Cloud resource architecture diagram generation method, cloud management platform, and computing device cluster

Abstract

The present application belongs to the technical field of cloud computing, and discloses a cloud resource architecture diagram generation method, a cloud management platform, and a computing device cluster. The present application comprises: in response to an architecture diagram generation request of a tenant, a cloud management platform acquires configuration information of a first cloud resource, acquires a network traffic log of the first cloud resource, and automatically generates a cloud resource architecture diagram on the basis of the configuration information of the first cloud resource and the network traffic log. Manual drawing by tenants is not needed, the operation is simple, and the availability is high. Moreover, because network traffic logs of cloud resources are acquired on the basis of VPC flow logs associated with the cloud resources, that is, in the embodiments of the present application, connection relationships between the cloud resources can be acquired by means of the VPC flow logs associated with the cloud resources, no agent assembly is required to be installed, the performance of nodes where the cloud resources are located is not affected, the availability is higher, and the cost is lower.

Description

Cloud resource architecture diagram generation method, cloud management platform and computing device cluster

[0001] This application claims priority to the Chinese patent application with application number 202311393633.9, filed on October 25, 2023, and application name “Architecture diagram generation method, device, computing device cluster and storage medium”, and claims priority to the Chinese patent application with application number 202410118224.6, filed on January 26, 2024, and application name “Cloud resource architecture diagram generation method, cloud management platform and computing device cluster”, all of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of cloud computing technology, and in particular to a cloud resource architecture diagram generation method, a cloud management platform, and a computing device cluster. Background Art

[0003] With the recent development of cloud computing technology, cloud service providers can provide tenants with a variety of available cloud resources, such as computing, storage, and network resources. Tenants can purchase or lease cloud resources from cloud service providers and utilize them to implement their own business needs. For example, tenants can deploy applications to the cloud environment created by these cloud resources, achieving cloud migration.

[0004] Currently, after purchasing or renting cloud resources, tenants can usually manually draw a cloud resource architecture diagram and then use the cloud resource architecture diagram to manage cloud resources. However, manually drawing cloud resource architecture diagrams is not only cumbersome and inefficient, but also requires high skills from tenants.

[0005] Summary of the Invention

[0006] The present application provides a cloud resource architecture diagram generation method, cloud management platform, computing device cluster, storage medium and program product, which are simple to operate, highly available and low in cost.

[0007] To achieve the above objectives, this application adopts the following technical solutions:

[0008] In a first aspect, a method for generating a cloud resource architecture diagram is provided, which is applied to a cloud management platform, wherein the cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, wherein the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, and one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, and the multiple target cloud resources include a first cloud resource and a second cloud resource. The method includes: in response to an architecture diagram generation request sent by a tenant, obtaining configuration information of the first cloud resource and obtaining a network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes the type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on the flow log of the virtual private cloud (VPC) associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that there is data packet transmission between the first cloud resource and the second cloud resource; based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, a cloud resource architecture diagram is generated, wherein the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship.

[0009] In this application, in response to a tenant's request to generate an architecture diagram, the cloud management platform can obtain the configuration information of a first cloud resource and the network traffic log of the first cloud resource. Based on the configuration information and network traffic log of the first cloud resource, the cloud resource architecture diagram is automatically generated, eliminating the need for the tenant to manually draw the diagram. This simplifies operation and improves usability. Furthermore, since the network traffic log of the first cloud resource can be obtained through the VPC flow log, that is, the connection relationship between cloud resources can be obtained through the VPC flow log, there is no need to install invasive components, resulting in lower costs.

[0010] In addition, because the connection relationships between cloud resources contained in the VPC flow log can cover more cloud resources, the network traffic logs of each cloud resource contained in the VPC flow log can generate a cloud resource architecture diagram with wider coverage and more complete information.

[0011] Optionally, the implementation process of obtaining the network traffic log of the first cloud resource may include: obtaining the flow log of the virtual private cloud VPC associated with the first cloud resource, the flow log including a first record indicating that there is data packet transmission between the first cloud resource and the second cloud resource, the first record including the source address and destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource.

[0012] The second cloud resource and the first cloud resource may be cloud resources in the same VPC or in different VPCs. Therefore, using the flow logs of the VPC associated with the first cloud resource, we can not only obtain the connection relationships between cloud resources that transmit data packets within the VPC, but also the connection relationships between cloud resources that transmit data packets across VPCs. Based on this, the network traffic logs of cloud resources within a VPC can be used to obtain a cross-VPC cloud resource architecture diagram.

[0013] Optionally, when the second cloud resource and the first cloud resource are cloud resources in different VPCs, after obtaining the connection relationship between the first cloud resource and the second cloud resource based on the network traffic log of the first cloud resource, the cloud management platform can further obtain the configuration information of the second cloud resource and the network traffic log of the second cloud resource based on the IP address of the second cloud resource contained in the network traffic log of the first cloud resource, and then determine the connection relationship between other cloud resources in the VPC associated with the second cloud resource and the second cloud resource based on the configuration information and network traffic log of the second cloud resource. In this way, by connecting the various cloud resources in series, an architectural diagram of cloud resources across multiple VPCs can be obtained.

[0014] Optionally, the first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

[0015] In the present application, not only can the connection relationship between the first cloud resource and the second cloud resource be obtained through the source address and destination address in the first record, but the source port identifier and destination port identifier in the first record can also be used to further determine which two ports on the first cloud resource and the second cloud resource have a communication link established between them. On this basis, tenants can achieve more refined cloud resource management based on the connection relationship between cloud resources and the link relationship between the ports of cloud resources shown in the cloud resource architecture diagram.

[0016] Optionally, the IP address of the second cloud resource is the first virtual IP address, and the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

[0017] In the present application, when the source address or destination address in the first record is a virtual IP address, the real IP address of the instance to which the virtual IP address is bound can be determined by searching the second record that records the same transmission process of the same data packet, thereby determining the hidden binding relationship between the virtual IP address and the instance.

[0018] Optionally, the multiple target cloud resources also include a fourth cloud resource and a fifth cloud resource, and the method also includes: obtaining configuration information of the fourth cloud resource, the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship.

[0019] In this application, the cloud management platform can also obtain the statically configured connection relationship between cloud resources based on the configuration information of cloud resources. In this way, combined with the dynamic connection relationship obtained based on network traffic logs, a more complete cloud resource architecture diagram can be obtained.

[0020] Optionally, the multiple target cloud resources also include a sixth cloud resource, and the method also includes: obtaining configuration information of the sixth cloud resource; based on the configuration information of the sixth cloud resource, obtaining configuration information of a public network resource associated with the sixth cloud resource, the configuration information of the public network resource including the connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource.

[0021] In this application, the configuration information of the public network resource associated with the sixth cloud resource can be searched based on the configuration information of the sixth cloud resource. In this way, the cloud resource architecture diagram can also include the connection relationship between the sixth cloud resource and the public network resource, making the generated cloud resource architecture diagram more complete.

[0022] Optionally, the method also includes: obtaining cloud audit information of the VPC associated with the first cloud resource, the cloud audit information including at least one of cloud resource addition information, cloud resource deletion information and cloud resource modification information within the VPC; adding corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource addition information; or, deleting corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource deletion information; or, modifying corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource modification information.

[0023] In this application, after generating the cloud resource architecture diagram, the cloud resource architecture diagram can also be refreshed by obtaining the cloud audit information of the VPC associated with the first cloud resource to ensure the accuracy of the cloud resource architecture diagram.

[0024] In a second aspect, a cloud management platform is provided, which is used to manage an infrastructure that provides multiple target cloud resources. The infrastructure includes at least one cloud data center, each cloud data center is equipped with multiple servers, and one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure. The multiple target cloud resources include a first cloud resource and a second cloud resource. The cloud management platform includes at least one module, and the at least one module is used to execute the cloud resource architecture diagram generation method described in the first aspect above.

[0025] Exemplarily, the at least one module may include a resource information acquisition module and an architecture diagram generation module.

[0026] Among them, the resource information acquisition module is used to respond to the architecture diagram generation request sent by the tenant, obtain the configuration information of the first cloud resource, and obtain the network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes the type of the first cloud resource, and the network traffic log of the first cloud resource is obtained based on the flow log of the virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that there is data packet transmission between the first cloud resource and the second cloud resource; the architecture diagram generation module is used to generate a cloud resource architecture diagram based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, and the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship.

[0027] Optionally, the resource information acquisition module includes: a flow log acquisition unit, used to obtain the flow log of the virtual private cloud VPC associated with the first cloud resource, the flow log including a first record indicating that there is data packet transmission between the first cloud resource and the second cloud resource, the first record including the source address and destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource.

[0028] Optionally, the first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

[0029] Optionally, the IP address of the second cloud resource is the first virtual IP address, and the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

[0030] Optionally, the multiple target cloud resources also include a fourth cloud resource and a fifth cloud resource, and the resource information acquisition module includes: a resource configuration information acquisition unit, used to obtain the configuration information of the fourth cloud resource, the configuration information of the fourth cloud resource also includes the connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship.

[0031] Optionally, the multiple target cloud resources also include a sixth cloud resource, and the resource information acquisition module includes: a resource configuration information acquisition unit, used to obtain the configuration information of the sixth cloud resource; based on the configuration information of the sixth cloud resource, obtaining the configuration information of the public network resource associated with the sixth cloud resource, the configuration information of the public network resource includes the connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource.

[0032] Optionally, the cloud management platform also includes: a cloud audit information acquisition module, used to obtain cloud audit information of the VPC associated with the first cloud resource, the cloud audit information including at least one of cloud resource addition information, cloud resource deletion information and cloud resource modification information within the VPC; an architecture diagram update module, used to add corresponding cloud resources in the cloud resource architecture diagram based on the cloud resource addition information; or, based on the cloud resource deletion information, delete the corresponding cloud resources in the cloud resource architecture diagram; or, based on the cloud resource modification information, modify the corresponding cloud resources in the cloud resource architecture diagram.

[0033] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the cloud resource architecture diagram generation method as described in the first aspect above.

[0034] In a fourth aspect, a computer-readable storage medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generation method as described in the first aspect above.

[0035] In a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generation method as described in the first aspect above.

[0036] The technical effects obtained by the above-mentioned second, third, fourth and fifth aspects are similar to the technical effects obtained by the corresponding technical means in the first and second aspects, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG1 is an implementation architecture diagram of a cloud resource architecture diagram generation method provided in an embodiment of the present application;

[0038] FIG2 is a flow chart of a method for generating a cloud resource architecture diagram provided in an embodiment of the present application;

[0039] FIG3 is a schematic diagram of configuration information of a public network resource associated with a first cloud resource provided in an embodiment of the present application;

[0040] FIG4 is a schematic diagram of configuration information of other public network resources associated with a public network resource provided in an embodiment of the present application;

[0041] FIG5 is a diagram of a generated cloud resource architecture provided by an embodiment of the present application;

[0042] FIG6 is a schematic diagram of the structure of a cloud management platform provided in an embodiment of the present application;

[0043] FIG7 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0044] FIG8 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0045] FIG9 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0047] Before explaining the embodiments of the present application in detail, the application scenarios involved in the embodiments of the present application are first introduced.

[0048] With the recent development of cloud computing technology, cloud service providers can provide tenants with a variety of available cloud resources, such as Elastic Compute Service (ECS) instances, bare metal servers, cloud databases, Elastic IP (EIP), and Elastic Load Balancer (ELB) instances. Tenants can purchase or rent cloud resources from cloud service providers and use them to implement their own business operations. For example, tenants can rent or purchase cloud resources to build a Virtual Private Cloud (VPC) and deploy their own applications to the VPC, thus migrating their applications to the cloud.

[0049] Tenants may wish to obtain a cloud resource architecture diagram for one or more existing VPCs. This diagram allows them to understand the relationships between their leased or purchased cloud resources and manage them based on these relationships. Alternatively, they can use this diagram to build other VPCs.

[0050] Currently, tenants can query information about their cloud resources through the cloud management platform. Based on this information, tenants can manually draw cloud resource architecture diagrams. This manual approach to drawing architecture diagrams is cumbersome, inefficient, and has poor usability.

[0051] In addition, in some related technologies, tenants can also install agent components on the nodes corresponding to the cloud resources they rent or purchase through the cloud management platform. The cloud management platform can obtain the interface call relationship of the cloud resources through the agent components on each node, and then generate an architecture diagram based on the interface call relationship. However, since the agent component obtains the interface call relationship of the cloud resources, it will occupy the computing resources of the node, thus affecting the node performance. In addition, on the one hand, the installation and maintenance cost of the agent component is high, so the installation rate in the cloud environment is low. On the other hand, the nodes corresponding to some cloud resources may not completely belong to the tenant. Therefore, for security reasons, the agent component may not be installed on such nodes. In this case, the interface call relationship of the cloud resources that can be obtained through the agent component will be extremely limited, which will result in insufficient coverage of the final generated architecture diagram and incomplete information.

[0052] In response to the problems existing in the above-mentioned architecture diagram generation method, an embodiment of the present application provides a cloud resource architecture diagram generation method, in which, in response to the tenant's architecture diagram generation request, the cloud management platform can obtain the configuration information and network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes the type of the first cloud resource, and the network traffic log of the first cloud resource indicates that there is data packet transmission between the first cloud resource and the second cloud resource. On this basis, the cloud management platform can automatically generate a cloud resource architecture diagram containing the connection relationship between the first cloud resource and the second cloud resource based on the configuration information and network traffic log of the first cloud resource, without the need for the tenant to draw the diagram manually, with simple operation and high availability. In addition, since the network traffic log of the cloud resource in the embodiment of the present application is obtained based on the flow log of the VPC associated with the cloud resource, that is, the connection relationship between cloud resources can be obtained through the flow log of the VPC associated with the cloud resource in the embodiment of the present application, there is no need to install the agent component, and the performance of the node where the cloud resource is located is not affected, the availability is stronger, and the cost is lower.

[0053] In addition, since the VPC flow log records all data packet transmissions between cloud resources within the VPC, compared to the method of obtaining interface call information by installing an agent component, the connection relationships that can be obtained through the VPC flow log cover more cloud resources. On this basis, based on the network traffic logs of each cloud resource included in the VPC flow log, the method provided in the embodiment of the present application can generate a cloud resource architecture diagram with wider coverage and more complete information.

[0054] Next, the implementation architecture of the cloud resource architecture diagram generation method provided in the embodiment of the present application is introduced.

[0055] Figure 1 is an implementation architecture diagram of a cloud resource architecture diagram generation method provided by an embodiment of the present application. As shown in Figure 1, the implementation architecture may include a cloud management platform 101 and a tenant terminal 102. The tenant terminal 102 establishes a communication connection with the cloud management platform 101.

[0056] The cloud management platform 101 is used to manage an infrastructure that provides multiple target cloud resources. The infrastructure may include at least one cloud data center, each cloud data center is provided with multiple servers, and one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure. In addition, the cloud management platform 101 can also be used to provide tenants with an access interface to access the cloud data center. For example, a tenant can purchase resources provided by a cloud data center through the cloud management platform 101. For another example, after purchasing virtual machine resources provided by a cloud data center, a tenant can create, manage, log in and operate a virtual machine on a server in the cloud data center through the cloud management platform 101. In an embodiment of the present application, a virtual machine may also be referred to as a virtual instance, a cloud server or an ECS instance. In addition, in an embodiment of the present application, cloud servers, virtual instances and ECS instances may also be used interchangeably.

[0057] In the embodiment of the present application, a cloud service client may be running on the tenant terminal 102, and the tenant may remotely log in to the cloud management platform 101 through the cloud service client using the account and password registered in the cloud management platform 101. After logging in to the cloud management platform 101, the cloud management platform 101 may provide the tenant with an interactive interface through the cloud service client on the tenant terminal 102. The tenant may perform an architecture diagram acquisition operation in the interactive interface, thereby triggering the tenant terminal 102 to send an architecture diagram generation request to the cloud management platform 101 through the cloud service client.

[0058] After receiving a tenant's request to generate an architecture diagram, the cloud management platform 101 can obtain the configuration information and network traffic logs of the first cloud resource used by the tenant, and then automatically generate a cloud resource architecture diagram based on the configuration information and network traffic logs. The cloud management platform 101 can then send the cloud resource architecture diagram to the tenant terminal 102. The tenant terminal 102 can display the cloud resource architecture diagram on the architecture diagram display page of the cloud service client.

[0059] In one possible implementation, the architecture may further include a cloud log server 103, which is used to store flow logs for different VPCs. These flow logs may include network traffic logs for different cloud resources. Based on this, the cloud management platform 101 can obtain network traffic logs for tenants' cloud resources from the cloud log server 103.

[0060] In one possible implementation, the implementation architecture may further include a cloud resource information server 104, which is used to store configuration information of cloud resources rented or purchased by different tenants. For example, a configuration information database may be deployed on the cloud resource information server 104, storing the configuration information of the tenants' cloud resources. Based on this, the cloud management platform 101 can obtain the configuration information of the cloud resources associated with the tenants from the cloud resource information server.

[0061] It should be noted that the tenant terminal 102 can be a tenant device such as a smartphone, tablet computer, or personal computer. The cloud log server 103 and the cloud resource information server 104 are both servers deployed in a cloud data center. Moreover, either the cloud log server 103 or the cloud resource information server 104 can be a physical server in the cloud data center, a server cluster, or a cloud server, which is not limited in this embodiment of the present application.

[0062] It is understood that the above implementation architecture diagram also includes multiple target cloud resources managed by the cloud management platform, which is not shown in Figure 1 of the embodiment of the present application. In addition, the cloud resource architecture diagram generation method provided in the embodiment of the present application generates a corresponding architecture diagram for some of the multiple target cloud resources managed by the cloud management platform.

[0063] Next, the cloud resource architecture diagram generation method provided in the embodiment of the present application is explained in detail.

[0064] FIG2 is a flow chart of a method for generating a cloud resource architecture diagram provided by an embodiment of the present application. The method can be applied to the cloud management platform described above. Referring to FIG2 , the method includes the following steps:

[0065] Step 201: In response to an architecture diagram generation request sent by a tenant, configuration information of a first cloud resource is obtained, and a network traffic log of the first cloud resource is obtained.

[0066] In an embodiment of the present application, after a tenant logs in to the cloud management platform via a cloud service client on a tenant terminal, the cloud management platform can provide the tenant with an interactive interface for managing cloud resources through the cloud service client. The tenant can perform an architecture diagram acquisition operation within the interactive interface. In response to the architecture diagram acquisition operation, the tenant terminal can send an architecture diagram generation request to the cloud management platform via the cloud service client.

[0067] In one possible implementation, the interactive interface may display an architecture diagram acquisition option. In response to the tenant selecting the architecture diagram acquisition option, the tenant terminal may display in the interactive interface information indicating one or more VPCs constructed by the tenant. In response to the tenant selecting information indicating a first VPC among the one or more VPCs, the tenant terminal generates an architecture diagram generation request based on the information indicating the first VPC selected by the tenant, and then sends the architecture diagram generation request to the cloud management platform. The architecture diagram generation request carries the information indicating the first VPC.

[0068] It should be noted that the VPC indication information may indicate the corresponding VPC. Exemplarily, the VPC indication information may be a network identifier of the VPC, such as an IP address of a VPC subnet or a virtual extensible local area network (VXLAN) network identifier (VNI).

[0069] Optionally, the VPC indication information may be other information that can identify the VPC. For example, the indication information may be the domain name address associated with the EIP bound to the VPC. Alternatively, the indication information may be a tenant identifier. Furthermore, the VPC indication information may be the resource identifier of any cloud resource within the VPC. For example, the indication information of the first VPC may be the resource identifier of the first cloud resource within the first VPC.

[0070] In another possible implementation, in response to the tenant selecting the architecture diagram acquisition option, the tenant terminal may further display an information input box in the interactive interface for entering VPC information. The tenant may enter the information indicating the first VPC in this information input box. After receiving the information indicating the first VPC, the tenant terminal may generate an architecture diagram generation request based on the information indicating the first VPC and send the architecture diagram generation request to the cloud management platform. The architecture diagram generation request may include the information indicating the first VPC.

[0071] After receiving the architecture diagram generation request, the cloud management platform obtains the configuration information and network traffic log of the first cloud resource based on the indication information of the first VPC carried in the architecture diagram generation request.

[0072] In a first possible implementation, when the architecture diagram generation request carries the network identifier of a first VPC, the cloud management platform may obtain configuration information of at least one cloud resource within the first VPC based on the network identifier of the first VPC. The configuration information of the at least one cloud resource includes the configuration information of the first cloud resource.

[0073] It should be noted that tenants can configure their own rented or purchased cloud resources to build a VPC. The cloud management platform can store the network identifiers of each VPC and the configuration information of the cloud resources within that VPC in a cloud resource information server. Based on this, upon receiving a request to generate an architecture diagram containing the network identifier of a first VPC, the cloud management platform can obtain the configuration information of the cloud resources corresponding to the network identifier of the first VPC from the cloud resource information server.

[0074] For example, the cloud resource configuration information corresponding to a VPC's network identifier may include the IP address, resource identifier, and type of each cloud resource within the VPC. The IP address of a cloud resource can be either a virtual IP address or a real IP address. The resource identifier of a cloud resource can be used to uniquely identify a cloud resource, for example, it can be a number assigned to the cloud resource by a cloud management platform. The type of a cloud resource can be used to indicate the cloud services that the cloud resource can implement, that is, the function of the cloud resource. For example, cloud resource types may include gateway, cloud database, ELB, cloud server, etc.

[0075] For example, the configuration information of cloud resources within the first VPC can be as shown in Table 1, where each row in Table 1 is the configuration information of a cloud resource within the first VPC. The first column in Table 1 is the IP address of each cloud resource, the second column is the resource identifier of each cloud resource, and the third column is the type of the cloud resource. The IP address of the cloud resource with resource identifier ID5 is a virtual IP (VIP) address. When the cloud resource type is system interface, it indicates that the corresponding cloud resource is a physical host. When the cloud resource type is dynamic host configuration protocol (DHCP), it indicates that the corresponding cloud resource is used for dynamic allocation of IP addresses and configuration information.

[0076] Table 1 Configuration information of cloud resources in the first VPC network

[0077] Table 1 above is an example of configuration information given in an embodiment of the present application. It is understandable that the configuration information of cloud resources may include more information than Table 1 above. For example, taking the first cloud resource as an example, the configuration information of the first cloud resource may also include the connection relationship between the first cloud resource and other cloud resources. For example, when the first cloud resource is a cloud server, the configuration information of the cloud server may also include information about the cloud hard disk bound to the cloud server, thereby indicating that the cloud server has a connection relationship with the cloud hard disk. If the cloud server is also bound to an EIP, the configuration information of the cloud server may also include information about the EIP bound to the cloud server, thereby indicating that the cloud server has a connection relationship with the EIP. Optionally, the configuration information of any cloud resource may also include the network identifier of the VPC to which the cloud resource belongs, the regional identifier of the region to which it belongs, and so on.

[0078] After obtaining the configuration information of at least one cloud resource including the first cloud resource in the first VPC, the cloud management platform may also obtain the configuration information of public network resources associated with these cloud resources based on the configuration information of the at least one cloud resource in the first VPC.

[0079] It should be noted that when building a VPC, the tenant can configure public network resources for the VPC, such as EIP, public network address translation (NAT), etc. Among them, the public network resources can be bound to the cloud server or ELB within the VPC. The cloud management platform can store the tenant's configuration information for the public network resources in the cloud resource information server. Among them, the configuration information of the public network resources may include the IP address of the public network resource, the IP address and / or resource identifier of the cloud resource within the VPC to which the public network resource is bound. Based on this, in an embodiment of the present application, the cloud management platform can also query the configuration information of the public network resources bound to the cloud resources within the first VPC from the cloud resource information server based on the IP address and / or resource identifier of the cloud resource of the type of cloud server and / or ELB within the first VPC.

[0080] For example, if the cloud resources within the first VPC include a sixth cloud resource, which is the ELB shown in Table 1, the cloud management platform can query the configuration information of the public network resources associated with the ELB, as shown in Figure 3, based on the resource identifier of the ELB shown in Table 1. As shown in Figure 3, the ELB is associated with an EIP, which is 139.159.202.120. Furthermore, the configuration information of the EIP also includes the bandwidth size of the EIP and the protocol type used, such as the dynamic Border Gateway Protocol (BGP). Therefore, the configuration information of the EIP can indicate that the EIP is connected to the ELB.

[0081] Optionally, after obtaining the public network resources associated with the cloud resources within the first VPC, the cloud management platform can further determine the other public network resources associated with these public network resources based on the obtained configuration information of the public network resources, as these public network resources may also be bound to other public network resources. For example, the EIP shown in Figure 3 may also correspond to a domain name address, and the domain name address may also be bound to a website application firewall (WAF). Based on this, as shown in Figure 3, the EIP configuration information may also include the domain name address corresponding to the EIP: aaa.bbb.com. After querying the domain name address corresponding to the EIP, the cloud management platform can further obtain the configuration information of the WAF corresponding to the domain name address, as shown in Figure 4. The WAF corresponding to the domain name address is identified as ID10, the operating mode is protection enabled, and the access status is connected. Thus, the configuration information of a public network resource can further indicate the connection relationship between the public network resource and other public network resources.

[0082] The above mainly introduces the implementation process of the cloud management platform obtaining the configuration information of at least one cloud resource including the first cloud resource and the associated public network resources in the first VPC when the architecture diagram generation request carries the network identifier of the first VPC.

[0083] In a second possible implementation, if the architecture diagram generation request carries other indicative information of the first VPC instead of the network identifier of the first VPC, for example, if the indicative information is a domain name address that can indicate the first VPC, the cloud management platform can obtain the configuration information of the EIP corresponding to the domain name address based on the domain name address. Subsequently, based on the EIP configuration information, the cloud resource within the first VPC bound to the EIP, such as a cloud server or ELB, is determined. Furthermore, based on the resource identifier or IP address of the cloud server or ELB, the cloud management platform obtains the configuration information of other cloud resources within the first VPC, including the cloud server or ELB. In this way, the cloud management platform can obtain the configuration information of multiple cloud resources within the first VPC, including the first cloud resource, as well as the configuration information of public network resources associated with the cloud resources within the first VPC. For the relevant implementation principles, please refer to the relevant description of the first possible implementation above.

[0084] As can be seen, the difference between this implementation and the first implementation is that, in this implementation, the configuration information of the public network resources associated with the first VPC and the cloud resources within the first VPC are gradually obtained based on the association relationship contained in the configuration information, starting from the domain name address, while in the first implementation, the configuration information of the cloud resources within the first VPC and the configuration information of the associated public network resources are gradually obtained based on the first VPC. Based on this, when the first VPC indication information carried in the architecture diagram generation request is the resource identifier of a cloud resource in the first VPC, such as the resource identifier of a first cloud resource, the cloud management platform can also determine the network identifier of the first VPC to which the first cloud resource belongs based on the resource identifier of the first cloud resource, and then, based on the network identifier of the first VPC, obtain the configuration information of multiple cloud resources within the first VPC, including the first cloud resource, as well as the configuration information of the public network resources associated with the cloud resources within the first VPC. That is, in this case, the configuration information is used to obtain the configuration information of the cloud resources within the first VPC and the configuration information of the associated public network resources, starting from the first cloud resource within the first VPC.

[0085] After receiving the architecture diagram generation request, the cloud management platform may also obtain the network traffic log of the first cloud resource based on the indication information of the first VPC carried in the architecture diagram generation request.

[0086] For example, the cloud management platform can obtain network traffic logs of at least one cloud resource, including the first cloud resource, within the first VPC based on the indication information of the first VPC. The network traffic logs of any cloud resource can indicate the data packet transmission status between the cloud resource and other cloud resources.

[0087] It's important to note that, as discussed above, cloud resource configuration information may include statically configured connections between cloud resources. However, cloud resources may also have other relationships beyond statically configured connections, such as dynamic connections between cloud resources. Dynamic connections between different cloud resources may also reveal other hidden connections between cloud resources. Therefore, cloud management platforms can combine cloud resource configuration information with network traffic logs to uncover connection relationships between cloud resources.

[0088] As an example, the cloud management platform can provide tenants with a VPC flow log service, and the tenants can choose whether to enable the VPC flow log service. The VPC flow log service can be used to generate a flow log for the VPC to record the data packet transmission of the cloud resources within the VPC. Based on this, in an embodiment of the present application, the tenant can pre-enable the flow log service of the first VPC. In response to the tenant's flow log service activation operation, the tenant terminal can send a flow log creation request to the cloud management platform, and the flow log creation request carries the network identifier of the first VPC. After receiving the flow log creation request, the cloud management platform can create a log group in the cloud log server and create a flow log for the first VPC in the log group. Afterwards, based on the captured information of the data packets of the cloud resources passing through the first VPC, a log record indicating the existence of data packet transmission between cloud resources is generated in the flow log, wherein each log record can include detailed information on the data packet transmission.

[0089] Based on this, after receiving the architecture diagram generation request, the cloud management platform can obtain the flow log of the first VPC from the cloud log server based on the indication information of the first VPC, wherein the flow log includes at least one log record indicating that there is data packet transmission between the cloud resources within the first VPC and other cloud resources. Accordingly, the network traffic log of the cloud resource includes the at least one log record.

[0090] For example, if the architecture diagram generation request carries the network identifier of the first VPC, the cloud management platform can directly obtain the corresponding flow log from the cloud log server based on the network identifier of the first VPC.

[0091] If the architecture diagram generation request carries other indication information of the first VPC, for example, a domain name address associated with the first VPC, the cloud management platform can, in the process of obtaining the configuration information of the cloud resources through the second implementation method described above, determine the information of the cloud resources in the associated first VPC based on the configuration information of the EIP corresponding to the domain name address, and then determine the network identifier of the first VPC based on the information of the cloud resources. Then, based on the network identifier of the first VPC, obtain the corresponding flow log from the cloud log server.

[0092] It should be noted that the log records in the flow log can include the flow log version number, project identifier, interface identifier, source address, destination address, source port identifier, destination port identifier, protocol type, number of data packets, data packet size, start time, end time, action and log status in sequence.

[0093] The project ID of the log record can be the network ID of the VPC. Of course, if the tenant creates a flow log for a specific region or a switch or elastic network interface card in the VPC, the project ID of the log record in the flow log can be the ID of the corresponding region, switch, or elastic network interface card.

[0094] The interface identifier is used to indicate the interface that captured the log record. For example, if the log record comes from the first elastic network card in the first VPC, the interface identifier in the log record can be the identifier of the first elastic network card.

[0095] The source address and source port identifier can be the IP address of the sender of the data message recorded in the log record and the identifier of the corresponding sending port. The source address can be a real IP address or a virtual IP address. The destination address and destination port identifier can be the IP address of the receiver of the data message recorded in the log record and the identifier of the corresponding receiving port. The destination address can also be a real IP address or a virtual IP address.

[0096] The protocol type is the network protocol used for datagram transmission, for example, it may be the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), etc.

[0097] The number of data packets and the size of data packets are used to indicate the number of data packets and the size of data packets respectively included in the data message transmission recorded in the log record.

[0098] The start time and the end time are respectively used to indicate the start time and the end time of capturing the information recorded by the log record.

[0099] The action is used to indicate whether the data packet transmission is allowed by the security group and the network access control list (ACL).

[0100] After obtaining the flow log of the first VPC, the cloud management platform can parse each log record in the flow log based on the log record format introduced above, so as to obtain the information contained in each log record. In this way, by parsing multiple log records in the flow log, the cloud management platform can obtain the network traffic log of at least one cloud resource in the first VPC, including the first cloud resource.

[0101] Optionally, in some embodiments, before obtaining the flow logs of the first VPC from the cloud log server based on the indication information of the first VPC, the cloud management platform may also send permission request information to the tenant terminal of the tenant corresponding to the first VPC, requesting permission from the tenant to obtain the flow logs of the first VPC. After receiving the permission request information, the tenant terminal may display the permission request information and corresponding options for approving and disapproving authorization on the cloud service client interface. If the tenant agrees to the cloud management platform obtaining the flow logs of the first VPC, the tenant may click the option for approving authorization, triggering the tenant terminal to return a notification message of approval to the cloud management platform. After receiving the notification message of approving authorization, the cloud management platform may obtain the flow logs of the first VPC. If the tenant disagrees with the cloud management platform obtaining the flow logs of the first VPC, the tenant may click the option for disapproving authorization, triggering the tenant terminal to return a notification message of disapproval to the cloud management platform. In this case, the cloud management platform does not obtain the flow logs of the first VPC.

[0102] Step 202: Generate a cloud resource architecture diagram based on the configuration information of the first cloud resource and the network traffic log.

[0103] After obtaining configuration information and network traffic logs of at least one cloud resource including the first cloud resource in the first VPC, the cloud management platform may generate a cloud resource architecture diagram based on the obtained configuration information and network traffic logs.

[0104] In some embodiments, the configuration information of a cloud resource may include information about other cloud resources associated with the cloud resource. For example, taking the fourth cloud resource in the first VPC as an example, if the configuration information of the fourth cloud resource also includes information about a fifth cloud resource associated with the fourth cloud resource, the cloud management platform can determine that the fourth cloud resource has a connection relationship with the fifth cloud resource.

[0105] For example, the fourth cloud resource is a cloud server, and the configuration information of the fourth cloud resource includes information of two bound cloud hard disks. Based on the configuration information, the cloud management platform can determine that the fourth cloud resource has a connection relationship with the two cloud hard disks.

[0106] In some embodiments, the cloud management platform may also obtain configuration information of a public network resource associated with at least one cloud resource within the first VPC. The configuration information of the public network resource may include the cloud resource within the first VPC to which the public network resource is bound. Based on this, taking the cloud resource within the first VPC to which the public network resource is bound as the sixth cloud resource as an example, the cloud management platform may further determine that the sixth cloud resource has a connection relationship with the public network resource based on the binding information between the public network resource and the sixth cloud resource included in the configuration information of the public network resource.

[0107] For example, as shown in FIG3 , the configuration information of the EIP indicates that the EIP is bound to the ELB identified as ID3 , and it can be determined that there is a connection relationship between the EIP and the ELB.

[0108] In some embodiments, the network traffic logs of the cloud resources in the first VPC may indicate that data packets are transmitted between the cloud resource and other cloud resources. Based on this, the cloud management platform may also determine the connection relationship between the cloud resources based on the network traffic logs of the cloud resources in the first VPC.

[0109] For example, each log record in the flow log of the first VPC includes the source address and destination address of a data packet transmission. Based on this, the cloud management platform can determine the connection relationship between two cloud resources based on the source address and destination address of the data packet transmission recorded in each log record.

[0110] Taking a log record in the flow log of the first VPC as an example, this log record is referred to as the first record. The cloud management platform can determine that there is a connection relationship between the first cloud resource and the second cloud resource based on the source address and destination address in the first record, where the source address in the first record is the IP address of the first cloud resource and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource and the destination address in the first record is the IP address of the first cloud resource.

[0111] As can be seen from the above introduction, the source address in the log record is the address of the sender of the data message, while the destination address is the address of the receiver of the data message. Therefore, if the source address in the first record is the IP address of the first cloud resource and the destination address is the IP address of the second cloud resource, then based on the first record, it can be determined that the first cloud resource transmitted the data message to the second cloud resource, that is, there is a connection relationship between the first cloud resource and the second cloud resource. Similarly, if the source address in the first record is the IP address of the second cloud resource and the destination address is the IP address of the first cloud resource, then based on the first record, it can be determined that the second cloud resource transmitted the data message to the first cloud resource, that is, there is a connection relationship between the first cloud resource and the second cloud resource.

[0112] It should be noted that the second cloud resource can be a cloud resource within the first VPC or a cloud resource within the second VPC. In the case where the second cloud resource is a cloud resource within the second VPC, if the second VPC and the first VPC are VPCs built by the same tenant, the cloud management platform can also use the IP address of the second cloud resource as the indication information of the second VPC, and based on the indication information of the second VPC, refer to the method introduced in the aforementioned step 201 to obtain the configuration information and network traffic logs of the cloud resources within the second VPC, and then obtain the connection relationship of the cloud resources within the second VPC through the configuration information and network traffic logs of the cloud resources within the second VPC. It can be seen that the flow log of the first VPC can not only determine the connection relationship between cloud resources within the same VPC, but also determine the connection relationship between cloud resources across VPCs.

[0113] Optionally, the log records in the flow log of the first VPC may also include a source port identifier and a destination port identifier. On this basis, the cloud management platform may also determine the connection relationship between the two ports on the two cloud resources based on the source port identifier and the destination port identifier in the log records.

[0114] Still taking the first record as an example, the cloud management platform can also determine that there is a connection relationship between the first port on the first cloud resource and the second port on the second cloud resource based on the source port identifier and the destination port identifier in the first record.

[0115] As can be seen from the above introduction, the source port identifier in the log record is the port on the sender of the data packet indicated by the source address that sends the data packet, and the destination port identifier is the port on the receiver indicated by the destination address that receives the data packet. Based on this, if the source address in the first record is the IP address of the first cloud resource, then the source port identifier in the first record is the identifier of the port on the first cloud resource that sends the data packet to the second cloud resource, and the destination port identifier in the first record is the identifier of the port on the second cloud resource that receives the data packet sent by the first cloud resource. In this case, based on the first record, it can be determined that there is a connection relationship between the first port on the first cloud resource identified by the source port identifier and the second port on the second cloud resource identified by the destination port identifier.

[0116] Optionally, if the source address in the first record is the IP address of the second cloud resource, the source port identifier in the first record is the identifier of the port on the second cloud resource that sends data packets to the first cloud resource, and the destination port identifier in the first record is the identifier of the port on the first cloud resource used to receive data packets sent by the second cloud resource. In this case, based on the first record, it can be determined that there is a connection relationship between the second port on the second cloud resource identified by the source port identifier and the first port on the first cloud resource identified by the destination port identifier.

[0117] For example, if both the first cloud resource and the second cloud resource are ECS instances, different applications deployed on the ECS instances may communicate through different ports. Based on this, the cloud management platform can also determine which two ports on the two ECS instances are connected based on the first record, that is, which two ports have established a communication link.

[0118] Alternatively, if the source or destination address in the first record is a virtual IP address, then since the virtual IP address can be bound to at least one instance, it will correspond to at least one real IP address. Based on this, the cloud management platform can also determine from the flow log of the first VPC a second record indicating the same data packet transmission as the first record, and determine the cloud resource bound to the virtual IP address in the first record based on the second record.

[0119] For example, if the source address in the first record is the IP address of the second cloud resource, and if the source address in the first record is the first virtual IP address, the cloud management platform can search the flow logs of the first VPC for a second record whose destination address, destination port identifier, protocol type, number of packets, packet size, start time, and end time are all the same as the first record, and whose source address is a real IP address. The cloud management platform can then determine, based on the first and second records, that the first virtual IP address is the virtual IP address bound to the third cloud resource indicated by the source address in the second record.

[0120] Since the destination address, destination port, protocol type, number of packets, packet size, start time, and end time in the second and first records are identical, this indicates that both records record the same datagram transmission to the first cloud resource. In this case, the source addresses in both the first and second records refer to the address of the sender of this datagram transmission. Based on this, the first virtual IP address in the first record is the virtual IP address of the sender of the datagram, while the source address in the second record is the real IP address of the sender of the datagram. Therefore, the source address in the second record is the real IP address of the instance bound to the first virtual IP address. In other words, the first virtual IP address is the virtual IP address bound to the third cloud resource indicated by the source address in the second record. This allows the cloud management platform to determine that the third cloud resource and the second cloud resource represented by the first virtual IP address are connected.

[0121] Alternatively, taking the example of a first record where the destination address is the IP address of a second cloud resource, if the destination address in the first record is a first virtual IP address, the cloud management platform can search the flow logs of the first VPC for a second record whose source address, source port identifier, protocol type, number of packets, packet size, start time, and end time are all the same as those of the first record and whose destination address is a real IP address. The cloud management platform can then determine, based on the first and second records, that the first virtual IP address is the virtual IP address bound to the third cloud resource indicated by the destination address in the second record.

[0122] Furthermore, if the cloud service types of the third cloud resource and the second cloud resource indicated by the first virtual IP address are both cloud databases, and the cloud management platform can further determine the network deployment relationship of the cloud resources, that is, the cloud database is deployed on the instance of the third cloud resource.

[0123] Optionally, if the third cloud resource is a cloud resource within the first VPC, and the configuration information for the cloud resources within the first VPC also includes a seventh cloud resource of type cloud database, and the IP address of the seventh cloud resource is a real IP address, the cloud management platform can further determine that the first virtual IP address is also the virtual IP address bound to the seventh cloud resource. Furthermore, the cloud management platform can further determine that the cloud database is deployed on two instances, the third cloud resource and the seventh cloud resource, where the third cloud resource is the current primary instance and the seventh cloud resource is the current backup instance.

[0124] The above is an example of determining the association relationship between cloud resources based on the network traffic logs of cloud resources, given in an embodiment of the present application. In some possible scenarios, the cloud management platform can also obtain other cloud resource deployment relationships based on the network traffic logs of cloud resources within the first VPC. For example, the cloud management platform can also determine the deployment location of hidden switches in the first VPC based on the source address, destination address, and interface identifier in each log record, and determine which cloud resources in the first VPC belong to the same security group based on the source address, destination address, and action in each log record.

[0125] After determining the connection relationship between cloud resources through configuration information and network traffic logs, the cloud management platform can generate a cloud resource architecture diagram based on the determined connection relationship between cloud resources and the obtained configuration information of cloud resources and public network resources. The cloud resource architecture diagram includes the connection relationship between the above-mentioned cloud resources.

[0126] Exemplarily, the cloud management platform can first draw cloud resource nodes representing corresponding cloud resources based on the configuration information of cloud resources within the first VPC obtained, and draw cloud resource nodes corresponding to public network resources based on the configuration information of public network resources associated with the first VPC, thereby obtaining a resource node graph, wherein each cloud resource node can correspond to a resource identifier and / or IP address of a cloud resource or public network resource.

[0127] It should be noted that the cloud management platform can determine the initial layout of cloud resource nodes corresponding to each cloud resource based on the type of cloud resources within the first VPC, and determine the initial layout of cloud resource nodes corresponding to the public network resources based on the association relationship between the public network resources and other resources contained in the configuration information of the public network resources, thereby drawing a resource node diagram based on the initial layout.

[0128] For example, referring to Figure 5, ELB instances are used to achieve load balancing and are usually associated with ECS instances in VPC scenarios. Therefore, in the resource node diagram, the ELB node representing the ELB instance can be close to the ECS1 node representing the ECS1 instance and the ECS2 node representing the ECS2 instance. Multiple ECS instances are usually used as computing resources, so the ECS1 node and the ECS2 node are placed side by side. For another example, the cloud database is used as a data storage service, and the ECS instance may access the cloud database more frequently. Therefore, the relational database service (RDS) node A representing the cloud database resource A, the RDS node B representing the cloud database resource B, and the RDS node C representing the cloud database resource C can be close to the ECS1 node and the ECS2 node. Finally, based on the configuration information of public network resources, we can determine the connection relationship between the EIP and the ELB instance, the connection relationship between the domain name address and the EIP, and the connection relationship between the domain name address aaa.bbb.com and the WAF. Therefore, the EIP node representing the EIP can be close to the ELB node, the domain name address aaa.bbb.com is close to the EIP node, and the WAF node representing the WAF is close to the domain name address and the EIP node. Furthermore, as shown in Figure 5, each cloud resource node can also correspond to the IP address of the corresponding cloud resource.

[0129] Optionally, if the connection relationship between cloud resources determined through the network traffic log of cloud resources includes the connection relationship between cloud resources within the first VPC and cloud resources within other VPCs, the cloud management platform can also add cloud resource nodes representing cloud resources within other VPCs in the resource node graph based on the connection relationship between cloud resources within the first VPC and cloud resources within other VPCs.

[0130] Optionally, when drawing the resource node diagram, the cloud management platform may also represent corresponding cloud resource nodes through corresponding cloud resource legends according to the types of cloud resources.

[0131] After obtaining the resource node graph, the cloud management platform may connect the cloud resource nodes corresponding to the cloud resources having a connection relationship based on the connection relationship between the cloud resources determined above.

[0132] For example, still using Figure 5 as an example, the cloud management platform can determine, based on the cloud resource configuration information, that the EIP is bound to the ELB instance, that the EIP is associated with the domain name aaa.bbb.com, and that the domain name is associated with the WAF. Therefore, a connection line can be used to connect the EIP node to the ELB node, the EIP node to domain name A, and domain name A to the WAF. Furthermore, based on the flow logs within the first VPC, it can be determined that the ELB instance has a connection relationship with the ECS1 instance and the ECS2 instance, respectively. Therefore, based on this connection relationship, the ELB node can be connected to the ECS1 node, and the ELB node can be connected to the ECS2 node. In addition, based on the flow logs of the first VPC, it can be determined that the ECS1 and ECS2 instances are connected to cloud database resource A, and that both ECS1 and ECS2 instances are connected to cloud database resource B. Since the IP address of cloud database resource A is a virtual IP address, while the IP addresses of cloud database resource B and cloud database resource C are real IP addresses, it can be determined that cloud database resource A is the virtual IP address bound to cloud database resource B and cloud database resource C, and that the cloud database is distributed across cloud database resource B and cloud database resource C. Furthermore, cloud database resource B is the current primary instance, and cloud database resource C is the current backup instance. Based on this, the cloud management platform can connect both the ECS1 and ECS2 nodes to RDS node A, and connect RDS node A to RDS node B and RDS node C, respectively, and mark RDS node B as the primary node and RDS node C as the backup node in the diagram. Furthermore, the cloud management platform can also mark the cloud resources within the first VPC with the network identifier VPC1 of the first VPC. In this way, the cloud management platform obtains a cloud resource architecture diagram including the connection relationships between multiple cloud resources.

[0133] In some embodiments, after obtaining the configuration information of the cloud resources within the first VPC and the configuration information of the associated public network resources, the cloud management platform may first generate a resource node graph based on the obtained configuration information using the method introduced above. Thereafter, the connection relationship between the cloud resources is determined based on the obtained configuration information and the network traffic log of the cloud resources within the first VPC, and the cloud resource nodes in the resource node graph are connected according to the connection relationship between the cloud resources, thereby obtaining a cloud resource architecture diagram including the connection relationship between multiple cloud resources.

[0134] In other embodiments, the cloud management platform may also first generate a request based on the architecture diagram to obtain the configuration information and network traffic logs of the first cloud resource in the first VPC, and then determine the connection relationship between the first cloud resource and other cloud resources based on the configuration information and network traffic logs of the first cloud resource, and then draw the connection lines between the corresponding cloud resources and cloud resource nodes in the cloud resource architecture diagram based on the connection relationship. Afterwards, the cloud management platform may obtain the configuration information and network traffic logs of other cloud resources that have a connection relationship with the first cloud resource, and then draw the possible connection relationships between other cloud resources in the cloud resource architecture diagram. In this way, new connection relationships are continuously obtained through the connection relationships between the determined cloud resources, so as to draw the cloud resource architecture diagram. Among them, the implementation process of determining the connection relationship between the cloud resource and other cloud resources based on the configuration information and network traffic logs of any cloud resource can be referred to the previous introduction and will not be repeated here.

[0135] After generating the cloud resource architecture diagram, the cloud management platform may send the cloud resource architecture diagram to the tenant terminal. Accordingly, the tenant terminal may display the cloud resource architecture diagram on the resource architecture diagram display page of the cloud service client.

[0136] Optionally, the cloud management platform can also store the cloud resource architecture diagram. For example, if the architecture diagram generation request sent by the tenant carries the network identifier of the first VPC, the cloud management platform can store the cloud resource architecture diagram in association with the network identifier of the first VPC. In this way, if the cloud management platform subsequently receives another architecture diagram generation request from the tenant carrying the network identifier of the first VPC, it can directly obtain the cloud resource architecture diagram based on the architecture diagram generation request and return the cloud resource architecture diagram to the tenant terminal.

[0137] Optionally, after the cloud resource architecture diagram is stored, if the cloud resources in the cloud resource architecture diagram change, the cloud management platform may also update the cloud resource architecture diagram according to the changes in the cloud resources.

[0138] For example, a cloud data center can provide tenants with a cloud audit service. This service can record operational activities of various resources within the cloud environment. For example, it can record changes such as deletions, additions, and modifications to various cloud resources within a VPC, such as ECS instances and cloud databases. Based on this information, the cloud management platform can obtain cloud audit information for the first VPC and, based on this information, update the cloud resource architecture diagram. This cloud audit information can include at least one item of cloud resource change information.

[0139] In some embodiments, the cloud management platform may obtain cloud audit information of the first VPC at a preset time interval and then update the cloud resource architecture diagram based on the cloud audit information. The cloud audit information may include one or more cloud resource change information within the preset time interval.

[0140] In other embodiments, after each record of cloud resource change information for the first VPC, the cloud audit service may proactively send a resource change notification to the cloud management platform. The resource change notification may include the network identifier of the first VPC and the cloud resource change information recorded by the cloud audit service. After receiving the resource change notification, the cloud management platform may obtain the corresponding cloud resource architecture diagram based on the network identifier of the first VPC and then update the cloud resource architecture diagram based on the cloud resource change information in the resource change notification.

[0141] In addition, based on the different cloud resource change information obtained in the cloud audit information, the cloud management platform can update the cloud resource architecture diagram in different ways.

[0142] Exemplarily, if the cloud audit information includes cloud resource addition information, the cloud management platform can add the connection relationship between the newly added cloud resource and other cloud resources in the cloud resource architecture diagram based on the cloud resource addition information. For example, if the cloud resource addition information includes information on adding a certain cloud resource in the cloud resource architecture diagram, the cloud management platform can obtain the configuration information of the added cloud resource, and then add the cloud resource node corresponding to the cloud resource in the cloud resource architecture diagram based on the configuration information of the cloud resource. If the configuration information of the cloud resource also includes the connection relationship between the cloud resource and other cloud resources, the cloud management platform can also add the connection relationship between the cloud resource and other cloud resources in the cloud resource architecture diagram. In addition, the cloud management platform can also obtain the network traffic log of the cloud resource, and add the connection relationship between the cloud resource and other cloud resources in the cloud resource architecture diagram based on the network traffic log of the cloud resource. The relevant implementation method can refer to the introduction in the previous article and will not be repeated here.

[0143] If the cloud audit information includes cloud resource deletion information, the cloud management platform can delete the corresponding cloud resource in the cloud resource architecture diagram and the connection relationship between the cloud resource and other cloud resources based on the cloud resource deletion information. For example, the cloud resource deletion information may include information about deleting a cloud resource in the cloud resource architecture diagram. The cloud management platform can then delete the cloud resource node used to represent the cloud resource in the cloud resource architecture diagram, and at the same time delete the connection relationship between the cloud resource node and other cloud resource nodes. After the deletion is completed, the cloud management platform can also mine the connection relationship by re-acquiring the network traffic logs of each cloud resource in the cloud resource architecture diagram, so as to supplement the new connection relationship that may appear between the remaining cloud resources after deleting the cloud resource.

[0144] If the cloud audit information includes cloud resource modification information, the cloud management platform can modify the corresponding cloud resource information in the cloud resource architecture diagram based on the cloud resource modification information. For example, the cloud resource modification information may include information about modifying the connection relationship of a cloud resource already in the current cloud resource architecture diagram. The cloud management platform can then modify the connection relationship of the cloud resource in the cloud resource architecture diagram based on the cloud resource modification information.

[0145] Optionally, in some embodiments, when the cloud resource architecture diagram includes the connection relationships between cloud resources in different VPCs, the cloud management platform can obtain cloud audit information for each VPC and, referring to the method described above, update the cloud resource architecture diagram based on the cloud audit information for each VPC. Alternatively, the cloud management platform can obtain cloud audit information containing change information of the corresponding cloud resource for each cloud resource included in the cloud resource architecture diagram, and then, referring to the method described above, update the cloud resource architecture diagram based on the obtained cloud audit information.

[0146] In an embodiment of the present application, in response to a tenant's architecture diagram generation request, the cloud management platform can obtain the configuration information of the first cloud resource and the network traffic log of the first cloud resource, and automatically generate a cloud resource architecture diagram containing the connection relationship between the first cloud resource and other cloud resources based on the configuration information and network traffic log of the first cloud resource. There is no need for the tenant to draw the diagram manually, the operation is simple, and the availability is high.

[0147] In addition, in an embodiment of the present application, the connection relationship between the first cloud resource and other cloud resources can be obtained through the flow log of the VPC associated with the first cloud resource. There is no need to install invasive components, the performance of the node where the cloud resource is located is not affected, and the availability is higher and the cost is lower.

[0148] Finally, because VPC flow logs record the data packet transmission of all cloud resources within the VPC, they can capture a wider range of connection relationships than methods that obtain interface call relationships by installing invasive components. Consequently, the connection relationships in VPC flow logs can generate cloud resource architecture diagrams with wider coverage and more complete information.

[0149] Next, the cloud management platform provided in the embodiment of the present application is introduced.

[0150] FIG6 is a schematic structural diagram of a cloud management platform provided in an embodiment of the present application. Referring to FIG6 , the cloud management platform 600 may include: a resource information acquisition module 61 and an architecture diagram generation module 62 .

[0151] The resource information acquisition module 61 may be used to execute step 201 in the aforementioned embodiment, and the architecture diagram generation module 62 may be used to execute step 202 in the aforementioned embodiment.

[0152] Exemplarily, referring to FIG6 , the resource information acquisition module 61 may include a flow log acquisition unit 611. The flow log acquisition unit 611 may be used to acquire the flow log of the VPC associated with the first cloud resource, the flow log including a first record indicating the existence of data packet transmission between the first cloud resource and the second cloud resource, the first record including the source address and destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource. Specifically, referring to FIG6 , the flow log may be stored on a cloud log server that provides an object storage service (OBS), and the flow log acquisition unit 611 may acquire the flow log of the VPC associated with the first cloud resource from the cloud log server.

[0153] Optionally, the resource information acquisition module 61 may further include a resource configuration information acquisition unit 612, which is configured to: acquire configuration information of the first cloud resource. Optionally, the resource configuration information acquisition unit 612 may further be configured to acquire configuration information of a fourth cloud resource, wherein the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource. Accordingly, the architecture diagram generation module 62 may further be configured to generate a cloud resource architecture diagram using the configuration information of the fourth cloud resource, wherein the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship. Optionally, the resource configuration information acquisition unit 612 may further be configured to acquire configuration information of a sixth cloud resource, and based on the configuration information of the sixth cloud resource, acquire configuration information of a public network resource associated with the sixth cloud resource, wherein the configuration information of the public network resource may include the connection relationship between the sixth cloud resource and the public network resource. Accordingly, the architecture diagram generation module 62 is further configured to generate a cloud resource architecture diagram using the configuration information of the sixth cloud resource and the configuration information of the associated public network resource, wherein the cloud resource architecture diagram also includes the connection relationship between the sixth cloud resource and the public network resource. For example, referring to FIG6 , the configuration information of the cloud resource can be stored in a cloud resource information server, and the resource configuration information acquisition unit 612 can obtain the configuration information of the first cloud resource and the configuration information of the public network resource associated with the first cloud resource from the cloud resource information server.

[0154] Optionally, the above-mentioned first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

[0155] Optionally, the IP address of the second cloud resource is the first virtual IP address, and the flow log of the VPC associated with the first cloud resource also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

[0156] Optionally, the configuration information of the first cloud resource also includes a connection relationship between the first cloud resource and the fourth cloud resource. The first cloud resource and the fourth cloud resource in the cloud resource architecture diagram have a connection relationship.

[0157] Optionally, the cloud management platform 600 further includes a cloud audit information acquisition module 63 and an architecture diagram update module 64. The cloud audit information acquisition module 63 is configured to acquire cloud audit information for the VPC associated with the first cloud resource unit, including at least one of cloud resource addition information, cloud resource deletion information, and cloud resource modification information within the VPC. The architecture diagram update module 64 is configured to add corresponding cloud resources to the cloud resource architecture diagram based on the cloud resource addition information; or, based on the cloud resource deletion information, delete corresponding cloud resources from the cloud resource architecture diagram; or, based on the cloud resource modification information, modify corresponding cloud resources from the cloud resource architecture diagram. For example, referring to FIG6 , the cloud audit information acquisition module 63 can acquire cloud audit information for the VPC associated with the first cloud resource unit from the cloud audit service.

[0158] In an embodiment of the present application, in response to a tenant's request to generate an architecture diagram, the cloud management platform can obtain the configuration information of a first cloud resource and its network traffic logs. Based on this first cloud resource's configuration information and network traffic logs, the cloud resource architecture diagram is automatically generated, eliminating the need for the tenant to manually draw the diagram. This approach simplifies operations and improves usability. Furthermore, since the connection relationship between the first cloud resource and other cloud resources can be obtained through the flow logs of the VPC associated with the first cloud resource, there is no need to install invasive components, resulting in lower costs.

[0159] The present application also provides a computing device 700. As shown in FIG7 , computing device 700 includes a bus 702, a processor 704, a memory 706, and a communication interface 708. Processor 704, memory 706, and communication interface 708 communicate with each other via bus 702. Computing device 700 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 700.

[0160] Bus 702 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG7 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 702 may include a path for transmitting information between various components of computing device 700 (e.g., memory 706, processor 704, and communication interface 708).

[0161] The processor 704 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0162] The memory 706 may include volatile memory, such as random access memory (RAM). The processor 704 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0163] Memory 706 stores executable program code, and processor 704 executes the executable program code to implement the functions of the aforementioned resource information acquisition module and architecture diagram generation module, thereby implementing the cloud resource architecture diagram generation method. In other words, memory 706 stores instructions for executing the cloud resource architecture diagram generation method.

[0164] Alternatively, the memory 706 stores executable code, and the processor 704 executes the executable code to respectively implement the functions of the aforementioned cloud management platform, thereby implementing the cloud resource architecture diagram generation method. That is, the memory 706 stores instructions for executing the cloud resource architecture diagram generation method.

[0165] The communication interface 708 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or a communication network.

[0166] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0167] As shown in Figure 8, the computing device cluster includes at least one computing device 700. The memory 706 in one or more computing devices 700 in the computing device cluster may store the same instructions for executing the cloud resource architecture diagram generation method.

[0168] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store partial instructions for executing the cloud resource architecture diagram generation method. In other words, the combination of one or more computing devices 700 can jointly execute instructions for implementing the cloud resource architecture diagram generation method.

[0169] It should be noted that the memory 706 in different computing devices 700 in the computing device cluster can store different instructions, each for executing a portion of the functions of the cloud management platform. In other words, the instructions stored in the memory 706 in different computing devices 700 can implement the functions of one or more modules of the resource information acquisition module and the architecture diagram generation module.

[0170] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network or a local area network, etc. FIG. 9 shows a possible implementation. As shown in FIG. 9 , two computing devices 700A and 100B are connected via a network. Specifically, the connection to the network is made through a communication interface in each computing device. In this type of possible implementation, the memory 706 in the computing device 700A stores instructions for executing the functions of a resource information acquisition module and an architecture diagram generation module. At the same time, the memory 706 in the computing device 700B stores instructions for executing the functions of a cloud audit information acquisition module and an architecture diagram update module.

[0171] The connection method between the computing device clusters shown in Figure 9 can be that considering that the cloud resource architecture diagram generation method provided in the embodiment of the present application requires resource information acquisition and architecture diagram generation instances, it is considered to entrust the functions implemented by the resource information acquisition module and the architecture diagram generation module to the computing device 700A for execution.

[0172] It should be understood that the functionality of the computing device 700A shown in FIG9 may also be implemented by multiple computing devices 700. Similarly, the functionality of the computing device 700B may also be implemented by multiple computing devices 700.

[0173] The present application also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to the connection method of the computing device cluster described in Figures 8 and 9. The difference is that the memory 706 of one or more computing devices 700 in the computing device cluster can store the same instructions for executing the cloud resource architecture diagram generation method.

[0174] In some possible implementations, the memory 706 of one or more computing devices 700 in the computing device cluster may also store partial instructions for executing the cloud resource architecture diagram generation method. In other words, the combination of one or more computing devices 700 can jointly execute the instructions for executing the cloud resource architecture diagram generation method.

[0175] It should be noted that the memory 706 in different computing devices 700 in the computing device cluster can store different instructions for executing partial functions of the cloud resource architecture diagram generation system. In other words, the instructions stored in the memory 706 in different computing devices 700 can implement the functions of one or more devices of the cloud management platform and infrastructure.

[0176] Embodiments of the present application also provide a computer program product including instructions. This computer program product may be software or a program product including instructions that can be executed on a computing device or stored in any available medium. When the computer program product is executed on at least one computing device, it causes the at least one computing device to execute a method for generating a cloud resource architecture diagram.

[0177] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device, or a data storage device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the cloud resource architecture diagram generation method.

[0178] In the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other. The technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the textual description of the embodiments of the present application, the character " / " generally indicates that the related objects before and after are in an "or" relationship. In the present application, "first", "second" and various numerical numbers are only used to distinguish for the convenience of description and are not used to limit the scope of the embodiments of the present application. For example, to distinguish different messages, etc., rather than to describe a specific order or sequence.

[0179] It is understood that the various numbers used in the embodiments of the present application are only used for ease of description and are not intended to limit the scope of the embodiments of the present application. The order of the sequence numbers of the above-mentioned processes does not necessarily indicate the order in which they are executed. The order in which the processes are executed should be determined by their functions and internal logic.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present application.

Claims

1. A method for generating a cloud resource architecture diagram, characterized in that: Applied to a cloud management platform, the cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, the multiple target cloud resources include a first cloud resource and a second cloud resource, the method includes: In response to an architecture diagram generation request sent by the tenant, obtain configuration information of the first cloud resource and obtain a network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes a type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on a flow log of a virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that data message transmission exists between the first cloud resource and a second cloud resource; Based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, a cloud resource architecture diagram is generated, and the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship.

2. The method according to claim 1, characterized in that The obtaining of the network traffic log of the first cloud resource includes: Obtain a flow log of a virtual private cloud VPC associated with the first cloud resource, the flow log including a first record indicating that data packet transmission exists between the first cloud resource and the second cloud resource, the first record including a source address and a destination address of the data packet transmission, wherein the source address in the first record is an IP address of the first cloud resource, and the destination address in the first record is an IP address of the second cloud resource; or, the source address in the first record is an IP address of the second cloud resource, and the destination address in the first record is an IP address of the first cloud resource.

3. The method according to claim 2, characterized in that The first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

4. The method according to claim 2, characterized in that: The IP address of the second cloud resource is the first virtual IP address, and the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a connection relationship with the second cloud resource.

5. The method according to any one of claims 1 to 4, characterized in that: The multiple target cloud resources further include a fourth cloud resource and a fifth cloud resource, and the method further includes: The configuration information of the fourth cloud resource is obtained, wherein the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship.

6. The method according to any one of claims 1 to 5, characterized in that: The multiple target cloud resources further include a sixth cloud resource, and the method further includes: Obtaining configuration information of the sixth cloud resource; Based on the configuration information of the sixth cloud resource, the configuration information of the public network resource associated with the sixth cloud resource is obtained, the configuration information of the public network resource includes the connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Obtain cloud audit information of the VPC associated with the first cloud resource, the cloud audit information including at least one of cloud resource addition information, cloud resource deletion information, and cloud resource modification information in the VPC; Based on the cloud resource addition information, add the corresponding cloud resource in the cloud resource architecture diagram; or, based on the cloud resource deletion information, The information is deleted to delete the corresponding cloud resources in the cloud resource architecture diagram; or, based on the cloud resource modification information, the corresponding cloud resources in the cloud resource architecture diagram are modified.

8. A cloud management platform, characterized in that: The cloud management platform is used to manage an infrastructure that provides multiple target cloud resources, the infrastructure includes at least one cloud data center, each cloud data center is provided with multiple servers, one or any combination of the multiple target cloud resources is deployed in at least one server of the infrastructure, the multiple target cloud resources include a first cloud resource and a second cloud resource, and the cloud management platform includes: a resource information acquisition module, configured to, in response to an architecture diagram generation request sent by a tenant, acquire configuration information of the first cloud resource and acquire a network traffic log of the first cloud resource, wherein the configuration information of the first cloud resource includes a type of the first cloud resource, the network traffic log of the first cloud resource is obtained based on a flow log of a virtual private cloud VPC associated with the first cloud resource, and the network traffic log of the first cloud resource indicates that data message transmission exists between the first cloud resource and a second cloud resource; An architecture diagram generation module is used to generate a cloud resource architecture diagram based on the configuration information of the first cloud resource and the network traffic log of the first cloud resource, wherein the first cloud resource and the second cloud resource in the cloud resource architecture diagram have a connection relationship.

9. The cloud management platform according to claim 8, characterized in that: The resource information acquisition module includes: A flow log acquisition unit is used to obtain the flow log of the virtual private cloud VPC associated with the first cloud resource, the flow log includes a first record indicating that there is data packet transmission between the first cloud resource and the second cloud resource, the first record includes a source address and a destination address of the data packet transmission, wherein the source address in the first record is the IP address of the first cloud resource, and the destination address in the first record is the IP address of the second cloud resource; or, the source address in the first record is the IP address of the second cloud resource, and the destination address in the first record is the IP address of the first cloud resource.

10. The cloud management platform according to claim 9, characterized in that: The first record also includes a source port identifier and a destination port identifier of the data packet transmission, wherein the source port identifier is the identifier of the first port on the first cloud resource, and the destination port identifier is the identifier of the second port on the second cloud resource; or, the source port identifier is the identifier of the second port on the second cloud resource, and the destination port identifier is the identifier of the first port on the first cloud resource; the first port on the first cloud resource and the second port on the second cloud resource in the cloud resource architecture diagram have a connection relationship.

11. The cloud management platform according to claim 9, characterized in that: The IP address of the second cloud resource is the first virtual IP address, and the flow log also includes a second record indicating that there is data packet transmission between the first cloud resource and the third cloud resource, the second record and the first record indicate the same data packet transmission, and the source address or destination address of the data packet transmission included in the second record and the first record is the IP address of the first cloud resource; the third cloud resource in the cloud resource architecture diagram has a binding relationship with the first virtual IP address.

12. The cloud management platform according to any one of claims 8 to 11, characterized in that: The multiple target cloud resources further include a fourth cloud resource and a fifth cloud resource, and the resource information acquisition module includes: A resource configuration information acquisition unit is used to acquire the configuration information of the fourth cloud resource, wherein the configuration information of the fourth cloud resource also includes a connection relationship between the fourth cloud resource and the fifth cloud resource, and the fourth cloud resource and the fifth cloud resource in the cloud resource architecture diagram have a connection relationship.

13. The cloud management platform according to any one of claims 8 to 12, characterized in that: The multiple target cloud resources further include a sixth cloud resource, and the resource information acquisition module further includes: A resource configuration information acquisition unit is used to obtain the configuration information of the sixth cloud resource; based on the configuration information of the sixth cloud resource, the configuration information of the public network resource associated with the sixth cloud resource is acquired, the configuration information of the public network resource includes the connection relationship between the sixth cloud resource and the public network resource, and the sixth cloud resource in the cloud resource architecture diagram has a connection relationship with the public network resource.

14. The cloud management platform according to any one of claims 8 to 13, characterized in that: The cloud management platform also includes: a cloud audit information acquisition module, configured to acquire cloud audit information of the VPC associated with the first cloud resource, wherein the cloud audit information includes at least one of cloud resource addition information, cloud resource deletion information, and cloud resource modification information within the VPC; An architecture diagram updating module is used to add corresponding cloud resources in the cloud resource architecture diagram based on cloud resource addition information; or to delete corresponding cloud resources in the cloud resource architecture diagram based on cloud resource deletion information; or to modify corresponding cloud resources in the cloud resource architecture diagram based on cloud resource modification information.

15. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the cloud resource architecture diagram generation method as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generating method according to any one of claims 1 to 7.

17. A computer program product comprising instructions, characterized in that When the instruction is executed by a computing device cluster, the computing device cluster executes the cloud resource architecture diagram generating method as described in any one of claims 1 to 7.

Images