RepliMap

AWS Infrastructure Intelligence Engine

Scan existing AWS infrastructure, generate Terraform code, and detect compliance drift against SOC 2, HIPAA, and PCI DSS.

Quick Start • Features • Compliance • Installation • Docs

Python 3.10+

RepliMap Demo

Features

Reverse Terraform — Scan any AWS account and generate clean, modular HCL
Drift Detection — Compare Terraform state against actual AWS configuration
Compliance Lens — Map infrastructure drift to SOC 2, HIPAA, PCI DSS controls
compliance.tf Integration — Generate Terraform with compliance-ready module sources (16 verified frameworks, 21 modules) — prevention at terraform apply paired with RepliMap's runtime drift detection
Audit-Ready Reports — Generate markdown reports your auditor can read directly
Risk Exemptions — Document and track accepted risks with expiry dates
Data Sovereignty — Everything runs locally. No data leaves your machine.

Quick Start

Installation

# Using pipx (recommended)
pipx install replimap

# Using pip
pip install replimap

# Verify
replimap --version

Scan and Generate Terraform

# Scan your AWS account
replimap -p prod -r us-east-1 scan

# Generate Terraform from scanned infrastructure
replimap -p prod -r us-east-1 codify -o ./terraform

Check Compliance Drift

# Compare TF state against AWS and check SOC 2 compliance
replimap drift -s terraform.tfstate --compliance soc2

# Generate audit-ready markdown report
replimap drift -s terraform.tfstate -c soc2 -f markdown -o compliance-report.md

# Check all frameworks at once
replimap drift -s terraform.tfstate -c all

# Use risk exemptions
replimap drift -s terraform.tfstate -c all --ignore-file .replimap-ignore.yml

Generate SOC 2 Evidence Report

# Full evidence report with PASS/FAIL for every resource
replimap audit -s terraform.tfstate --company "Acme Corp" --period "2026-Q1" -o soc2-evidence.md

Generate Compliance-Ready Terraform (compliance.tf Integration)

# Codify with SOC 2-compliant module sources
replimap codify -p prod -r us-east-1 -c soc2 -o ./terraform

# Other frameworks (16 verified): hipaa, pci-dss, nist, fedramp,
# iso27001, gdpr, nis2, cis, and versioned variants
replimap codify -p prod -c pci-dss -o ./terraform
replimap codify -p prod -c nist    -o ./terraform

# After apply, verify no drift from the compliance baseline
cd ./terraform
terraform login soc2.compliance.tf      # or: tofu login soc2.compliance.tf
terraform init && terraform apply
replimap drift -s terraform.tfstate --compliance soc2

RepliMap covers the detection layer (what's drifted in production); compliance.tf covers the prevention layer (what gets deployed). Together they form a complete infrastructure control stack.

Generated .tf files use the canonical subdomain (pcidss.compliance.tf, nist80053.compliance.tf, ...), verified via scripts/verify_compliance_tf_subdomains.py. Friendly CLI slugs like pci-dss and nist are resolved to their canonical form before URL construction — terraform init never sees a short slug.

Compliance Coverage

RepliMap maps 18 infrastructure checks to SOC 2, HIPAA, and PCI DSS controls.

Rule	Resource	Check	SOC 2	HIPAA	PCI DSS
s3-encryption-enabled	S3 Bucket	Default encryption	CC6.1	§164.312(a)(2)(iv)	3.4.1
rds-encryption-enabled	RDS Instance	Storage encryption	CC6.1	§164.312(a)(2)(iv)	3.4
kms-key-rotation-enabled	KMS Key	Key rotation	CC6.1	—	—
ebs-encryption-enabled	EBS Volume	Volume encryption	CC6.1	§164.312(a)(2)(iv)	3.4.1
elasticache-at-rest-encryption	ElastiCache Cluster	At-rest encryption	CC6.1	§164.312(a)(2)(iv)	—
elasticache-transit-encryption	ElastiCache Cluster	In-transit encryption	CC6.7	§164.312(e)(1)	—
cloudwatch-log-encryption	CloudWatch Log Group	KMS encryption configured	CC6.1	—	—
sns-encryption-enabled	SNS Topic	KMS encryption configured	CC6.1	—	—
sqs-encryption-enabled	SQS Queue	KMS encryption configured	CC6.1	—	—
s3-no-public-acl	S3 Bucket	ACL not public	CC6.6	§164.312(e)(1)	1.3
rds-not-publicly-accessible	RDS Instance	Not publicly accessible	CC6.6	—	1.3
sg-no-unrestricted-ingress	Security Group	No 0.0.0.0/0 on sensitive ports	CC6.6	—	1.2.1
sg-no-unrestricted-egress	Security Group	No unrestricted egress (0.0.0.0/0 all protocols)	CC6.6	—	—
iam-trust-policy	IAM Role	No wildcard or root principals	CC6.1	—	—
s3-logging-enabled	S3 Bucket	Access logging	CC7.1	§164.312(b)	10.1
s3-versioning-enabled	S3 Bucket	Versioning enabled	CC8.1	—	—
rds-multi-az-enabled	RDS Instance	Multi-AZ availability	CC7.1	—	—
rds-backup-retention	RDS Instance	Backup >= 7 days	CC7.1	—	—

How It Works

DriftEngine compares your Terraform state against actual AWS resources
ComplianceMappingEngine maps attribute diffs to framework controls
Value-aware checking prevents false positives (e.g., fixing publicly_accessible: True → False is not a violation)
Port-aware SG analysis: 0.0.0.0/0 on SSH/RDP/DB ports is critical; HTTP/HTTPS is acceptable

Risk Exemptions

Document accepted risks in .replimap-ignore.yml:

exceptions:
  - resource: aws_s3_bucket.public_website
    attribute: acl
    reason: "Public website bucket, approved by CISO"
    approved_by: "jane@acme.com"
    expires: "2026-12-31"

Exemptions appear as "Accepted Risks" in reports. Expired exemptions are automatically flagged and restored as active findings.

Commands

RepliMap has 23 commands, grouped as shown in replimap --help:

Core

Command	Description
`replimap scan`	Scan AWS resources and build dependency graph
`replimap graph`	Generate visual dependency graph of AWS infrastructure
`replimap load`	Load and display a saved graph
`replimap profiles`	List available AWS profiles

Infrastructure as Code

Command	Description
`replimap codify`	Transform ClickOps AWS infrastructure into a Terraform adoption starting point
`replimap remediate`	Generate Terraform remediation code from an audit JSON file

Analysis

Command	Description
`replimap analyze`	Analyze a resource dependency graph for critical infrastructure
`replimap deps`	Explore dependencies for a resource (Pro+)
`replimap drift`	Detect infrastructure drift between Terraform state and AWS
`replimap drift-offline`	Offline drift detection
`replimap validate`	Validate infrastructure against topology constraints

Security & Compliance

Command	Description
`replimap audit`	Run security audit on AWS infrastructure (Checkov-based, or SOC 2 evidence with `--state`)
`replimap residency`	Validate data residency compliance for NZ/AU sovereignty
`replimap iam`	Generate least-privilege IAM policies from graph analysis
`replimap trust-center`	Trust Center API auditing for compliance

Configuration & Utility

Command	Description
`replimap doctor`	Run environment health checks
`replimap cache`	Credential cache management
`replimap scan-cache`	Scan result cache management
`replimap license`	License management commands
`replimap upgrade`	Upgrade your RepliMap plan
`replimap completion`	Generate shell completion scripts

Help & Debugging

Command	Description
`replimap explain`	Get detailed information about an error code
`replimap errors`	List all error codes

Run replimap <command> --help for full flags and examples.

Architecture

RepliMap is built around a Graph Engine powered by NetworkX. It transforms discrete cloud resources into a connected dependency graph, enabling impact analysis, visualization, and intelligent code generation.

┌──────────────────────────────────────────────────────────────────┐
│                         RepliMap Architecture                    │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│   ┌─────────────┐     ┌─────────────┐     ┌─────────────┐       │
│   │  Scanners   │────>│   Graph     │────>│  Renderers  │       │
│   │  (AWS API)  │     │   Engine    │     │  (Terraform)│       │
│   └─────────────┘     └──────┬──────┘     └─────────────┘       │
│                              │                                   │
│         ┌────────────────────┼────────────────────┐             │
│         │                    │                    │             │
│         v                    v                    v             │
│   ┌───────────┐      ┌─────────────┐      ┌───────────┐        │
│   │ Compliance │      │ Right-Sizer │      │   Drift   │        │
│   │   Engine   │      │   Engine    │      │  Detector │        │
│   └───────────┘      └─────────────┘      └───────────┘        │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘

Supported Resources

Resources are listed here only if RepliMap both scans them from the AWS API and generates matching Terraform (scan → codify).

View all 28 supported resource types

Category	Resources
Network	VPC, Subnet, Security Group, Route Table, Internet Gateway, NAT Gateway, VPC Endpoint, Network ACL, Elastic IP
Compute & Load Balancing	EC2 Instance, Launch Template, Auto Scaling Group, Application/Network Load Balancer (+ target groups, listeners)
Database	RDS Instance, Aurora Cluster (+ Cluster Instance), DB Subnet Group, DB Parameter Group, ElastiCache Cluster, ElastiCache Subnet Group
Storage	S3 Bucket, S3 Bucket Policy, EBS Volume
Messaging & Monitoring	SQS Queue, SNS Topic, CloudWatch Log Group, CloudWatch Metric Alarm
IAM	IAM Role, IAM Instance Profile

Configuration

AWS Credentials

RepliMap uses standard AWS credential chain:

# AWS CLI profile (recommended)
replimap -p my-profile scan

# Environment variables
export AWS_ACCESS_KEY_ID=xxx
export AWS_SECRET_ACCESS_KEY=xxx
replimap scan

# IAM role (EC2/ECS/Lambda)
replimap scan  # Auto-detects instance role

Required IAM Permissions

RepliMap only needs read-only access. See IAM_POLICY.md for the minimal policy.

Security & Privacy

Your data never leaves your machine.

RepliMap runs entirely client-side
No cloud account required
Read-only AWS access (no modifications)
Sensitive data (passwords, keys) automatically redacted
SOC 2-compliant design

See SECURITY.md for details.

Roadmap

compliance.tf integration for codify output (16 verified core frameworks, 21 modules, shared --compliance alias resolution across codify/drift/audit)
Not yet supported: Lambda, ECS, EKS, DynamoDB, EFS, Secrets Manager, KMS, CloudTrail, VPC Flow Logs
CI/CD integration templates (GitHub Actions, Azure DevOps)

Pricing

	Community (Free)	Pro ($29/mo)	Team ($99/mo)	Sovereign ($2,500/mo)
Unlimited scans	✅	✅	✅	✅
Graph / dependency map	✅	✅	✅	✅
Generate Terraform (resource `.tf` files, full account)	✅	✅	✅	✅
Compliance audit	Full scan + score	Full scan + score + report file	Full scan + score + report file	Full scan + score + report file
Drift detection	✅ (experimental)	✅ (experimental)	✅ (experimental)	✅ (experimental)
Import scaffold (`imports.tf` / `imports.sh`)	—	✅	✅	✅
Dependency Explorer (`deps`)	—	✅	✅	✅
Coverage summary (unmanaged resources)	Counts only	Full list	Full list	Full list
CI/CD blocking (`--fail-on-*`) + Trust Center report	—	—	✅	✅
APRA/RBNZ/NZISM regional compliance	—	—	—	✅
Offline activation / digital signatures / white-label	—	—	—	✅

View full pricing

Contributing

We welcome contributions. See CONTRIBUTING.md for guidelines.

git clone git@github.com:RepliMap/replimap.git
cd replimap
pip install -e ".[dev]"
pytest

Documentation

IAM Policy

Support

Purpose	Contact
General inquiries	hello@replimap.com
Technical support	support@replimap.com
Enterprise & Sales	david@replimap.com
Bug reports	GitHub Issues

License

RepliMap is licensed under the Business Source License 1.1.

View full pricing

Website • Docs • Twitter

Made with ☕ in New Zealand

Release files for replimap 0.5.9

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for replimap 0.5.9
File	Size	Uploaded
replimap-0.5.9.tar.gz	1.9 MB	Sep 27, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for replimap 0.5.9
File	Interpreter	ABI	Platform	Reset
replimap-0.5.9-py3-none-any.whl 1.3 MB Sep 27, 2026	Python 3	none	any	Details

Total release size: 3.3 MB

Release files / replimap-0.5.9.tar.gz

Download URL	replimap-0.5.9.tar.gz
Size	1.9 MB
Tags	Source
SHA-256 checksum How to use checksums	`f24de3d37ecef170c170778791fe838d95acdc4c98880b09bb0452ca00b5f490`
BLAKE2b-256 checksum How to use checksums	`b9cd60bada36fcd06fc51558d5626092405bfc630f39aaae08fde9b6e743c93b`
Upload date	Sep 27, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / replimap-0.5.9-py3-none-any.whl

Download URL	replimap-0.5.9-py3-none-any.whl
Size	1.3 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`06541f6a656aa1b4cf3365c82fb50c3d447b46ccd53cfe55893ebe021ce8847a`
BLAKE2b-256 checksum How to use checksums	`b99ce07492439365017f88b3d7616ba4df196dbd00020d698141fbf900b04aeb`
Upload date	Sep 27, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.14`