draw.io Server

• Open the product in AWS Marketplace. Choose Continue to Subscribe, then Continue to Configuration and Continue to Launch.
• Choose an instance type. Any current-generation type works, because the app is lightweight and rendering happens in the browser.
• Select your key pair and a Security Group that allows inbound 22, 80 and 443.
• Launch the instance and note its public IP address.

aws ec2 run-instances \
  --image-id <ami-id-from-listing> \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=drawio-server}]'

SSH in and confirm that both services are active:

sudo systemctl is-active drawio nginx

active active

List the listening ports. The editor's Tomcat listener is bound to the loopback interface only, so only nginx (ports 80 and 443) is reachable from the network:

sudo ss -tlnp | grep -E ':(80|443|8080) '

LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",...)) LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",...)) LISTEN 0 100 [::ffff:127.0.0.1]:8080 *:* users:(("java",...))

Port 8080 (Tomcat) answers on 127.0.0.1 only. Confirm the bundled version and licence:

cat /opt/tomcat/DRAWIO_VERSION

drawio_version=30.3.14 drawio_war_sha256=f46acbc76273bece778a39c4dda63261c10d7326160b3ffb231cb784e9b0a9eb drawio_license=Apache-2.0 tomcat_version=9.0.120 baked_at=2026-07-24T02:07:26Z

draw.io ships no credentials. Read the secret-free access note, which records the editor URL:

sudo cat /root/drawio-server-credentials.txt

# draw.io — Access Notes
# Generated on first boot by drawio-server-firstboot.service
#
# draw.io (diagrams.net) is a client-side diagram editor. It has NO admin UI,
# login or password: diagrams live in YOUR BROWSER / on YOUR DEVICE ...
# drawio.url=https://<public-ip>/ drawio.healthz=https://<public-ip>/healthz drawio.version=v30.3.14

Request a known editor asset, the ~9 MB draw.io application bundle, to confirm the editor is served over TLS:

curl -sk -o /dev/null -w 'GET /js/app.min.js -> HTTP %{http_code}, %{size_download} bytes\n' https://127.0.0.1/js/app.min.js

GET /js/app.min.js -> HTTP 200, 9407659 bytes

Check the health endpoint next. It is unauthenticated and answers on both HTTP and HTTPS, and port 80 redirects everything else to HTTPS:

curl -sk -o /dev/null -w 'healthz -> HTTP %{http_code}\n' https://127.0.0.1/healthz

healthz -> HTTP 200

The stock Tomcat administrative console is removed. Request the manager application and confirm it returns 404:

curl -sk -o /dev/null -w 'GET /manager/html -> HTTP %{http_code}\n' https://127.0.0.1/manager/html

GET /manager/html -> HTTP 404

Open https://<public-ip>/ in your browser and accept the per-instance self-signed certificate. The draw.io editor loads directly, and no login is required.

Drag shapes onto the canvas and connect them to draw flowcharts, UML, network, BPMN and other diagrams.

Select any shape to style it with the Style, Text and Arrange panels on the right.

Because draw.io runs in your browser, you choose where your diagrams live.

• Local device: save .drawio (or .xml) files to your computer from the File menu.
• Your own cloud storage: connect Google Drive, OneDrive or GitHub from File > Open from / Save to, so diagrams are stored in accounts you control.
• Export: export any diagram to PNG, SVG or PDF from File > Export as. Your browser performs the export, so no additional export service is exposed on the instance.

# Status and logs
sudo systemctl status drawio nginx
sudo journalctl -u drawio -n 100 --no-pager

# Restart the editor or the proxy
sudo systemctl restart drawio
sudo systemctl restart nginx

• Restrict inbound access. draw.io has no login of its own, so anyone who can reach the URL can use the editor. Restrict the Security Group to your own CIDR, or place the instance behind a VPN or in a private subnet.
• Use your own domain and certificate. To get a trusted certificate, terminate TLS at nginx with your own domain and a CA-signed certificate (for example via certbot). Alternatively, front the instance with an Application Load Balancer and an ACM certificate. Edit /etc/nginx/sites-available/sac-drawio, point ssl_certificate and ssl_certificate_key at your own files, then reload nginx.
• Keep it patched. Apply OS security updates regularly with sudo apt-get update && sudo apt-get upgrade.
• Health checks. Use the unauthenticated endpoint https://<public-ip>/healthz for load-balancer and monitoring probes.

draw.io / diagrams.net is licensed under the Apache-2.0 licence. The licence text is included in the image at /opt/tomcat/webapps/ROOT/LICENSE.

"draw.io" and "diagrams.net" are trademarks of JGraph Ltd. This image packages the open source application for self-hosting and is not affiliated with or endorsed by JGraph Ltd. SecureAnyCloud provides the packaging, hardening and support.

Need Help?

SecureAnyCloud provides 24/7 technical support for this product by email and live chat at sales@secureanycloud.com. We can help with deployment, reverse-proxy termination with your own domain and certificate, connecting the editor to your own storage, network hardening for the login-less editor, and instance sizing.

Deploy on AWS

Launch draw.io / diagrams.net Diagram Editor - Self-Hosted AMI by SecureAnyCloud with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com