Tag Archives: Infrastructure as Code

Azure

ZoneForge for Azure: Sketch It, Check It, Ship It

Gallery Leave a comment

Azure architecture has a habit of starting as a tidy diagram and ending with a surprisingly specific error message from Azure. ZoneForge for Azure helps connect those two moments: design your architecture, check it, and generate something you can actually deploy.

It used to be called Azure Canvas. The name changed after Microsoft’s own “Azure Canvases” started making search results a little crowded. ZoneForge felt like a better fit for a tool that helps you shape the zones of an Azure environment—and, ideally, spend less time asking why a subnet is in the wrong place.

Give it a go at zoneforge.cloud.

Azure resources, in their proper homes

ZoneForge isn’t just a box-and-arrow editor with Azure stickers. It understands some of the rules behind the shapes: subnets live inside VNets, VMs and network controls belong in the right places, and services such as VPN Gateway, Azure Bastion, and Azure Firewall need their reserved subnets.

You can organize an architecture with Management Group, Subscription, Region, and Resource Group boundaries, then switch between Network, Infrastructure, and Identity views. Handy when one diagram is trying to explain everything at once—and nobody can find the network.

Bring in the Azure you already have

Starting from scratch is optional. Sign into your Azure subscription and use Azure Import to bring in a resource group or a VNet and its connected resources. If something looks off in the diagram, simply right-click the resource and Go To that resource directly in Azure.

Check the design before Azure does

Validate Design checks the architecture locally and against a live subscription. Depending on the design, that includes CIDR ranges and overlaps, required relationships, resource-provider registration, region availability, VM sizes, and storage account name availability.

There are also Architecture Review, a live monthly cost estimate using Azure retail pricing (no sign-in required), and a Well-Architected score across the five pillars. That score is a heuristic based on the diagram—not an official Microsoft assessment, and definitely not a substitute for knowing what your workload actually does.

Get it out of the browser

When the diagram is ready to travel, ZoneForge can generate Bicep, ARM JSON, and a Terraform starter configuration for the supported resource set. You can also export to SVG, save as Visio (.vsdx), or print an A4-friendly diagram.

And if you’re ready to see what Azure thinks, Azure Deploy sends the generated ARM template to Azure Resource Manager. Azure may still have opinions, of course—but at least you’ll get its errors back where you can read them.

The useful little things

There’s a File menu for saving, loading, importing, and exporting; one-click share links; draggable dialogs; and dark mode for late-night architecture sessions (or just personal preference). The About dialog also has a feedback box—ratings, comments, and reports of the bits you managed to break are all welcome.

ZoneForge is free and runs in your browser. Diagrams can be saved locally or exported, and Azure access uses the signed-in user’s delegated permissions. Import is read-only.

Whether you’re documenting what exists, sketching what might, or getting a design ready to deploy, ZoneForge gives you one place to work through it—before Azure gets the last word.

Try it at zoneforge.cloud.

Azure, Cloud Computing, Developer Tools, DevOps / Infrastructure as Code, Web Tools

Azure Canvas Update: It’s an Architecture Designer, Not just a Drawing App

Gallery Leave a comment

When I first wrote about Azure Canvas, the easy pitch was “draggable Azure icons in your browser.” That was never the point, and the gap between the two has widened considerably since. Azure Canvas is not a diagramming tool that happens to use Azure shapes — it is an architecture designer that understands what those shapes mean, what they are allowed to do, and whether Azure will actually accept them.

The distinction matters, because anyone can push coloured rectangles around a canvas. The hard part is a canvas that pushes back.

As ever, the tool is free and runs entirely in the browser.

Try it: https://azure-canvas.com/

A canvas that understands Azure

Every object in Azure Canvas carries the rules of the real service behind it, and the canvas enforces them as you design:

– VNets contain subnets; VMs, NSGs, route tables, NAT gateways, private endpoints, and Application Gateways live inside subnets rather than floating in space.

– VPN Gateway, Azure Bastion, and Azure Firewall claim their required reserved subnets automatically, because Azure insists on them and so should the diagram.

– Peerings, VPN connections, public IP associations, identities, monitoring links, and application dependencies are modelled as real relationships, not decorative arrows.

– Service‑specific obligations are handled for you — an NSG sharing a subnet with Application Gateway v2 gets its GatewayManager rule without you needing to remember it at 11pm.

The result is a design that is structurally correct by construction. You are not drawing a picture of an architecture; you are building the architecture, and the picture is a side effect.

From design to validated to deployed

The reason the modelling matters is that the diagram is the start of a pipeline, not the end of one:

– Import reconstructs an existing resource group or VNet and its connected resources directly from Azure Resource Manager, read‑only, with subscription and region boundaries intact.

– Validate Design combines local structural checks with live Azure checks — provider registration, region and VM‑size availability, storage name availability, CIDR overlap, required relationships, and service constraints — so problems surface before deployment, not during it.

– Generate produces deployable Bicep, ARM JSON, and a Terraform starter from the same model.

– Deploy submits the generated template straight to Azure Resource Manager, no local CLI or compiler required, and monitors progress with the timing warnings that gateways and Bastion have taught it to give.

Each stage reads from one architecture‑aware model. That is what separates this from a drawing app: the boxes are not the artifact, they are the source of truth that everything else is derived from.

Taking the design elsewhere

Because the model is real, the outputs are too. Alongside JSON import/export and browser‑local saving, Azure Canvas can now hand your design to the places architectures tend to end up — exporting to native Visio for design packs that have to live in someone else’s document, and printing a design that crops, scales, and fits itself to the page instead of fighting you. Useful, unglamorous, and firmly in service of the design rather than the headline.

Who it’s for

Azure Canvas is for architects, network and security teams, engineers, and students — anyone who prefers to understand an environment visually before committing it to code, and who wants the visual to be more than a pretty guess.

It is free, actively evolving, and shaped by people designing and operating real Azure environments. Suggestions are welcome in the comments; I read them, and Azure remains an enthusiastic reviewer of the rest.

Try Azure Canvas: https://azure-canvas.com/