draw.io / diagrams.net Diagram Editor - Self-Hosted

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

draw.io (also known as diagrams.net) is a popular open-source diagram editor for creating flowcharts, UML, entity-relationship, network, BPMN, org-chart, mind-map, and wireframe diagrams in your browser. This AMI delivers a fully installed, security-hardened self-hosted draw.io server so a working diagram editor is available over HTTPS within minutes of launch, running entirely in your own AWS account.

The draw.io editor runs client-side in the browser; this appliance hosts the application and serves it over TLS, so your diagram data stays in your browser or in whatever storage you choose to connect (local device, Google Drive, OneDrive, or GitHub). It is a stateless editor host - there is no server-side database and no diagram data kept on the instance.

## About cloudimg

cloudimg specializes in delivering pre-hardened, production-ready AMIs on AWS. This listing includes a software charge for ongoing cloudimg technical support services including deployment assistance, security patching guidance, and configuration help.

## Why This Image vs a Manual Install

This image eliminates the Java runtime and servlet-container setup, WAR deployment, reverse-proxy configuration, TLS termination, and Tomcat hardening that a bare install requires. A stock Tomcat ships administrative web applications and a users file that are a well-known attack surface; this image removes the manager and host-manager applications, ships an empty users file, disables the shutdown port, and binds the application to the loopback interface so only the hardened nginx HTTPS front door is reachable. Launch the instance and start diagramming - no configuration files to edit and no additional packages to install.

## Application Stack

The official draw.io web application is deployed on Apache Tomcat 9 (matching the runtime the draw.io project itself ships) on OpenJDK 17, bound to the loopback interface. An nginx reverse proxy on port 443 forwards to it over a self-signed TLS certificate that is regenerated uniquely on each instance's first boot; port 80 serves an unauthenticated health endpoint and redirects everything else to HTTPS. Image export to PNG, SVG, or PDF is performed client-side by your browser, so no additional export service is exposed.

## Security Hardening

This image follows a defence-in-depth approach:

• Network isolation: the application binds exclusively to the loopback interface; only the nginx reverse proxy is exposed
• No admin console, no default credentials: the Tomcat manager and host-manager applications are removed, the users file is empty, and the shutdown port is disabled
• Encrypted transport: the reverse proxy terminates HTTPS with a certificate generated uniquely per instance on first boot
• Metadata protection: instances require IMDSv2 and the built-in image-import proxy is verified on every build not to expose the instance metadata endpoint
• Automatic restart: systemd monitors the application and nginx and restarts them on failure

## Concrete Use Cases

• Private diagramming for regulated teams: Run the draw.io editor inside your own AWS account so architecture, security, and design diagrams are created and edited without sending diagram data to a public service - ideal for teams operating under data-residency or compliance requirements who need to keep intellectual property within their own infrastructure boundary.
• Team diagram host for engineering organizations: Put the appliance behind your own domain name and CA-signed certificate and give a development or platform team a shared, always-available draw.io editor over HTTPS for sprint planning, incident post-mortems, and cloud migration documentation.
• Diagram authoring for technical documentation workflows: Sketch and iterate on flowcharts, UML, network, and BPMN diagrams in the browser and export them as PNG, SVG, or PDF to embed in wikis, runbooks, and architecture decision records.

## AWS Integration

Deploy on any EC2 instance type; the application is lightweight because rendering happens in the browser. Front the instance with an Application Load Balancer using the unauthenticated health endpoint on port 80 for availability monitoring, and restrict inbound access to your own network with the instance Security Group. The AMI enforces IMDSv2 for metadata security.

## Getting Started

1. Launch the AMI from this listing with a key pair and a Security Group allowing inbound ports 22, 80, and 443 - ideally restricted to your own IP range.

2. Open https:/// in your browser and accept the per-instance self-signed certificate.

3. Start creating diagrams; export to PNG, SVG, or PDF from the File menu when done.

4. For production, put your own domain and a CA-signed certificate in front of the instance and restrict inbound access to your network.