Draw your architecture. Ship secure Terraform.
Infrager turns drag-and-drop AWS and Google Cloud diagrams into production-ready HCL. A security linter reads the same diagram and flags open security groups, public buckets, unencrypted storage, and overprivileged IAM while you are still drawing.
MIT licensed · free · no card required
resource "aws_security_group" "web_sg" {
name = "Web SG"
description = "Managed by Infrager"
vpc_id = aws_vpc.main_vpc.id
ingress {
protocol = "tcp"
from_port = 22
to_port = 22
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_instance" "app_server" {
ami = "ami-0c02fb55956c7d316"
instance_type = "t3.micro"
subnet_id = aws_subnet.private_subnet_b.id
vpc_security_group_ids = [aws_security_group.web_sg.id]
iam_instance_profile = aws_iam_instance_profile.app_role.name
}What you get
canvas
Draw the architecture
Drag VPCs, subnets, security groups, instances, load balancers, databases, buckets, and IAM roles onto a canvas. Connect two nodes and Infrager works out what the relationship means.
codegen
Get Terraform, ordered
Every change regenerates HCL sorted by dependency, with provider blocks per cloud and variables for anything secret. Copy it or download main.tf.
lint
Catch problems on the canvas
Rules run on every edit and mark the offending node. An SSH port open to the world shows up as you draw it, not in a compliance review three weeks later.
aws + gcp
Two clouds, 150+ services
Eight core AWS resources have typed properties and security rules. Everything else, across AWS and Google Cloud, comes from a searchable catalog that emits real Terraform.
workspace
Projects that persist
Sign in, keep as many architectures as you want, and let autosave handle the rest. Diagrams stay in your workspace.
MIT
Open source, free
The whole thing is on GitHub under MIT. Codegen and linting run in your browser, so diagrams never need to leave it to become Terraform.
The mistakes are visible in the diagram first
A security group open to the world, a bucket anyone can read, a database without encryption: all of it is already there in the drawing, long before anyone runs terraform plan. Infrager treats the diagram as the source of truth and checks it on every edit.
- Security groups exposing SSH, RDP, or database ports to 0.0.0.0/0
- S3 buckets without a public access block
- RDS instances and buckets without encryption at rest
- IAM policies granting Action or Resource wildcards
- Databases marked publicly accessible
- Resources missing their VPC or subnet attachment
New resources start encrypted, private, and closed, so warnings appear when you opt into risk rather than greeting you on a blank canvas.
VPC and subnets
Typed CIDR, AZ, public IP behavior
Security groups
Ingress and egress rules, port ranges
EC2 and load balancers
Placement, target groups, listeners
RDS and S3
Encryption, versioning, public access
IAM roles
Assume-role policy and inline statements
150+ more
Lambda, EKS, GKE, BigQuery, Pub/Sub
Why the Fluiq team built this
Fluiq exists to make what runs in production observable and governable. Infrager applies the same idea one layer down, to the infrastructure underneath. It is a separate product with no Fluiq account required, released under MIT because tools that catch security mistakes work better when everyone can read the rules.
Start with a blank canvas
Create an account, drag in a VPC, and watch the Terraform appear next to it.