Skip to content
ArchFoundry Docs Open the canvas

Draw and manage what already runs in AWS

Updated October 19, 2026Plans: Free, Pro, Enterprise

Overview

Once an AWS account is connected, ArchFoundry can read it and draw what runs there, with the real bill on each card. You can then take that infrastructure under management: ArchFoundry keeps the Terraform for it, so later changes go through the same plan and approval as anything you deploy. Taking it over creates, changes and deletes nothing in AWS.

Prerequisites

  • An owner or admin role in your ArchFoundry organization.
  • A connected AWS account. See Connect your AWS account.
  • To take it under management, a deploy role on that account (Grant deploy, in the same guide).

Steps

  1. In Cloud accounts, click Connect an account, then on the account's row click See what's running. The canvas opens with a diagram drawn from the account.
  2. To refresh the diagram later, click the note in the top bar that says when it was read from the account.
  3. To take it under management, click Manage at the top right of the canvas. On a diagram drawn from an account, it takes the place of Deploy.
  4. Click Check the account. ArchFoundry reads the account and checks a plan against what is really there. This step writes nothing.
  5. Review what comes under management, open What stays yours to look after, and why, and read the Terraform being taken over.
  6. Click Manage this account. ArchFoundry writes Terraform state. AWS is not touched.

Example

The Manage tab shows three steps before anything is agreed to:

text
1 Check the account    read through your role; a plan is checked against the account
2 Review               what comes under management, what stays yours, and the Terraform
3 Take over            only if the account matches the Terraform exactly, and only when you confirm

Expected result: Under management. The account is listed in Deployments, marked managed.

Verify it worked

  • In Deployments, the stack shows the managed label: it was in your account before ArchFoundry, and ArchFoundry manages it now without having created it.
  • Cloud accounts lists the diagram under Drawn from an account, marked Live.

Troubleshooting

The check was refused. The account and the Terraform do not match exactly, so ArchFoundry will not take it over. Read the check's log under The check's log, then click Check again.

Destroy is refused on a managed stack. That is on purpose. ArchFoundry did not create it, so it will not delete it. To stop managing it, click Release…, then Release. Release stops the managing and touches nothing in AWS.

Some resources stay yours to look after. Resources ArchFoundry cannot manage are listed with the reason, and stay as they are.

Next steps