Thanks a lot for writing all this up, @davidcheung ! This is great!

A few things related to the diagram:

• iam_account and the little person in the IAM box should be removed, this isn't really useful info (and I'm not sure why it's connected to things like the fluentd role)
• Having "IAM access key" in IAM and "ci-user-aws-key" in secret manager is probably redundant, maybe remove the one in IAM?
• The ci user should be connected to the kubernetes-admin role
• There shouldn't be an IAM role for alb-ingress-controller
• There are some deployments missing for new things like cert-manager
• I'm not sure showing configmaps provides a lot of value, it's just application-specific configuration related to components that are already being shown on the diagram..

the helm stuff [cert-manager, clusterIssuer, autoscaler] i actually categorized them as custom resources(at the bottom-right), I guess they're really just deployments

There have both custom resources and deployments

What do you think about another box for the auto scaling group, to show how the cluster-autoscaler manages the ASG?

AWS autoscaling group itself is not in the VPC right?
realized i didnt have the metrics server either, added that

Yes, the ASG can be shown as in the VPC. Technically it's not related to a VPC directly itself, but it specifies the subnets to bring up instances in, and the subnets/instances are within the VPC.

Fine to leave it as-is though, doesn't really make a difference.