WO2025086627A1 - Cloud resource architecture diagram generation method, cloud management platform, and computing device cluster - Google Patents

Abstract

The present application belongs to the technical field of cloud computing, and discloses a cloud resource architecture diagram generation method, a cloud management platform, and a computing device cluster. The present application comprises: in response to an architecture diagram generation request of a tenant, a cloud management platform acquires configuration information of a first cloud resource, acquires a network traffic log of the first cloud resource, and automatically generates a cloud resource architecture diagram on the basis of the configuration information of the first cloud resource and the network traffic log. Manual drawing by tenants is not needed, the operation is simple, and the availability is high. Moreover, because network traffic logs of cloud resources are acquired on the basis of VPC flow logs associated with the cloud resources, that is, in the embodiments of the present application, connection relationships between the cloud resources can be acquired by means of the VPC flow logs associated with the cloud resources, no agent assembly is required to be installed, the performance of nodes where the cloud resources are located is not affected, the availability is higher, and the cost is lower.

Description

Cloud resource architecture diagram generation method, cloud management platform and computing device cluster

This application claims priority to the Chinese patent application with application number 202311393633.9, filed on October 25, 2023, and application name “Architecture diagram generation method, device, computing device cluster and storage medium”, and claims priority to the Chinese patent application with application number 202410118224.6, filed on January 26, 2024, and application name “Cloud resource architecture diagram generation method, cloud management platform and computing device cluster”, all of which are incorporated by reference into this application.

Technical Field

The present application relates to the field of cloud computing technology, and in particular to a cloud resource architecture diagram generation method, a cloud management platform, and a computing device cluster.

Background Art

In recent years, with the development of cloud computing technology, cloud service providers can provide tenants with a variety of available cloud resources, such as computing resources, storage resources, network resources, etc. Tenants can purchase or rent cloud resources provided by cloud service providers and use these cloud resources to implement their own business. For example, tenants can deploy applications to the cloud environment formed by these cloud resources to run them, so as to realize the application on the cloud.

Currently, after purchasing or renting cloud resources, tenants can usually manually draw an architecture diagram of the cloud resources, and then use the architecture diagram of the cloud resources to manage the cloud resources. However, manually drawing an architecture diagram of cloud resources is not only cumbersome and inefficient, but also requires high capabilities of tenants.

Summary of the invention

The present application provides a cloud resource architecture diagram generation method, a cloud management platform, a computing device cluster, a storage medium and a program product, which are simple to operate, high in availability and low in cost.

In order to achieve the above objectives, this application adopts the following technical solutions:

In a first aspect, a method for generating a cloud resource architecture diagram is provided, which is applied to a cloud management platform, wherein the cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, wherein the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, and one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, and the multiple target cloud resources include a first cloud resource and a second cloud resource. The method includes: in response to an architecture diagram generation request sent by a tenant, obtaining configuration information of the first cloud resource, and obtaining a network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes the type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on a flow log of a virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that there is data packet transmission between the first cloud resource and the second cloud resource; based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, a cloud resource architecture diagram is generated, wherein the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship.

In the present application, in response to a tenant's architecture diagram generation request, the cloud management platform can obtain the configuration information of the first cloud resource and the network traffic log of the first cloud resource, and automatically generate a cloud resource architecture diagram based on the configuration information and network traffic log of the first cloud resource, without the need for the tenant to draw manually, which is simple to operate and has high availability. In addition, since the network traffic log of the first cloud resource can be obtained through the flow log of the VPC, that is, the connection relationship between cloud resources can be obtained through the flow log of the VPC, there is no need to install invasive components, so the cost is lower.

In addition, because the connection relationships between cloud resources contained in the VPC flow log can cover more cloud resources, the network traffic logs of each cloud resource contained in the VPC flow log can generate a cloud resource architecture diagram with wider coverage and more complete information.

Optionally, the implementation process of obtaining the network traffic log of the first cloud resource may include: obtaining the flow log of the virtual private cloud VPC associated with the first cloud resource, the flow log including a first record indicating that there is data packet transmission between the first cloud resource and the second cloud resource, the first record including a source address and a destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource.

The second cloud resource and the first cloud resource may be cloud resources in the same VPC or in different VPCs. Therefore, through the flow log of the VPC associated with the first cloud resource, not only the connection relationship between cloud resources with data message transmission in the VPC can be obtained, but also the connection relationship between cloud resources with data message transmission across VPCs can be obtained. On this basis, through the network traffic log of cloud resources in a VPC, the cloud resource architecture diagram across VPCs can be obtained.

Optionally, when the second cloud resource and the first cloud resource are cloud resources in different VPCs, after obtaining the connection relationship between the first cloud resource and the second cloud resource based on the network traffic log of the first cloud resource, the cloud management platform can further obtain the configuration information of the second cloud resource and the network traffic log of the second cloud resource based on the IP address of the second cloud resource contained in the network traffic log of the first cloud resource, and then determine the connection relationship between other cloud resources in the VPC associated with the second cloud resource and the second cloud resource based on the configuration information and network traffic log of the second cloud resource. In this way, by connecting various cloud resources in series, an architecture diagram of cloud resources across multiple VPCs can be obtained.

Optionally, the first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

In the present application, not only can the connection relationship between the first cloud resource and the second cloud resource be obtained through the source address and the destination address in the first record, but the source port identifier and the destination port identifier in the first record can also be used to further determine which two ports on the first cloud resource and the second cloud resource have a communication link established between them. On this basis, tenants can achieve more refined cloud resource management based on the connection relationship between cloud resources and the link relationship between the ports of cloud resources shown in the cloud resource architecture diagram.

Optionally, the IP address of the second cloud resource is the first virtual IP address, and the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

In the present application, when the source address or destination address in the first record is a virtual IP address, the real IP address of the instance to which the virtual IP address is bound can be determined by searching the second record that records the same transmission process of the same data packet, thereby determining the hidden binding relationship between the virtual IP address and the instance.

Optionally, the multiple target cloud resources also include a fourth cloud resource and a fifth cloud resource, and the method also includes: obtaining configuration information of the fourth cloud resource, the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship.

In the present application, the cloud management platform can also obtain the statically configured connection relationship between cloud resources based on the configuration information of cloud resources. In this way, combined with the dynamic connection relationship obtained based on the network traffic log, a more complete cloud resource architecture diagram can be obtained.

Optionally, the multiple target cloud resources also include a sixth cloud resource, and the method also includes: obtaining configuration information of the sixth cloud resource; based on the configuration information of the sixth cloud resource, obtaining configuration information of a public network resource associated with the sixth cloud resource, the configuration information of the public network resource including a connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource.

In this application, the configuration information of the public network resource associated with the sixth cloud resource can be searched based on the configuration information of the sixth cloud resource. In this way, the cloud resource architecture diagram can also include the connection relationship between the sixth cloud resource and the public network resource, making the generated cloud resource architecture diagram more complete.

Optionally, the method also includes: obtaining cloud audit information of the VPC associated with the first cloud resource, the cloud audit information including at least one of cloud resource addition information, cloud resource deletion information and cloud resource modification information within the VPC; adding corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource addition information; or, deleting corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource deletion information; or, modifying corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource modification information.

In the present application, after the cloud resource architecture diagram is generated, the cloud resource architecture diagram can also be refreshed by obtaining the cloud audit information of the VPC associated with the first cloud resource to ensure the accuracy of the cloud resource architecture diagram.

In a second aspect, a cloud management platform is provided, wherein the cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, wherein the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, and one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, wherein the multiple target cloud resources include a first cloud resource and a second cloud resource. 2. Cloud resources, the cloud management platform includes at least one module, and the at least one module is used to execute the cloud resource architecture diagram generation method described in the first aspect above.

Exemplarily, the at least one module may include a resource information acquisition module and an architecture diagram generation module.

Among them, the resource information acquisition module is used to respond to the architecture diagram generation request sent by the tenant, obtain the configuration information of the first cloud resource, and obtain the network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes the type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on the flow log of the virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that there is data packet transmission between the first cloud resource and the second cloud resource; the architecture diagram generation module is used to generate a cloud resource architecture diagram based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, and the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship.

Optionally, the resource information acquisition module includes: a flow log acquisition unit, used to obtain the flow log of the virtual private cloud VPC associated with the first cloud resource, the flow log including a first record indicating that there is data packet transmission between the first cloud resource and the second cloud resource, the first record including a source address and a destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource.

Optionally, the first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

Optionally, the IP address of the second cloud resource is the first virtual IP address, and the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

Optionally, the multiple target cloud resources also include a fourth cloud resource and a fifth cloud resource, and the resource information acquisition module includes: a resource configuration information acquisition unit, used to obtain the configuration information of the fourth cloud resource, the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship.

Optionally, the multiple target cloud resources also include a sixth cloud resource, and the resource information acquisition module includes: a resource configuration information acquisition unit, used to obtain the configuration information of the sixth cloud resource; based on the configuration information of the sixth cloud resource, obtaining the configuration information of the public network resources associated with the sixth cloud resource, the configuration information of the public network resources includes the connection relationship between the sixth cloud resource and the public network resources, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resources.

Optionally, the cloud management platform also includes: a cloud audit information acquisition module, used to obtain cloud audit information of the VPC associated with the first cloud resource, the cloud audit information including at least one of cloud resource addition information, cloud resource deletion information and cloud resource modification information within the VPC; an architecture diagram update module, used to add corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource addition information; or, based on the cloud resource deletion information, delete the corresponding cloud resources in the cloud resource architecture diagram; or, based on the cloud resource modification information, modify the corresponding cloud resources in the cloud resource architecture diagram.

In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the cloud resource architecture diagram generation method as described in the first aspect above.

In a fourth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generation method as described in the first aspect above.

In a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generation method as described in the first aspect above.

The technical effects obtained by the second, third, fourth and fifth aspects above are the same as those obtained by the first and second aspects. The technical effects obtained by the technical means are similar and will not be repeated here.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is an implementation architecture diagram of a cloud resource architecture diagram generation method provided in an embodiment of the present application;

FIG2 is a flow chart of a method for generating a cloud resource architecture diagram provided in an embodiment of the present application;

FIG3 is a schematic diagram of configuration information of a public network resource associated with a first cloud resource provided in an embodiment of the present application;

FIG4 is a schematic diagram of configuration information of other public network resources associated with a public network resource provided in an embodiment of the present application;

FIG5 is a diagram of a generated cloud resource architecture provided in an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a cloud management platform provided in an embodiment of the present application;

FIG7 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

FIG8 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

FIG. 9 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

Before explaining the embodiments of the present application in detail, the application scenarios involved in the embodiments of the present application are first introduced.

In recent years, with the development of cloud computing technology, cloud service providers can provide tenants with a variety of available cloud resources, such as elastic compute service (ECS) instances, bare metal servers, cloud databases, elastic IP (EIP), elastic load balancing (ELB) instances, etc. Tenants can purchase or rent cloud resources provided by cloud service providers and use these cloud resources to implement their own business. For example, tenants can rent or purchase cloud resources to build VPCs and deploy their own applications to VPCs to run in order to implement applications on the cloud.

For one or more VPCs that have been built, tenants may want to obtain cloud resource architecture diagrams of these VPCs. Through the cloud resource architecture diagram, tenants can learn the associations between the cloud resources they rent or purchase, and manage the cloud resources in the VPC based on the associations. Alternatively, tenants can also refer to the cloud resource architecture diagram to build other VPCs.

Currently, tenants can query the information of cloud resources they use through the cloud management platform, and then manually draw cloud resource architecture diagrams based on the information of cloud resources. This manual architecture diagram drawing method is cumbersome, inefficient, and has poor usability.

In addition, in some related technologies, tenants can also install agent components on the nodes corresponding to the cloud resources they rent or purchase through the cloud management platform. The cloud management platform can obtain the interface call relationship of cloud resources through the agent components on each node, and then generate an architecture diagram based on the interface call relationship. However, since the agent component obtains the interface call relationship of cloud resources, it will occupy the computing resources of the node, thus affecting the node performance. In addition, on the one hand, the installation and maintenance cost of the agent component is high, so the installation rate in the cloud environment is low. On the other hand, the nodes corresponding to some cloud resources may not completely belong to the tenant. Therefore, for security reasons, the agent component may not be installed on such nodes. In this case, the interface call relationship of cloud resources that can be obtained through the agent component will be extremely limited, which will result in insufficient coverage of the final generated architecture diagram and incomplete information.

In response to the problems existing in the above-mentioned architecture diagram generation method, an embodiment of the present application provides a cloud resource architecture diagram generation method, in which, in response to the tenant's architecture diagram generation request, the cloud management platform can obtain the configuration information and network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes the type of the first cloud resource, and the network traffic log of the first cloud resource indicates that there is data message transmission between the first cloud resource and the second cloud resource. On this basis, the cloud management platform can automatically generate a cloud resource architecture diagram containing the connection relationship between the first cloud resource and the second cloud resource based on the configuration information and network traffic log of the first cloud resource, without the need for the tenant to draw manually, simple operation, and high availability. In addition, since the network traffic log of the cloud resource in the embodiment of the present application is obtained based on the flow log of the VPC associated with the cloud resource, that is, in the embodiment of the present application, the connection relationship between the cloud resources can be obtained through the flow log of the VPC associated with the cloud resource, without the need to install the agent component, and does not affect the performance of the node where the cloud resource is located, the availability is stronger and the cost is lower.

In addition, since the VPC flow log records all data packet transmissions between cloud resources within the VPC, compared to the method of obtaining interface call information by installing an agent component, the connection relationships that can be obtained through the VPC flow log cover more cloud resources. On this basis, based on the network traffic logs of each cloud resource included in the VPC flow log, the method provided in the embodiment of the present application can generate a cloud resource architecture diagram with wider coverage and more complete information.

Next, the implementation architecture of the cloud resource architecture diagram generation method provided in the embodiment of the present application is introduced.

Fig. 1 is an implementation architecture diagram of a cloud resource architecture diagram generation method provided in an embodiment of the present application. As shown in Fig. 1, the implementation architecture may include a cloud management platform 101 and a tenant terminal 102. The tenant terminal 102 establishes a communication connection with the cloud management platform 101.

The cloud management platform 101 is used to manage an infrastructure that provides multiple target cloud resources. Among them, the infrastructure may include at least one cloud data center, each cloud data center is provided with multiple servers, and one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure. In addition, the cloud management platform 101 can also be used to provide tenants with an access interface to access the cloud data center. For example, a tenant can purchase resources provided by a cloud data center through the cloud management platform 101. For another example, after purchasing virtual machine resources provided by a cloud data center, a tenant can create, manage, log in and operate a virtual machine on a server in a cloud data center through the cloud management platform 101. In an embodiment of the present application, a virtual machine may also be referred to as a virtual instance, a cloud server or an ECS instance. In addition, in an embodiment of the present application, cloud servers, virtual instances and ECS instances may also be used interchangeably.

In the embodiment of the present application, a cloud service client may be run on the tenant terminal 102, and the tenant may use the account and password registered in the cloud management platform 101 to remotely log in to the cloud management platform 101 through the cloud service client. After logging in to the cloud management platform 101, the cloud management platform 101 may provide an interactive interface to the tenant through the cloud service client on the tenant terminal 102, and the tenant may perform an architecture diagram acquisition operation in the interactive interface to trigger the tenant terminal 102 to send an architecture diagram generation request to the cloud management platform 101 through the cloud service client.

After receiving the tenant's architecture diagram generation request, the cloud management platform 101 can obtain the configuration information and network traffic log of the first cloud resource used by the tenant, and then automatically generate a cloud resource architecture diagram based on the configuration information and network traffic log of the first cloud resource. Afterwards, the cloud management platform 101 can send the cloud resource architecture diagram to the tenant terminal 102. The tenant terminal 102 can display the cloud resource architecture diagram in the architecture diagram display page of the cloud service client.

In a possible implementation, the implementation architecture may further include a cloud log server 103, which is used to store flow logs of different VPCs, and the flow logs may include network traffic logs of different cloud resources. Based on this, the cloud management platform 101 may obtain the network traffic logs of the tenant's cloud resources from the cloud log server 103.

In a possible implementation, the implementation architecture may further include a cloud resource information server 104, which is used to store configuration information of cloud resources rented or purchased by different tenants. For example, a configuration information database may be deployed on the cloud resource information server 104, and the configuration information of the cloud resources of the tenants is stored in the configuration information database. Based on this, the cloud management platform 101 may obtain the configuration information of the cloud resources associated with the tenant from the cloud resource information server.

It should be noted that the above-mentioned tenant terminal 102 can be a tenant device such as a smart phone, a tablet computer, a personal computer, etc. The cloud log server 103 and the cloud resource information server 104 are both servers deployed in a cloud data center, and any one of the cloud log server 103 and the cloud resource information server 104 can be a physical server in the cloud data center, or a server cluster, or a cloud server, which is not limited in the embodiments of the present application.

It is understandable that the above implementation architecture diagram also includes multiple target cloud resources managed by the cloud management platform, which is not shown in Figure 1 of the embodiment of the present application. In addition, the cloud resource architecture diagram generation method provided in the embodiment of the present application is to generate a corresponding architecture diagram for some of the multiple target cloud resources managed by the cloud management platform.

Next, the cloud resource architecture diagram generation method provided in the embodiment of the present application is explained in detail.

FIG2 is a flow chart of a method for generating a cloud resource architecture diagram provided in an embodiment of the present application. The method can be applied to the cloud management platform introduced above. Referring to FIG2, the method includes the following steps:

Step 201: In response to an architecture diagram generation request sent by a tenant, configuration information of a first cloud resource is obtained, and a network traffic log of the first cloud resource is obtained.

In an embodiment of the present application, after the tenant logs in to the cloud management platform through the cloud service client on the tenant terminal, the cloud management platform can provide the tenant with an interactive interface for managing cloud resources through the cloud service client. The tenant can perform an architecture diagram acquisition operation in the interactive interface, and in response to the architecture diagram acquisition operation, the tenant terminal can send an architecture diagram generation request to the cloud management platform through the cloud service client.

In a possible implementation, an architecture diagram acquisition option may be displayed in the interactive interface. In response to the tenant's selection operation of the architecture diagram acquisition option, the tenant terminal may display the indication information of one or more VPCs constructed by the tenant in the interactive interface. In response to the tenant's selection operation of the indication information of the first VPC in the indication information of the one or more VPCs, the tenant terminal generates an architecture diagram generation request based on the indication information of the first VPC selected by the tenant, and then sends the architecture diagram generation request to the cloud management platform. The architecture diagram generation request carries the indication information of the first VPC.

It should be noted that the indication information of the VPC can indicate the corresponding VPC. Exemplarily, the indication information of the VPC can be the network identifier of the VPC, for example, it can be the IP address of a VPC subnet or the virtual extended local area network network identifier (VXLAN (virtual extensible local area network) network identifier, VNI).

Optionally, the indication information of the VPC may also be other information that can indicate the VPC, for example, the indication information may be a domain name address associated with the EIP bound to the VPC. Alternatively, the indication information may also be an identifier of a tenant, etc. Alternatively, the indication information of the VPC may also be a resource identifier of any cloud resource in the VPC, for example, the indication information of the first VPC may be a resource identifier of a first cloud resource in the first VPC.

In another possible implementation, in response to the tenant's selection operation of the architecture diagram acquisition option, the tenant terminal may also display an information input box for inputting VPC indication information in the interactive interface. The tenant may input the indication information of the first VPC in the information input box. After receiving the indication information of the first VPC, the tenant terminal may generate an architecture diagram generation request based on the indication information of the first VPC, and send the architecture diagram generation request to the cloud management platform. The architecture diagram generation request carries the indication information of the first VPC.

After receiving the architecture diagram generation request, the cloud management platform obtains the configuration information and network traffic log of the first cloud resource based on the indication information of the first VPC carried in the architecture diagram generation request.

In a first possible implementation, when the architecture diagram generation request carries the network identifier of the first VPC, the cloud management platform can obtain configuration information of at least one cloud resource in the first VPC based on the network identifier of the first VPC. The configuration information of the at least one cloud resource includes the configuration information of the first cloud resource.

It should be noted that tenants can configure the cloud resources they rent or purchase to build a VPC. The cloud management platform can store the network identifiers of each VPC and the configuration information of the cloud resources in the corresponding VPC in the cloud resource information server. Based on this, after receiving the architecture diagram generation request carrying the network identifier of the first VPC, the cloud management platform can obtain the configuration information of the cloud resources corresponding to the network identifier of the first VPC from the cloud resource information server.

Exemplarily, the configuration information of the cloud resources corresponding to the network identifier of the VPC may include the IP address, resource identifier, and type of each cloud resource in the VPC. The IP address of the cloud resource may be a virtual IP address or a real IP address; the resource identifier of the cloud resource may be used to uniquely identify a cloud resource, for example, it may be a number assigned to the cloud resource by the cloud management platform; the type of the cloud resource may be used to indicate the cloud service that the cloud resource can implement, that is, the function of the cloud resource. For example, the types of cloud resources may include gateways, cloud databases, ELBs, cloud servers, etc.

For example, the configuration information of the cloud resources in the first VPC may be as shown in Table 1, wherein each line in Table 1 is the configuration information of a cloud resource in the first VPC, the first column in Table 1 is the IP address of each cloud resource, the second column is the resource identifier of each cloud resource, and the third column is the type of cloud resource. Among them, the IP address of the cloud resource with the resource identifier ID5 is a virtual IP (VIP) address, when the type of cloud resource is a system interface, it is used to indicate that the corresponding cloud resource is a physical host, and when the type of cloud resource is a dynamic host configuration protocol (DHCP), it is used to indicate that the corresponding cloud resource is used to dynamically allocate IP addresses and configuration information.

Table 1 Configuration information of cloud resources in the first VPC network

Table 1 above is an example of configuration information given in an embodiment of the present application. It is understandable that the configuration information of cloud resources may include more information than Table 1 above. For example, taking the first cloud resource as an example, the configuration information of the first cloud resource may also include the connection relationship between the first cloud resource and other cloud resources. For example, when the first cloud resource is a cloud server, the configuration information of the cloud server may also include the information of the cloud hard disk bound to the cloud server, so as to indicate that the cloud server has a connection relationship with the cloud hard disk. If the cloud server is also bound to an EIP, the configuration information of the cloud server may also include the information of the EIP bound to the cloud server, so as to indicate that the The cloud server has a connection relationship with the EIP. Optionally, the configuration information of any cloud resource may also include a network identifier of the VPC to which the cloud resource belongs, a region identifier of the region to which the cloud resource belongs, and the like.

After obtaining the configuration information of at least one cloud resource including the first cloud resource in the first VPC, the cloud management platform may also obtain the configuration information of the public network resources associated with these cloud resources based on the configuration information of the at least one cloud resource in the first VPC.

It should be noted that when building a VPC, the tenant can configure public network resources for the VPC, such as EIP, public network address translation (NAT), etc. Among them, the public network resources can be bound to the cloud server or ELB in the VPC. The cloud management platform can store the tenant's configuration information on the public network resources in the cloud resource information server. Among them, the configuration information of the public network resources may include the IP address of the public network resource, the IP address and/or resource identifier of the cloud resource in the VPC to which the public network resource is bound. Based on this, in an embodiment of the present application, the cloud management platform can also query the configuration information of the public network resources bound to the cloud resources in the first VPC from the cloud resource information server according to the IP address and/or resource identifier of the cloud resource of the type of cloud server and/or ELB in the first VPC.

For example, the cloud resources in the first VPC include the sixth cloud resource, which is the ELB shown in Table 1. The cloud management platform can query the configuration information of the public network resources associated with the ELB shown in Figure 3 based on the resource identifier of the ELB shown in Table 1. As shown in Figure 3, the ELB is associated with an EIP, which is 139.159.202.120. In addition, the configuration information of the EIP also includes the bandwidth size of the EIP, and the protocol type used is the dynamic border gateway protocol (BGP). It can be seen that the configuration information of the EIP can indicate that the EIP has a connection relationship with the ELB.

Optionally, after the cloud management platform obtains the public network resources associated with the cloud resources in the first VPC, since these public network resources may also be bound to other public network resources, the cloud management platform can also further determine other public network resources associated with these public network resources based on the configuration information of the obtained public network resources. For example, the EIP shown in FIG3 can also correspond to a domain name address, and the domain name address can also be bound to a website application firewall (WAF). Based on this, as shown in FIG3, the configuration information of the EIP can also include the domain name address corresponding to the EIP: aaa.bbb.com. After querying the domain name address corresponding to the EIP, the cloud management platform can further obtain the configuration information of the WAF corresponding to the domain name address as shown in FIG4 based on the domain name address. Among them, the identifier of the WAF corresponding to the domain name address is ID10, the working mode is to enable protection, and the access status is connected. It can be seen that the configuration information of a public network resource can further indicate the connection relationship between the public network resource and other public network resources.

The above mainly introduces the implementation process of the cloud management platform obtaining the configuration information of at least one cloud resource including the first cloud resource and the associated public network resources in the first VPC when the architecture diagram generation request carries the network identifier of the first VPC.

In a second possible implementation, when the architecture diagram generation request carries not the network identifier of the first VPC but other indication information of the first VPC, for example, when the indication information is a domain name address that can indicate the first VPC, the cloud management platform can obtain the configuration information of the EIP corresponding to the domain name address based on the domain name address. Afterwards, the resource identifier or IP address of the cloud resources such as the cloud server or ELB in the first VPC bound to the EIP is determined based on the configuration information of the EIP, and then the configuration information of other cloud resources in the first VPC including the cloud server or ELB is obtained based on the resource identifier or IP address of the cloud server or ELB. In this way, the cloud management platform can obtain the configuration information of multiple cloud resources including the first cloud resource in the first VPC and the configuration information of the public network resources associated with the cloud resources in the first VPC. For the relevant implementation principle, please refer to the relevant introduction in the above-mentioned first possible implementation.

It can be seen that the difference between this implementation and the first implementation is that in this implementation, the configuration information of the public network resources associated with the first VPC and the cloud resources in the first VPC are gradually obtained based on the association relationship contained in the configuration information, while in the first implementation, the configuration information of the cloud resources in the first VPC and the configuration information of the associated public network resources are gradually obtained based on the association relationship contained in the configuration information, while in the first implementation, the configuration information of the cloud resources in the first VPC and the configuration information of the associated public network resources are gradually obtained based on the first VPC. Based on this, when the indication information of the first VPC carried in the architecture diagram generation request is the resource identifier of a cloud resource in the first VPC, such as the resource identifier of the first cloud resource, the cloud management platform can also determine the network identifier of the first VPC to which the first cloud resource belongs based on the resource identifier of the first cloud resource, and then obtain the configuration information of multiple cloud resources including the first cloud resource in the first VPC and the configuration information of the public network resources associated with the cloud resources in the first VPC based on the network identifier of the first VPC. That is, in this case, the configuration information of the cloud resources in the first VPC and the configuration information of the associated public network resources are obtained based on the first cloud resource in the first VPC.

After receiving the architecture diagram generation request, the cloud management platform can also obtain the network traffic log of the first cloud resource based on the indication information of the first VPC carried in the architecture diagram generation request.

Exemplarily, the cloud management platform can obtain the network traffic log of at least one cloud resource including the first cloud resource in the first VPC based on the indication information of the first VPC. The network traffic log of any cloud resource can indicate the data message transmission between the cloud resource and other cloud resources.

It should be noted that, as can be seen from the above introduction, the configuration information of cloud resources may include the connection information between statically configured cloud resources. There may be other connections between cloud resources besides statically configured connections, such as dynamic connections between cloud resources. Dynamic connections between different cloud resources may also indicate other hidden connections between cloud resources. Based on this, the cloud management platform can combine the configuration information of cloud resources and network traffic logs to mine the connection relationships between cloud resources.

As an example, the cloud management platform can provide tenants with a VPC flow log service, and the tenant can choose whether to enable the VPC flow log service. Among them, the VPC flow log service can be used to generate a flow log of the VPC to record the data message transmission of the cloud resources within the VPC. Based on this, in an embodiment of the present application, the tenant can pre-enable the flow log service of the first VPC. In response to the tenant's flow log service activation operation, the tenant terminal can send a flow log creation request to the cloud management platform, and the flow log creation request carries the network identifier of the first VPC. After receiving the flow log creation request, the cloud management platform can create a log group in the cloud log server and create a flow log of the first VPC in the log group. Afterwards, based on the captured information of the data message of the cloud resources passing through the first VPC, a log record indicating that there is data message transmission between cloud resources is generated in the flow log, wherein each log record can include detailed information on the data message transmission.

Based on this, after receiving the architecture diagram generation request, the cloud management platform can obtain the flow log of the first VPC from the cloud log server based on the indication information of the first VPC, wherein the flow log includes at least one log record indicating the data packet transmission between the cloud resources within the first VPC and other cloud resources. Accordingly, the network traffic log of the cloud resource includes the at least one log record.

Exemplarily, if the architecture diagram generation request carries the network identifier of the first VPC, the cloud management platform can directly obtain the corresponding flow log from the cloud log server based on the network identifier of the first VPC.

If the architecture diagram generation request carries other indication information of the first VPC, for example, a domain name address associated with the first VPC, the cloud management platform can, in the process of obtaining the configuration information of the cloud resources through the second implementation method described above, determine the information of the cloud resources in the associated first VPC based on the configuration information of the EIP corresponding to the domain name address, and then determine the network identifier of the first VPC based on the information of the cloud resources, and then obtain the corresponding flow log from the cloud log server based on the network identifier of the first VPC.

It should be noted that the log records in the flow log can include the flow log version number, project identifier, interface identifier, source address, destination address, source port identifier, destination port identifier, protocol type, number of data packets, data packet size, start time, end time, action and log status in sequence.

The project ID of the log record can be the network ID of the VPC. Of course, if the tenant creates a flow log for a certain region or a switch or elastic network card in the VPC, the project ID of the log record in the flow log can be the ID of the corresponding region, switch ID, or elastic network card ID.

The interface identifier is used to indicate the interface that captures the log record. For example, if the log record comes from the first elastic network card in the first VPC, the interface identifier in the log record may be the identifier of the first elastic network card.

The source address and source port identifier may be the IP address of the sender of the data message recorded in the log record and the identifier of the corresponding sending port, and the source address may be a real IP address or a virtual IP address. The destination address and destination port identifier may be the IP address of the receiver of the data message recorded in the log record and the identifier of the corresponding receiving port. The destination address may also be a real IP address or a virtual IP address.

The protocol type is the network protocol used for datagram transmission, for example, it may be transmission control protocol (TCP), user datagram protocol (UDP), etc.

The number of data packets and the size of data packets are respectively used to indicate the number of data packets and the size of data packets contained in the data message transmission recorded in the log record.

The start time and the end time are respectively used to indicate the start time and the end time of capturing the information recorded by the log record.

The action is used to indicate whether the data message transmission is allowed by the security group and network access control list (ACL).

After obtaining the flow log of the first VPC, the cloud management platform can parse each log record in the flow log based on the log record format introduced above, so as to obtain the information contained in each log record. In this way, by parsing multiple log records in the flow log, the cloud management platform can obtain the network traffic log of at least one cloud resource in the first VPC including the first cloud resource.

Optionally, in some embodiments, before the cloud management platform obtains the flow log of the first VPC from the cloud log server based on the indication information of the first VPC, it can also send permission application information to the tenant terminal of the tenant corresponding to the first VPC, and the permission application information is used to apply to the tenant for permission to obtain the flow log of the first VPC. After receiving the permission application information, the tenant terminal can The permission application information and the corresponding options of agreeing to authorization and disagreeing to authorization are displayed in the interface of the cloud service client. If the tenant agrees that the cloud management platform can obtain the flow log of the first VPC, the tenant can click the option of agreeing to authorization to trigger the tenant terminal to return a notification message of agreeing to authorization to the cloud management platform. After receiving the notification message of agreeing to authorization, the cloud management platform can obtain the flow log of the first VPC. If the tenant disagrees that the cloud management platform can obtain the flow log of the first VPC, the tenant can click the option of disagreeing to authorization to trigger the tenant terminal to feedback a notification message of disagreeing to authorization to the cloud management platform. In this case, the cloud management platform does not obtain the flow log of the first VPC.

Step 202: Generate a cloud resource architecture diagram based on the configuration information of the first cloud resource and the network traffic log.

After obtaining configuration information and network traffic logs of at least one cloud resource including the first cloud resource in the first VPC, the cloud management platform may generate a cloud resource architecture diagram based on the obtained configuration information and network traffic logs.

In some embodiments, the configuration information of a cloud resource may include information about other cloud resources associated with the cloud resource. Based on this, taking the fourth cloud resource in the first VPC as an example, if the configuration information of the fourth cloud resource also includes information about the fifth cloud resource associated with the fourth cloud resource, the cloud management platform can determine that the fourth cloud resource has a connection relationship with the fifth cloud resource.

For example, the fourth cloud resource is a cloud server, and the configuration information of the fourth cloud resource includes information of two bound cloud hard disks. Based on the configuration information, the cloud management platform can determine that the fourth cloud resource has a connection relationship with the two cloud hard disks.

In some embodiments, the cloud management platform may also obtain configuration information of a public network resource associated with at least one cloud resource in the first VPC, and the configuration information of the public network resource may include the cloud resource in the first VPC to which the public network resource is bound. Based on this, taking the cloud resource in the first VPC to which the public network resource is bound as the sixth cloud resource as an example, the cloud management platform may also determine that the sixth cloud resource has a connection relationship with the public network resource based on the binding information of the public network resource and the sixth cloud resource included in the configuration information of the public network resource.

For example, as shown in FIG. 3 , the configuration information of the EIP indicates that the EIP is bound to the ELB identified as ID3 , and it can be determined that there is a connection relationship between the EIP and the ELB.

In some embodiments, the network traffic log of the cloud resources in the first VPC may indicate that there is data message transmission between the cloud resources and other cloud resources. Based on this, the cloud management platform may also determine the connection relationship between the cloud resources based on the network traffic log of the cloud resources in the first VPC.

Exemplarily, each log record in the flow log of the first VPC includes a source address and a destination address of a data packet transmission. Based on this, the cloud management platform can determine the connection relationship between two cloud resources based on the source address and the destination address of the data packet transmission recorded in each log record.

Taking a log record in the flow log of the first VPC as an example, the log record is referred to as the first record. The cloud management platform can determine that there is a connection relationship between the first cloud resource and the second cloud resource based on the source address and destination address in the first record, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource.

As can be seen from the above introduction, the source address in the log record is the address of the sender of the data message, and the destination address is the address of the receiver of the data message. Therefore, if the source address in the first record is the IP address of the first cloud resource and the destination address is the IP address of the second cloud resource, then based on the first record, it can be determined that the first cloud resource has transmitted the data message to the second cloud resource, that is, there is a connection relationship between the first cloud resource and the second cloud resource. Similarly, if the source address in the first record is the IP address of the second cloud resource and the destination address is the IP address of the first cloud resource, then based on the first record, it can be determined that the second cloud resource has transmitted the data message to the first cloud resource, that is, there is a connection relationship between the first cloud resource and the second cloud resource.

It should be noted that the second cloud resource can be a cloud resource in the first VPC or a cloud resource in the second VPC. In the case where the second cloud resource is a cloud resource in the second VPC, if the second VPC and the first VPC are VPCs built by the same tenant, the cloud management platform can also use the IP address of the second cloud resource as the indication information of the second VPC, and based on the indication information of the second VPC, refer to the method introduced in the aforementioned step 201 to obtain the configuration information and network traffic log of the cloud resources in the second VPC, and then obtain the connection relationship of the cloud resources in the second VPC through the configuration information and network traffic log of the cloud resources in the second VPC. It can be seen that the flow log of the first VPC can not only determine the connection relationship between cloud resources in the same VPC, but also determine the connection relationship between cloud resources across VPCs.

Optionally, the log records in the flow log of the first VPC may also include a source port identifier and a destination port identifier. On this basis, the cloud management platform may also determine the connection relationship between the two ports on the two cloud resources based on the source port identifier and the destination port identifier in the log records.

Still taking the first record as an example, the cloud management platform can also determine that there is a connection relationship between the first port on the first cloud resource and the second port on the second cloud resource based on the source port identifier and the destination port identifier in the first record.

As can be seen from the above introduction, the source port identifier in the log record is the sender of the data message indicated by the source address. The source port identifier is the port for sending the data message, and the destination port identifier is the port for receiving the data message on the receiver indicated by the destination address. Based on this, if the source address in the first record is the IP address of the first cloud resource, the source port identifier in the first record is the identifier of the port on the first cloud resource that sends the data message to the second cloud resource, and the destination port identifier in the first record is the identifier of the port on the second cloud resource for receiving the data message sent by the first cloud resource. In this case, based on the first record, it can be determined that there is a connection relationship between the first port on the first cloud resource identified by the source port identifier and the second port on the second cloud resource identified by the destination port identifier.

Optionally, if the source address in the first record is the IP address of the second cloud resource, the source port identifier in the first record is the identifier of the port on the second cloud resource that sends data packets to the first cloud resource, and the destination port identifier in the first record is the identifier of the port on the first cloud resource used to receive data packets sent by the second cloud resource. In this case, based on the first record, it can be determined that there is a connection relationship between the second port on the second cloud resource identified by the source port identifier and the first port on the first cloud resource identified by the destination port identifier.

For example, if both the first cloud resource and the second cloud resource are ECS instances, different applications deployed on the ECS instances may communicate through different ports. Based on this, the cloud management platform can also determine which two ports on the two ECS instances have a connection relationship based on the first record, that is, it can determine which two ports have a communication link established between them.

Optionally, if the source address or destination address in the first record is a virtual IP address, then since the virtual IP address can be bound to at least one instance, it will correspond to at least one real IP address. Based on this, the cloud management platform can also determine from the flow log of the first VPC a second record indicating the same data packet transmission as the first record, and determine the cloud resource bound to the virtual IP address in the first record based on the second record.

For example, if the source address in the first record is the IP address of the second cloud resource, and if the source address in the first record is the first virtual IP address, the cloud management platform can search the flow log of the first VPC for a second record whose destination address, destination port identifier, protocol type, number of packets, packet size, start time, and end time are the same as the first record and whose source address is a real IP address. Afterwards, the cloud management platform can determine, based on the first record and the second record, that the first virtual IP address is the virtual IP address bound to the third cloud resource indicated by the source address in the second record.

Since the destination address, destination port, protocol type, number of packets, packet size, start time, and end time in the second record and the first record are the same, it means that the two records record the same process of sending a data message to the first cloud resource. In this case, the source address in the first record and the second record refers to the address of the sender of the data message sent this time. Based on this, the first virtual IP address in the first record is the virtual IP address of the sender of the data message, and the source address in the second record is the real IP address of the sender of the data message. It can be seen that the source address in the second record is the real IP address of the instance bound to the first virtual IP address. In other words, the first virtual IP address is the virtual IP address bound to the third cloud resource indicated by the source address in the second record. In this way, the cloud management platform can determine that there is a connection relationship between the third cloud resource and the second cloud resource represented by the first virtual IP address.

Optionally, taking the IP address of the second cloud resource as an example, if the destination address in the first record is the first virtual IP address, the cloud management platform can search the flow log of the first VPC for a second record whose source address, source port identifier, protocol type, number of packets, packet size, start time and end time are the same as the first record and whose destination address is a real IP address. Afterwards, the cloud management platform can determine, based on the first record and the second record, that the first virtual IP address is the virtual IP address bound to the third cloud resource indicated by the destination address in the second record.

Furthermore, if the cloud service types of the third cloud resource and the second cloud resource indicated by the first virtual IP address are both cloud databases, and the cloud management platform can further determine the network deployment relationship of the cloud resources, that is, the cloud database is deployed on the instance of the third cloud resource.

Optionally, in the case where the third cloud resource is a cloud resource in the first VPC, if the configuration information of the cloud resource in the first VPC also includes a seventh cloud resource of type cloud database, and the IP address of the seventh cloud resource is a real IP address, the cloud management platform can also determine that the first virtual IP address is also the virtual IP address bound to the seventh cloud resource. In addition, the cloud management platform can also determine that the cloud database is deployed on two instances of the third cloud resource and the seventh cloud resource, wherein the third cloud resource is the current primary instance and the seventh cloud resource is the current backup instance.

The above is an example of determining the association relationship between cloud resources based on the network traffic log of cloud resources given in the embodiment of the present application. In some possible cases, the cloud management platform can also obtain other cloud resource deployment relationships based on the network traffic log of cloud resources in the first VPC. For example, the cloud management platform can also determine the deployment location of the hidden switch in the first VPC based on the source address, destination address and interface identifier in each log record, and determine which cloud resources in the first VPC belong to the same security group based on the source address, destination address and action in each log record.

After determining the connection relationship between cloud resources through configuration information and network traffic logs, the cloud management platform can generate a cloud resource architecture diagram based on the determined connection relationship between cloud resources and the acquired configuration information of cloud resources and public network resources. The cloud resource architecture diagram includes the connection relationship between the above-mentioned cloud resources.

Exemplarily, the cloud management platform can first draw cloud resource nodes representing corresponding cloud resources based on the acquired configuration information of cloud resources within the first VPC, and draw cloud resource nodes corresponding to public network resources based on the configuration information of public network resources associated with the first VPC, thereby obtaining a resource node graph, wherein each cloud resource node can correspond to a resource identifier and/or IP address of a cloud resource or a public network resource.

It should be noted that the cloud management platform can determine the initial layout of cloud resource nodes corresponding to each cloud resource based on the type of cloud resources within the first VPC, and determine the initial layout of cloud resource nodes corresponding to the public network resources based on the association between the public network resources and other resources contained in the configuration information of the public network resources, thereby drawing a resource node diagram based on the initial layout.

For example, see Figure 5. ELB instances are used to achieve load balancing. In VPC scenarios, they are usually associated with ECS instances. Therefore, in the resource node diagram, the ELB node representing the ELB instance can be close to the ECS1 node representing the ECS1 instance and the ECS2 node representing the ECS2 instance. Multiple ECS instances are usually used as computing resources, so the ECS1 node and the ECS2 node are placed side by side. For another example, the cloud database is a data storage service, and the ECS instance may access the cloud database more frequently. Therefore, the relational database service (RDS) node A representing the cloud database resource A, the RDS node B representing the cloud database resource B, and the RDS node C representing the cloud database resource C can be close to the ECS1 node and the ECS2 node. Finally, according to the configuration information of the public network resources, the connection relationship between the EIP and the ELB instance, the connection relationship between the domain name address and the EIP, and the connection relationship between the domain name address aaa.bbb.com and the WAF can be obtained. Therefore, the EIP node representing the EIP can be close to the ELB node, so the domain name address aaa.bbb.com is close to the EIP node, and the WAF node representing the WAF is close to the domain name address and the EIP node. In addition, as shown in Figure 5, each cloud resource node can also correspond to the IP address of the corresponding cloud resource.

Optionally, if the connection relationship between cloud resources determined through the network traffic log of cloud resources includes the connection relationship between cloud resources within the first VPC and cloud resources in other VPCs, the cloud management platform can also add cloud resource nodes representing cloud resources in other VPCs in the resource node graph based on the connection relationship between cloud resources in the first VPC and cloud resources in other VPCs.

Optionally, when drawing the resource node diagram, the cloud management platform may also indicate corresponding cloud resource nodes through corresponding cloud resource legends according to the types of cloud resources.

After obtaining the resource node graph, the cloud management platform may connect the cloud resource nodes corresponding to the cloud resources having a connection relationship based on the connection relationship between the cloud resources determined above.

For example, still taking Figure 5 as an example, the cloud management platform can determine that the EIP is bound to the ELB instance based on the configuration information of the cloud resources, and that the EIP is associated with the domain name address aaa.bbb.com, and that the domain name address is associated with the WAF. Therefore, the EIP node and the ELB node can be connected by a connecting line, the EIP node and the domain name address A can be connected, and the domain name address A can be connected to the WAF. In addition, based on the flow logs in the first VPC, it can be determined that the ELB instance has a connection relationship with the ECS1 instance and the ECS2 instance respectively. Therefore, based on the connection relationship, the ELB node can be connected to the ECS1 node, and the ELB node can be connected to the ECS2 node. In addition, according to the flow log of the first VPC, it can also be determined that the ECS1 instance and the ECS2 instance have a connection relationship with the cloud database resource A, and the ECS1 instance and the ECS2 instance also have a connection relationship with the cloud database resource B. Since the IP address of the cloud database resource A is a virtual IP address, and the IP addresses of the cloud database resources B and the cloud database resources C are both real IP addresses, it can be determined that the cloud database resource A is the virtual IP address bound to the cloud database resources B and the cloud database resources C, and the cloud database is distributedly deployed on the cloud database resources B and the cloud database resources C, and the cloud database resource B is the current master instance, and the cloud database resource C is the current standby instance. Based on this, the cloud management platform can connect both the ECS1 node and the ECS2 node to the RDS node A, and connect the RDS node A to the RDS node B and the RDS node C respectively, and mark the RDS node B as the master node and the RDS node C as the standby node in the figure. In addition, the cloud management platform can also mark the network identifier VPC1 of the first VPC for the cloud resources in the first VPC. In this way, the cloud management platform obtains a cloud resource architecture diagram including the connection relationships between multiple cloud resources.

In some embodiments, after obtaining the configuration information of the cloud resources within the first VPC and the configuration information of the associated public network resources, the cloud management platform may first generate a resource node graph based on the obtained configuration information through the method introduced above, and then determine the connection relationship between the cloud resources according to the obtained configuration information and the network traffic log of the cloud resources within the first VPC, and connect the cloud resource nodes in the resource node graph according to the connection relationship between the cloud resources, thereby obtaining a cloud resource architecture diagram including the connection relationship between multiple cloud resources.

In some other embodiments, the cloud management platform may also first generate a request based on the architecture diagram to obtain the configuration information and network traffic log of the first cloud resource in the first VPC, and then determine the connection relationship between the first cloud resource and other cloud resources based on the configuration information and network traffic log of the first cloud resource, and then draw the corresponding cloud resources and cloud resource nodes in the cloud resource architecture diagram based on the connection relationship. The connection lines between them. Afterwards, the cloud management platform can obtain the configuration information and network traffic logs of other cloud resources that have a connection relationship with the first cloud resource, and then draw the possible connection relationships between other cloud resources in the cloud resource architecture diagram. In this way, new connection relationships are continuously obtained through the connection relationships between the determined cloud resources, so as to draw the cloud resource architecture diagram. Among them, the implementation process of determining the connection relationship between any cloud resource and other cloud resources based on the configuration information and network traffic log of the cloud resource can be referred to the previous introduction, which will not be repeated here.

After generating the cloud resource architecture diagram, the cloud management platform may send the cloud resource architecture diagram to the tenant terminal. Accordingly, the tenant terminal may display the cloud resource architecture diagram in the resource architecture diagram display page of the cloud service client.

Optionally, the cloud management platform can also store the cloud resource architecture diagram. For example, when the architecture diagram generation request sent by the tenant carries the network identifier of the first VPC, the cloud management platform can store the cloud resource architecture diagram in correspondence with the network identifier of the first VPC. In this way, if the cloud management platform receives an architecture diagram generation request from the tenant carrying the network identifier of the first VPC again, the cloud management platform can directly obtain the cloud resource architecture diagram based on the architecture diagram generation request, and return the cloud resource architecture diagram to the tenant terminal.

Optionally, after storing the cloud resource architecture diagram, if the cloud resources in the cloud resource architecture diagram change, the cloud management platform may also update the cloud resource architecture diagram according to the changes in the cloud resources.

Exemplarily, a cloud data center can provide a cloud audit service to tenants. The cloud audit service can record the operation activities of various resources in the cloud environment. For example, the deletion, addition, modification and other change information of various cloud resources such as ECS instances and cloud databases in the VPC can be recorded. Based on this, the cloud management platform can obtain the cloud audit information of the first VPC, and then update the cloud resource architecture diagram based on the cloud audit information. The cloud audit information may include at least one cloud resource change information.

In some embodiments, the cloud management platform may obtain cloud audit information of the first VPC at a preset time interval, and then update the cloud resource architecture diagram according to the cloud audit information. The cloud audit information may include one or more cloud resource change information within the preset time interval.

In other embodiments, after recording each cloud resource change information of the first VPC, the cloud audit service may actively send a resource change notification to the cloud management platform, and the resource change notification may include the network identifier of the first VPC and the cloud resource change information recorded by the cloud audit service this time. After receiving the resource change notification, the cloud management platform may obtain the corresponding cloud resource architecture diagram based on the network identifier of the first VPC, and then update the cloud resource architecture diagram based on the cloud resource change information in the resource change notification.

In addition, according to the different cloud resource change information in the obtained cloud audit information, the cloud management platform can update the cloud resource architecture diagram in different ways.

Exemplarily, if the cloud audit information includes cloud resource addition information, the cloud management platform can add the connection relationship between the newly added cloud resource and other cloud resources in the cloud resource architecture diagram based on the cloud resource addition information. For example, if the cloud resource addition information includes information about adding a certain cloud resource in the cloud resource architecture diagram, the cloud management platform can obtain the configuration information of the added cloud resource, and then add the cloud resource node corresponding to the cloud resource in the cloud resource architecture diagram based on the configuration information of the cloud resource. If the configuration information of the cloud resource also includes the connection relationship between the cloud resource and other cloud resources, the cloud management platform can also add the connection relationship between the cloud resource and other cloud resources in the cloud resource architecture diagram. In addition, the cloud management platform can also obtain the network traffic log of the cloud resource, and add the connection relationship between the cloud resource and other cloud resources in the cloud resource architecture diagram based on the network traffic log of the cloud resource. The relevant implementation method can refer to the introduction in the previous text and will not be repeated here.

If the cloud audit information includes cloud resource deletion information, the cloud management platform can delete the corresponding cloud resource in the cloud resource architecture diagram and the connection relationship between the cloud resource and other cloud resources based on the cloud resource deletion information. For example, the cloud resource deletion information may include information about deleting a cloud resource in the cloud resource architecture diagram. The cloud management platform can delete the cloud resource node used to represent the cloud resource in the cloud resource architecture diagram, and delete the connection relationship between the cloud resource node and other cloud resource nodes. After the deletion is completed, the cloud management platform can also mine the connection relationship by re-acquiring the network traffic logs of each cloud resource in the cloud resource architecture diagram, so as to supplement the new connection relationship that may appear between the remaining cloud resources after deleting the cloud resource.

If the cloud audit information includes cloud resource modification information, the cloud management platform can modify the information of the corresponding cloud resource in the cloud resource architecture diagram based on the cloud resource modification information. For example, the cloud resource modification information may include information for modifying the connection relationship of a cloud resource already in the current cloud resource architecture diagram, and the cloud management platform can modify the connection relationship of the cloud resource in the cloud resource architecture diagram based on the cloud resource modification information.

Optionally, in some embodiments, when the cloud resource architecture diagram includes the connection relationship of cloud resources in different VPCs, the cloud management platform can obtain the cloud audit information of each VPC, and refer to the above-mentioned method to update the cloud resource architecture diagram based on the cloud audit information of each VPC. Alternatively, the cloud management platform can also obtain cloud audit information containing the change information of the corresponding cloud resource based on each cloud resource included in the cloud resource architecture diagram, and then refer to the above-mentioned method to update the cloud audit information based on the obtained cloud audit information. Update the cloud resource architecture diagram.

In an embodiment of the present application, in response to a tenant's request to generate an architecture diagram, the cloud management platform can obtain the configuration information of the first cloud resource and the network traffic log of the first cloud resource, and automatically generate a cloud resource architecture diagram including the connection relationship between the first cloud resource and other cloud resources based on the configuration information and network traffic log of the first cloud resource. There is no need for the tenant to draw the diagram manually, and the operation is simple and the availability is high.

In addition, in an embodiment of the present application, the connection relationship between the first cloud resource and other cloud resources can be obtained through the flow log of the VPC associated with the first cloud resource, without installing invasive components, without affecting the performance of the node where the cloud resource is located, with higher availability and lower cost.

Finally, since the VPC flow log records the data packet transmission of all cloud resources in the VPC, the connection relationship that can be obtained through the VPC flow log is more extensive than the method of obtaining interface call relationships by installing intrusive components. Accordingly, the connection relationship in the VPC flow log can generate a cloud resource architecture diagram with wider coverage and more complete information.

Next, the cloud management platform provided in the embodiment of the present application is introduced.

FIG6 is a schematic diagram of the structure of a cloud management platform provided in an embodiment of the present application. Referring to FIG6 , the cloud management platform 600 may include: a resource information acquisition module 61 and an architecture diagram generation module 62 .

The resource information acquisition module 61 may be used to execute step 201 in the aforementioned embodiment, and the architecture diagram generation module 62 may be used to execute step 202 in the aforementioned embodiment.

Exemplarily, referring to FIG6 , the resource information acquisition module 61 may include a flow log acquisition unit 611. The flow log acquisition unit 611 may be used to acquire the flow log of the VPC associated with the first cloud resource, the flow log including a first record indicating that there is data message transmission between the first cloud resource and the second cloud resource, the first record including the source address and the destination address of the data message transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource. Specifically, referring to FIG6 , the flow log may be stored on a cloud log server that provides an object storage service (OBS), and the flow log acquisition unit 611 may acquire the flow log of the VPC associated with the first cloud resource from the cloud log server.

Optionally, the resource information acquisition module 61 may further include a resource configuration information acquisition unit 612, which is used to: acquire the configuration information of the first cloud resource. Optionally, the resource configuration information acquisition unit 612 may also be used to acquire the configuration information of the fourth cloud resource, wherein the configuration information of the fourth cloud resource also includes the connection relationship between the fourth cloud resource and the fifth cloud resource, and accordingly, the architecture diagram generation module 62 is also used to generate a cloud resource architecture diagram using the configuration information of the fourth cloud resource, wherein the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship. Optionally, the resource configuration information acquisition unit 612 may also be used to acquire the configuration information of the sixth cloud resource, and based on the configuration information of the sixth cloud resource, acquire the configuration information of the public network resource associated with the sixth cloud resource, wherein the configuration information of the public network resource may include the connection relationship between the sixth cloud resource and the public network resource. Correspondingly, the architecture diagram generation module 62 is also used to generate a cloud resource architecture diagram using the configuration information of the sixth cloud resource and the configuration information of the associated public network resource, wherein the cloud resource architecture diagram also includes the connection relationship between the sixth cloud resource and the public network resource. For example, referring to FIG6 , the configuration information of the cloud resource can be stored in a cloud resource information server, and the resource configuration information acquisition unit 612 can acquire the configuration information of the first cloud resource and the configuration information of the public network resource associated with the first cloud resource from the cloud resource information server.

Optionally, the above-mentioned first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

Optionally, the IP address of the second cloud resource is the first virtual IP address, and the flow log of the VPC associated with the first cloud resource also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

Optionally, the configuration information of the first cloud resource also includes a connection relationship between the first cloud resource and the fourth cloud resource, and the first cloud resource and the fourth cloud resource in the cloud resource architecture diagram have a connection relationship.

Optionally, the cloud management platform 600 also includes: a cloud audit information acquisition module 63 and an architecture diagram update module 64. The cloud audit information acquisition module 63 is used to obtain the cloud audit information of the VPC associated with the first cloud resource unit, and the cloud audit information includes at least one of the cloud resource addition information, cloud resource deletion information and cloud resource modification information within the VPC; the architecture diagram update module 64 is used to add corresponding cloud resources to the cloud resource architecture diagram based on the cloud resource addition information; or, based on the cloud resource deletion information, delete the corresponding cloud resources in the cloud resource architecture diagram; or, based on the cloud resource modification information, modify the corresponding cloud resources in the cloud resource architecture diagram. For example, referring to FIG. 6, The cloud audit information acquisition module 63 can obtain the cloud audit information of the VPC associated with the first cloud resource from the cloud audit service.

In the embodiment of the present application, in response to the tenant's architecture diagram generation request, the cloud management platform can obtain the configuration information of the first cloud resource and the network traffic log of the first cloud resource, and automatically generate the cloud resource architecture diagram based on the configuration information and network traffic log of the first cloud resource, without the need for the tenant to draw manually, with simple operation and high availability. In addition, since the connection relationship between the first cloud resource and other cloud resources can be obtained through the flow log of the VPC associated with the first cloud resource, there is no need to install invasive components, and the cost is lower.

The embodiment of the present application also provides a computing device 700. As shown in FIG7 , the computing device 700 includes: a bus 702, a processor 704, a memory 706, and a communication interface 708. The processor 704, the memory 706, and the communication interface 708 communicate with each other through the bus 702. The computing device 700 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 700.

The bus 702 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG. 7 is represented by only one line, but does not mean that there is only one bus or one type of bus. The bus 702 may include a path for transmitting information between various components of the computing device 700 (e.g., the memory 706, the processor 704, and the communication interface 708).

Processor 704 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

The memory 706 may include a volatile memory, such as a random access memory (RAM). The processor 704 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

The memory 706 stores executable program codes, and the processor 704 executes the executable program codes to respectively implement the functions of the resource information acquisition module and the architecture diagram generation module, thereby implementing the cloud resource architecture diagram generation method. That is, the memory 706 stores instructions for executing the cloud resource architecture diagram generation method.

Alternatively, the memory 706 stores executable codes, and the processor 704 executes the executable codes to respectively implement the functions of the aforementioned cloud management platform, thereby implementing the cloud resource architecture diagram generation method. That is, the memory 706 stores instructions for executing the cloud resource architecture diagram generation method.

The communication interface 708 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or communication networks.

The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

As shown in Fig. 8, the computing device cluster includes at least one computing device 700. The memory 706 in one or more computing devices 700 in the computing device cluster may store the same instructions for executing the cloud resource architecture diagram generation method.

In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store some instructions for executing the cloud resource architecture diagram generation method. In other words, the combination of one or more computing devices 700 can jointly execute the instructions for implementing the cloud resource architecture diagram generation method.

It should be noted that the memory 706 in different computing devices 700 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the cloud management platform. That is, the instructions stored in the memory 706 in different computing devices 700 can implement the functions of one or more modules in the resource information acquisition module and the architecture diagram generation module.

In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network or a local area network, etc. FIG. 9 shows a possible implementation. As shown in FIG. 9 , two computing devices 700A and 100B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 706 in the computing device 700A stores instructions for executing the functions of a resource information acquisition module and an architecture diagram generation module. At the same time, the memory 706 in the computing device 700B stores instructions for executing the functions of a cloud audit information acquisition module and an architecture diagram update module.

The connection method between the computing device clusters shown in FIG9 may be considered to be a resource information acquisition module and an architecture diagram generation module. The processing is performed by the computing device 700A.

It should be understood that the functions of the computing device 700A shown in FIG9 may also be completed by multiple computing devices 700. Similarly, the functions of the computing device 700B may also be completed by multiple computing devices 700.

The embodiment of the present application also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to the connection mode of the computing device cluster described in Figures 8 and 9. The difference is that the memory 706 in one or more computing devices 700 in the computing device cluster can store the same instructions for executing the cloud resource architecture diagram generation method.

In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store partial instructions for executing the cloud resource architecture diagram generation method. In other words, the combination of one or more computing devices 700 may jointly execute instructions for executing the cloud resource architecture diagram generation method.

It should be noted that the memory 706 in different computing devices 700 in the computing device cluster can store different instructions for executing part of the functions of the cloud resource architecture diagram generation system. That is, the instructions stored in the memory 706 in different computing devices 700 can implement the functions of one or more devices of the cloud management platform and infrastructure.

The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the cloud resource architecture diagram generation method.

The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the cloud resource architecture diagram generation method.

In each embodiment of the present application, if there is no special explanation and logical conflict, the terms and/or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form a new embodiment according to their inherent logical relationship. In the embodiment of the present application, "at least one" refers to one or more, and "multiple" refers to two or more. "And/or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and/or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of the embodiment of the present application, the character "/" generally indicates that the front and back associated objects are in an "or" relationship. In the present application, "first", "second" and various digital numbers are only for the convenience of description, and are not used to limit the scope of the embodiment of the present application. For example, to distinguish different messages, etc., rather than to describe a specific order or sequence.

It is understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims (17)

A method for generating a cloud resource architecture diagram, characterized in that it is applied to a cloud management platform, the cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, the multiple target cloud resources include a first cloud resource and a second cloud resource, the method includes: In response to an architecture diagram generation request sent by the tenant, obtain configuration information of the first cloud resource and obtain a network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes a type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on a flow log of a virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that data message transmission exists between the first cloud resource and a second cloud resource; Based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, a cloud resource architecture diagram is generated, and the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship. The method according to claim 1, wherein obtaining the network traffic log of the first cloud resource comprises: Obtain a flow log of a virtual private cloud VPC associated with the first cloud resource, the flow log including a first record indicating that data packet transmission exists between the first cloud resource and the second cloud resource, the first record including a source address and a destination address of the data packet transmission, wherein the source address in the first record is an IP address of the first cloud resource, and the destination address in the first record is an IP address of the second cloud resource; or, the source address in the first record is an IP address of the second cloud resource, and the destination address in the first record is an IP address of the first cloud resource. The method according to claim 2 is characterized in that the first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship. The method according to claim 2 is characterized in that the IP address of the second cloud resource is a first virtual IP address, the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a connection relationship with the second cloud resource. The method according to any one of claims 1 to 4, characterized in that the multiple target cloud resources further include a fourth cloud resource and a fifth cloud resource, and the method further includes: The configuration information of the fourth cloud resource is obtained, wherein the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship. The method according to any one of claims 1 to 5, characterized in that the multiple target cloud resources also include a sixth cloud resource, and the method further includes: Obtaining configuration information of the sixth cloud resource; Based on the configuration information of the sixth cloud resource, the configuration information of the public network resource associated with the sixth cloud resource is obtained, the configuration information of the public network resource includes the connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource. The method according to any one of claims 1 to 6, characterized in that the method further comprises: Obtain cloud audit information of the VPC associated with the first cloud resource, the cloud audit information including at least one of cloud resource addition information, cloud resource deletion information, and cloud resource modification information in the VPC; Based on the cloud resource addition information, add the corresponding cloud resource in the cloud resource architecture diagram; or, based on the cloud resource deletion information, The corresponding cloud resources in the cloud resource architecture diagram are deleted based on the deletion information; or the corresponding cloud resources in the cloud resource architecture diagram are modified based on the cloud resource modification information. A cloud management platform, characterized in that the cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, the multiple target cloud resources include a first cloud resource and a second cloud resource, and the cloud management platform includes: a resource information acquisition module, configured to, in response to an architecture diagram generation request sent by a tenant, acquire configuration information of the first cloud resource and acquire a network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes a type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on a flow log of a virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that data message transmission exists between the first cloud resource and a second cloud resource; An architecture diagram generation module is used to generate a cloud resource architecture diagram based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, wherein the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship. The cloud management platform according to claim 8, wherein the resource information acquisition module comprises: A flow log acquisition unit is used to obtain the flow log of the virtual private cloud VPC associated with the first cloud resource, the flow log includes a first record indicating that there is data packet transmission between the first cloud resource and the second cloud resource, the first record includes a source address and a destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource. The cloud management platform according to claim 9 is characterized in that the first record also includes a source port identifier and a destination port identifier of the data message transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship. The cloud management platform according to claim 9 is characterized in that the IP address of the second cloud resource is a first virtual IP address, the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address. The cloud management platform according to any one of claims 8 to 11, characterized in that the multiple target cloud resources further include a fourth cloud resource and a fifth cloud resource, and the resource information acquisition module comprises: A resource configuration information acquisition unit is used to acquire the configuration information of the fourth cloud resource, wherein the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship. The cloud management platform according to any one of claims 8 to 12, characterized in that the multiple target cloud resources further include a sixth cloud resource, and the resource information acquisition module further includes: A resource configuration information acquisition unit is used to obtain the configuration information of the sixth cloud resource; based on the configuration information of the sixth cloud resource, the configuration information of the public network resource associated with the sixth cloud resource is acquired, the configuration information of the public network resource includes the connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource. The cloud management platform according to any one of claims 8 to 13, characterized in that the cloud management platform further comprises: a cloud audit information acquisition module, configured to acquire cloud audit information of the VPC associated with the first cloud resource, wherein the cloud audit information includes at least one of cloud resource addition information, cloud resource deletion information, and cloud resource modification information within the VPC; An architecture diagram updating module is used to add corresponding cloud resources in the cloud resource architecture diagram based on cloud resource addition information; or to delete corresponding cloud resources in the cloud resource architecture diagram based on cloud resource deletion information; or to modify corresponding cloud resources in the cloud resource architecture diagram based on cloud resource modification information. A computing device cluster, characterized in that it includes at least one computing device, each computing device includes a processor and a memory; The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the cloud resource architecture diagram generation method as described in any one of claims 1 to 7. A computer-readable storage medium, characterized in that it includes computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generation method as described in any one of claims 1 to 7. A computer program product comprising instructions, characterized in that when the instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generation method as described in any one of claims 1 to 7.