AWS-DFD-Visualizer

Multi-cloud interactive Data Flow Diagram (DFD) visualizer for Splunk. Renders AWS, Azure, and GCP Config topologies as Zero-Trust blueprint diagrams with nested VPC/Subnet enclosures, and SSH/22 compliance violation paths. Designed for DoD IL5 / NIST 800-53 / Zero-Trust Architecture environments.Built by Young Suh

Default Version 2.8.6

September 23, 2026

Compatibility

Splunk Enterprise, Splunk Cloud

Platform Version: 10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

Rating

(1)

Support

Developer Supported

### Purpose & Background Auditing complex cloud infrastructure for compliance — DoD Impact Level 5 (IL5), NIST 800-53, or NIST 800-207 Zero-Trust Architectures — is extremely challenging. While cloud accounts (AWS, Azure, GCP) generate high-volume telemetry from AWS Config, Azure Resource Manager, GCP Asset Inventory, VPC Flow Logs, and GuardDuty, reviewing these configurations in flat Splunk tables makes it difficult for security teams, system auditors, and DevSecOps engineers to analyze isolation boundaries, spot structural gaps, or verify access routes. **AWS DFD Visualizer** transforms your live Splunk search results into interactive, audit-ready Data Flow Diagrams directly inside Splunk — no external tools required. ### 🤝 The Complete Solution: Companion + Visualizer The AWS Zero-Trust topology solution consists of two complementary apps designed to work seamlessly together: > **"Companion produces the table; Visualizer draws the diagram."** - **AWS-DFD-Companion (v1.1.6)**: The data preparation utility. Ingests raw AWS Config, CloudWatch VPC Flow Logs, and inventory telemetry, packaging pre-built CIM macros to produce normalized DFD table rows (`from`, `to`, `edge_label`, `status`). - **AWS-DFD-Visualizer (v2.8.6)**: The presentation canvas. Renders those rows into interactive, audit-ready Zero-Trust blueprints with DoD IL5 compliance boundaries, nested VPC/Subnet containers, and drilldown capabilities.