Read the code. See what it builds.
Derive reads Terraform, CloudFormation, Bicep, ARM and Deployment Manager and draws the architecture they build, with the official AWS, Azure and Google Cloud icons. It runs on your machine, so your code never leaves it.
Free edition, no account needed. Runs with Python 3.12+ or Docker.
Three stacks, drawn as they are.
These are the example stacks that ship with Derive. Click any resource to see the code behind it and the references that connect it. The Azure and Google Cloud tabs are the diagram files Derive wrote, unedited.
# stack.yaml
AppVpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
EnableDnsHostnames: true
PublicSubnet:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref AppVpc
CidrBlock: 10.0.1.0/24
MapPublicIpOnLaunch: true
# network.tf, written by Derive
resource "aws_vpc" "app_vpc" {
cidr_block = "10.0.0.0/16"
enable_dns_hostnames = true
}
resource "aws_subnet" "public_subnet" {
vpc_id = aws_vpc.app_vpc.id
cidr_block = "10.0.1.0/24"
map_public_ip_on_launch = true
}
16 resources converted34 of 35 properties mapped1 gap reported, with its reasonRead the whole converted file
On the AWS example, --audit checks 17 resources and 20 references against the source text and reports no correctness findings.
Open a full diagram file, as Derive writes it: Terraform (AWS) CloudFormation Bicep ARM Deployment Manager
Nothing leaves your desk.
Point it at a folder
Drop a folder, a few files or a .zip into the local app, or run derive ./infra. It detects the format and draws. You need no account, and it works with the network unplugged.
Every line, sourced
Each resource and each connection shows the file and line that made it. --audit re-reads the source and exits non-zero if a reference was dropped or invented, so it can guard CI.
Its limits, stated
Convert is in beta and lists every property it could not map. Google Cloud icons are per category. for_each and count are not expanded, and on dense stacks some lines still cross.
Bought once, kept for good.
A licence includes a year of updates. After that you keep the last version you received, with every feature, for as long as you use it. Buying for a team? Choose the number of seats at checkout. Compare in detail.
PLATE IFree
€0
For seeing what a stack builds.
- Draw and explore all five formats in the local app
- Official AWS, Azure and Google Cloud icons
- Click any resource to see the line that made it
--auditto check the graph in CI
PLATE IILicence
€99once, per seat
For putting diagrams in docs and moving stacks between formats.
- Everything in Free
- Export to HTML, Mermaid, DOT, PNG and SVG
- Convert between formats (beta)
- One year of updates, then keep the last version
- Full refund within 14 days
Take a copy home.
Download the free edition as a Docker image or a Python package. Both run the same local app in your browser. Add a licence file to the same install and it adds export and Convert. Install steps and system requirements.
$ derive-app # opens the app at 127.0.0.1:8000 $ derive ./infra --audit # checks each reference against the source $ derive ./infra -o diagram.mmd # licence · Mermaid for your README $ derive ./stack --to terraform # licence · Convert, beta
Questions, answered plainly.
Does my infrastructure code leave my machine?
No. Derive reads files from your disk and draws them in a local app at 127.0.0.1. It makes no network requests while it works, and the diagram files it writes block outgoing requests in their own security policy, so you can open them anywhere. The licence is checked offline too.
Which formats and clouds does it read?
Terraform for AWS, Azure and Google Cloud, CloudFormation (YAML and JSON), Bicep, ARM templates and Google Cloud Deployment Manager. Derive detects the format itself, and one folder may hold several.
What can I do with the free edition?
Draw and explore diagrams from all five formats in the local app, with the official cloud icons, and run derive --audit in CI. Writing diagram files (HTML, Mermaid, DOT, PNG, SVG) and converting between formats need a licence.
How do I know the diagram is right?
Every resource and every line in the drawing links to the file and line it came from, so you can check it against the code. derive --audit re-derives each reference from the source text and lists anything missing or extra. On the bundled AWS example it checks 17 resources and 20 references and reports no correctness findings. For Terraform, --verify-terraform compares Derive's graph with Terraform's own.
What doesn't it do yet?
Convert is in beta: it converts what it can map and reports each property it could not, with the reason. On the CloudFormation-to-Terraform example it converts 16 resources, maps 34 of 35 properties and reports 1 gap. Google Cloud icons are per category rather than per service. for_each and count are not expanded into separate resources. On dense stacks, some lines still cross.
How is it different from hosted diagram tools?
Hosted diagram services work on a copy of your code on their servers. Derive runs where the code already is, reads five formats, converts between them (beta), and is bought once instead of rented.
What does a licence cost?
€99 once per seat, with a year of updates. When the year ends you keep the last version you received, with every feature. If it isn't right for you, ask for a refund within 14 days. See pricing.