Architecture diagrams for every Terraform pull request

Five minutes to your first diagram

.github/workflows/infragram.yml

on:
  pull_request:
    paths: ["infrastructure/**/*.tf", "infrastructure/**/*.tfvars"]
permissions:
  contents: read
  id-token: write # how the Action authenticates to Infragr.am

jobs:
  diagram:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_wrapper: false
      - uses: actions/setup-go@v7
        with:
          go-version: stable
      - uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::123456789012:role/infragram-plan
          aws-region: eu-west-1
      - uses: Tekchbila-Studios/infragram-action@v1
        with:
          working-directory: infrastructure

No API key and no stored secret. The Action signs in with the workflow’s own GitHub OIDC token, and your cloud credentials stay inside your workflow.

Plans stay on your runner

terraform plan runs in your workflow. Only a sanitized bundle of resource topology is uploaded, after an independent Gitleaks scan of the exact bytes being sent.

Four lenses per build

Network, Compute, Data and Security. Each is its own diagram, laid out in trust zones from the internet down to private subnets.

Built for pull requests

There is one comment per environment, and each push updates it in place. A newer push replaces older builds, and an unchanged plan reuses the diagram without using your quota.

Open-source collector

The code that reads your plan and removes secrets is MIT-licensed and built from source on every run. You can read it, pin it and run it yourself.

Where to go next

QuickstartInstall the GitHub App, add the workflow and open a pull request.

Data boundaryWhat runs on your runner, what is uploaded, and what never leaves.

Action referenceEvery input and output, with defaults and examples.

Supported AWS resourcesThe resource types drawn today, by lens.