Supported AWS services
Design Beaver models 42 services across compute, database, networking, and storage — each with the connection rules it uses to validate your architecture as you draw. Every service below can be placed on the canvas and checked for missing queues, invalid connections, and security anti-patterns.
Compute
EC2
Resizable virtual servers ("instances") in the AWS cloud. You choose an instance type (a balance of CPU, memory, network, and storage), an AMI (OS + software template), and manage the instance's lifecycle yourself — the baseline "just give me a server" compute option that most other AWS compute services (Lambda, ECS/EKS, Lightsail) exist as alternatives to.
Learn more →Lambda
Serverless compute that runs your code in response to events or direct invocations, without provisioning or managing servers. Scales automatically per-request and bills per-request plus execution duration.
Learn more →App Runner
Fully managed service that runs containerized web applications and APIs directly from source code or a container image, without you managing servers, load balancers, or scaling. App Runner builds (for source code), deploys, load-balances, and auto-scales the service, and gives it a public HTTPS endpoint out of the box — the "just run my web app" option that sits between Lambda and full ECS/Fargate control.
ECR
Elastic Container Registry — a fully managed registry for storing, sharing, and versioning container images and other OCI artifacts (Helm charts, etc.). It's where your built images live so that AWS compute services (ECS/Fargate, App Runner, Lambda container functions, EC2 running Docker) can pull them at deploy or task-start time. Comes in a private registry (per-account, IAM- controlled) and a public registry (ECR Public / Public Gallery).
ECS
Elastic Container Service — a managed orchestrator that runs Docker containers as "tasks" grouped into long-running "services" across a cluster. You hand it a task definition (container image, CPU/memory, ports, IAM roles) and ECS schedules and keeps the desired number of tasks running. Compute comes from one of two launch types: Fargate (serverless — AWS runs the underlying capacity) or EC2 (tasks packed onto instances you own and manage). The middle ground between raw EC2 and fully-abstracted Lambda for containerized web/app tiers and background workers.
Database
DynamoDB
Serverless, fully managed NoSQL key-value and document database with single-digit millisecond performance at any scale. No servers to provision or patch, and no joins — data is denormalized and accessed by key rather than queried relationally.
Learn more →RDS Proxy
Fully managed, highly available database proxy that sits between your application and an RDS or Aurora DB instance. It pools and multiplexes client connections so bursty, high-concurrency callers (Lambda especially) don't exhaust the database's max_connections, and it holds the client-facing IP steady through a failover so most connections survive a Multi-AZ event. Clients point at the proxy's endpoint instead of the DB endpoint.
RDS
Managed relational database service. Runs a standard SQL engine (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, or Aurora) as a DB instance inside a VPC, handling patching, backups, and (optionally) Multi-AZ failover — the usual "app tier connects to a database" building block behind an EC2 fleet or Lambda functions.
Learn more →
Storage
Networking
Application Load Balancer
Layer-7 (HTTP/HTTPS) load balancer that distributes incoming requests across registered targets — typically EC2 instances in an Auto Scaling group — using target groups and health checks. The standard way to make a fleet of otherwise-private app servers reachable from the internet without giving any individual instance a public IP.
Learn more →API Gateway
Fully managed service for creating, publishing, and securing HTTP APIs at any scale. The front door of a serverless API — it receives client requests and routes each method/path to a backend (most commonly a Lambda function), handling throttling, auth, and request/response mapping without a server to run.
Learn more →CloudFront
Content delivery network (CDN) that caches content at edge locations worldwide so users fetch it from a nearby location instead of the origin. The standard front door for a production static site sitting on S3.
Learn more →NAT Gateway
Managed Network Address Translation service that lets resources in a private subnet reach the internet and public AWS service endpoints for outbound traffic, while blocking unsolicited inbound connections from the internet. It's the standard egress path for a private compute tier (EC2 or VPC-attached Lambda) that needs to pull packages, call third-party APIs, or reach AWS public APIs without being given a public IP of its own.
Learn more →Route 53
DNS service that routes a domain name to AWS (or non-AWS) resources. The entry point of a static-hosting architecture — the thing a browser resolves before it ever reaches CloudFront or S3.
Learn more →VPC Endpoint
Private connectivity from inside a VPC to supported AWS services (and PrivateLink-powered partner/self-hosted services) without traversing the public internet, an internet gateway, or a NAT gateway. Two forms: an interface endpoint (an elastic network interface with a private IP in your subnet, powered by AWS PrivateLink) for most services, and a gateway endpoint (a route-table target, not PrivateLink) for S3 and DynamoDB. It keeps a private-subnet tier's traffic to AWS services on the AWS backbone.
Learn more →
Messaging & integration
EventBridge
Serverless event bus that routes events from AWS services, SaaS partners, and your own applications to targets like Lambda, SQS, and SNS. Rules match incoming events against an event pattern and forward each match to one or more targets in parallel — the standard way to build loosely-coupled, event-driven architectures on AWS with routing and filtering the sender doesn't have to know about.
Learn more →SES
Managed service for sending email — transactional messages (password resets, receipts, notifications) and bulk email — from your application, without running your own mail servers. Reached through the SES API or an SMTP endpoint.
Learn more →SNS
Fully managed pub/sub messaging. A publisher sends one message to a topic and SNS pushes a copy to every subscriber — SQS queues, Lambda functions, HTTP(S) endpoints, email, or SMS. The standard way to fan one event out to many independent consumers on AWS.
Learn more →SQS
Fully managed message queue that decouples the parts of a system — a producer drops a message on the queue and a consumer pulls it off on its own schedule, so a slow or failing consumer never blocks the producer. The default way to make work asynchronous on AWS.
Learn more →Step Functions
Serverless workflow orchestrator. You define a state machine — a sequence of steps with branching, parallelism, retries, error handling, and waits — and Step Functions runs it, calling other AWS services at each step and tracking the execution state for you so your own code doesn't have to. The standard way to coordinate a multi-step process across several services without hand-rolling the glue, polling, and retry logic.
Learn more →
Security & identity
Cognito
Managed user identity and authentication service. A Cognito user pool is a user directory that signs users in (directly or federated via Google/Apple/ SAML/OIDC) and issues JSON Web Tokens (JWTs). An API Gateway Cognito authorizer validates those tokens to protect an API. Identity pools instead exchange a signed-in identity for temporary AWS credentials to call AWS services directly.
Learn more →IAM Role
An IAM role (or EC2 instance profile) — the identity a compute principal assumes to get temporary, automatically-rotated credentials for calling other AWS services. Attach it to a Lambda function or EC2 instance to grant the specific actions that principal needs, instead of hardcoding access keys.
Learn more →Secrets Manager
A managed store for secrets — database credentials, API keys, OAuth tokens — that compute reads at runtime via an encrypted API call instead of baking the value into an image or environment file. Supports built-in automatic rotation, where Secrets Manager invokes a Lambda function on a schedule to replace the secret's value.
IoT
Frontend & mobile
Developer tools
CodeArtifact
A fully managed artifact repository — a private package registry for the language ecosystems your builds already use (npm, PyPI/Python, Maven/Gradle, NuGet/.NET, Ruby gems, Swift, Cargo/Rust, and generic files). You publish your own internal packages to it and pull third-party dependencies through it, so a team shares one governed source of packages instead of every build reaching straight out to public registries. Packages live in "repositories" grouped under a "domain" (the domain stores each asset once and dedupes across its repositories). A repository can have an "external connection" to a public registry (npmjs.com, Maven Central, PyPI, etc.) so CodeArtifact fetches and caches public packages on demand, and "upstream" relationships so one repository transparently serves another's contents. Think ECR, but for language packages rather than container images.
Learn more →CodeBuild
A fully managed continuous-integration build service. You point a CodeBuild "project" at a source (CodeCommit, S3, GitHub, GitLab, Bitbucket) and give it a buildspec — a YAML file of shell commands — and CodeBuild spins up a fresh, ephemeral build container, runs your compile/test/package steps in it, uploads the resulting artifacts (typically to S3), and tears the container down. There are no build servers to provision, patch, or scale; you pay per build-minute for the compute size you pick. It's the "run my build and tests" box in a CI/CD pipeline — most often invoked as a stage inside CodePipeline, but usable on its own.
Learn more →CodeCommit
AWS CodeCommit — a fully-managed source-control service that hosts private Git repositories. You push and pull with a standard Git client over HTTPS or SSH; there are no servers or storage to provision, and access is controlled with IAM instead of a separate set of repository accounts. It sits at the "source" end of an AWS-native CI/CD chain, feeding CodePipeline and CodeBuild and emitting repository events other services can react to. Note on currency: AWS de-emphasized it for new customers in July 2024 but returned it to full general availability on 2025-11-24, reopening new sign-ups and committing to ongoing investment (Git LFS, more Regions).
Learn more →CodeDeploy
A deployment service that automates rolling out application code to your compute, so releases aren't manual and a bad version can roll back on its own. It works across three "compute platforms": EC2/on-premises instances (a CodeDeploy agent on each host pulls a versioned revision bundle and runs the lifecycle hooks in your AppSpec file), AWS Lambda (shifts traffic between two function versions behind an alias), and Amazon ECS (shifts traffic between an old and a new task set behind a load balancer). EC2/on-premises deployments can be in-place or blue/green; all Lambda and ECS deployments are blue/green. It is the "deploy" stage most teams wire into a CodePipeline, and it can watch CloudWatch alarms to stop and roll back a release automatically.
Learn more →CodeGuru
Amazon CodeGuru is a developer-productivity service with two distinct halves. CodeGuru Reviewer uses program analysis and machine learning to flag defects and suggest fixes in Java and Python code during pull requests and full-repo scans. CodeGuru Profiler collects runtime performance data from live applications (JVM languages and Python) and points at the most expensive lines of code and CPU bottlenecks. Scope has narrowed sharply by 2026: CodeGuru Reviewer stopped accepting new repository associations on 2025-11-07 (existing associations still function), and CodeGuru's separate Security Detector product (CodeGuru Security) reached end of support on 2025-11-20 — its SAST / secrets / dependency (SCA) / code-quality scanning has effectively folded into Amazon Q Developer and Amazon Inspector Code Security, which AWS now points customers to for code security. CodeGuru Profiler remains the actively-supported half; for new work, treat Reviewer/Security as legacy and reach for Amazon Q Developer or Amazon Inspector instead.
Learn more →CodePipeline
A managed continuous delivery service that models your release process as a "pipeline": an ordered set of stages (Source → Build → Test → Deploy, plus optional manual-approval and invoke stages), each containing one or more actions. CodePipeline itself runs no build or deploy compute — it detects a source change, then orchestrates other services to do the work: it pulls source from a repository, hands artifacts to a build provider (CodeBuild), and drives a deploy provider (CodeDeploy, ECS, S3, CloudFormation, etc.), passing artifacts between stages through an S3 artifact store. It runs under an IAM service role that grants it access to every service its actions touch.
Learn more →X-Ray
A distributed tracing service that records requests as they travel across the components of an application and stitches them into an end-to-end trace and a visual service map. Each instrumented component emits "segments" (and finer "subsegments" for downstream calls) that X-Ray correlates by a shared trace ID, so you can see where latency and errors actually come from in a microservice or serverless call chain. Services don't send segments to X-Ray directly — an X-Ray daemon / collector (managed for Lambda and App Runner, a sidecar or agent for EC2/ECS) buffers them and relays them to the X-Ray API.
Learn more →
Beyond AWS
SaaS integrations and the generic actors you drop on a diagram — not AWS services, but things your architecture talks to or that stand in for people and devices.
Third-party integrations
Datadog
Observability platform for metrics, logs, traces, and alerting. The Datadog Agent runs on hosts and containers to ship metrics and logs, a Lambda extension/layer instruments serverless functions, and integrations pull database and cloud metrics. Data flows one way — into Datadog for dashboards, monitors, and alerts — so it sits at the edge of a diagram observing services.
SendGrid
Twilio SendGrid is a transactional and marketing email platform. Applications call its Web API (or SMTP relay) to send email — password resets, receipts, notifications — and SendGrid handles delivery, reputation, and analytics. It's a third-party alternative to Amazon SES for teams already standardized on it.
Slack
Team messaging platform commonly used as the destination for operational notifications — deploys, alarms, build results, on-call pages. Backend code posts messages to a channel via an Incoming Webhook or the Slack Web API, and AWS Chatbot can forward SNS notifications into Slack without custom code.
Stripe
Payments platform for accepting cards and other payment methods, plus billing, subscriptions, and payouts. Applications call the Stripe API to create charges and manage customers, and Stripe posts webhook events back to the app when something happens (a payment succeeds, a subscription renews, a dispute opens).
Diagram actors
Desktop
A desktop workstation acting as a client, e.g. an office/on-premises machine connecting to the architecture.
Internet
The public internet / external network. Use to show the boundary between the outside world and the architecture, e.g. traffic entering via CloudFront or a public-facing load balancer.
Laptop
A laptop acting as a client, e.g. a developer or admin connecting to the architecture from a portable workstation.
Mobile Device
A phone or tablet acting as a client, e.g. a mobile app calling an API. Use to distinguish mobile clients from browser/desktop clients.
User
A single end user interacting with the system — e.g. a person using a web or mobile app. Use to show where a request or interaction originates from.
Users
A group of end users or actors, as opposed to a single user. Use when a diagram wants to represent multiple/concurrent clients rather than one.