSER / on YOUR DEVICE ...
#
drawio.url=https://<public-ip>/
drawio.healthz=https://<public-ip>/healthz
drawio.version=v30.3.14

Step 6: Verify the editor over HTTPS

The editor is served over HTTPS. A known editor asset (the ~9 MB draw.io application bundle) loads over TLS:

curl -sk -o /dev/null -w 'GET /js/app.min.js -> HTTP %{http_code}, %{size_download} bytes\n' https://127.0.0.1/js/app.min.js

GET /js/app.min.js -> HTTP 200, 9407659 bytes

The unauthenticated health endpoint answers on both HTTP and HTTPS, and port 80 redirects to HTTPS:

curl -sk -o /dev/null -w 'healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz

healthz -> HTTP 200

Step 7: Confirm the hardening

The stock Tomcat administrative console is removed, so the manager application returns 404:

curl -sk -o /dev/null -w 'GET /manager/html -> HTTP %{http_code}\n' https://127.0.0.1/manager/html

GET /manager/html -> HTTP 404

Step 8: Open the editor in a browser

Open https://<public-ip>/ in your browser and accept the per-instance self-signed certificate. The draw.io editor loads directly - no login is required.

Draw flowcharts, UML, network, BPMN and other diagrams by dragging shapes onto the canvas and connecting them:

Select any shape to style it with the Style, Text and Arrange panels on the right:

Step 9: Save and export your diagrams

Because draw.io runs in your browser, you choose where diagrams live:

• Local device - save .drawio (or .xml) files to your computer from the File menu.
• Your own cloud storage - connect Google Drive, OneDrive or GitHub from File > Open from / Save to so diagrams are stored in accounts you control.
• Export - export any diagram to PNG, SVG or PDF from File > Export as. Export is performed client-side by your browser, so no additional export service is exposed on the instance.

Step 10: Managing the service

# Status and logs
sudo systemctl status drawio nginx
sudo journalctl -u drawio -n 100 --no-pager

# Restart the editor or the proxy
sudo systemctl restart drawio
sudo systemctl restart nginx

Step 11: Production recommendations

• Restrict inbound access. draw.io has no login of its own, so anyone who can reach the URL can use the editor. Restrict the Security Group to your own CIDR, or place the instance behind a VPN / private subnet.
• Use your own domain and certificate. For a trusted certificate, terminate TLS at nginx with your own domain and a CA-signed certificate (for example via certbot), or front the instance with an Application Load Balancer and ACM certificate. Edit /etc/nginx/sites-available/cloudimg-drawio and point ssl_certificate / ssl_certificate_key at your own files, then reload nginx.
• Keep it patched. Apply OS security updates (sudo apt-get update && sudo apt-get upgrade) regularly.
• Health checks. Use https://<public-ip>/healthz (unauthenticated) for load-balancer and monitoring probes.

Step 12: Support and licensing

draw.io / diagrams.net is licensed under the Apache-2.0 licence; the licence text is baked into the image at /opt/tomcat/webapps/ROOT/LICENSE. "draw.io" and "diagrams.net" are trademarks of JGraph Ltd; this image packages the open source application for self-hosting and is not affiliated with or endorsed by JGraph Ltd. cloudimg provides the packaging, hardening and support.

Need Help?

cloudimg provides 24/7 technical support for this product by email and live chat at support@cloudimg.co.uk. We can help with deployment, reverse-proxy termination with your own domain and certificate, connecting the editor to your own storage, network hardening for the login-less editor, and instance sizing.