GraphIaC
infrastructure you can read
v0.1 — nodes · edges inferred from the pair · refs are data deps · desugar
Source
label : Type(…) · a -> b · other.field
# Static site: Route53 -> CloudFront (HTTPS) -> S3. # The arrows are the point: each one is an IAM policy, a certificate # attachment, or a service integration the edge knows how to provision. # # cert -> hz DNS validation records, automatically # cert -> cf the viewer certificate — and a GATE: cf stays # BLOCKED until the cert is ISSUED (no phase logic) # cf -> bucket an OAC bucket policy: only this distribution can read # cf -> hz the A alias record for the domain # # No ARNs anywhere: relationships are arrows, not fields. domain = "begrif.co" hz : HostedZone(domain_name: domain) cert : ACMCertificate(domain_name: domain) bucket : S3Bucket("begrif-co-site") cf : CloudFrontDistribution(domain_name: domain) cert -> hz cert -> cf cf -> bucket cf -> hz : (domain_name: domain)
⇄ desugar
💾 save
▷ plan
▶ run
✓ verify
ready
Graph
nodes are resources · edges are the wiring
solid
= provisioned · dashed = data dependency
wheel = zoom · drag = pan · double-click = fit