RepliMap

AWS Infrastructure Intelligence Engine

Scan existing AWS infrastructure, generate Terraform code, and detect compliance drift against SOC 2, HIPAA, and PCI DSS.

Quick Start • Features • Compliance • Installation • Docs

Python 3.10+

RepliMap Demo

Features

Reverse Terraform — Scan any AWS account and generate clean, modular HCL
Drift Detection — Compare Terraform state against actual AWS configuration
Compliance Lens — Map infrastructure drift to SOC 2, HIPAA, PCI DSS controls
compliance.tf Integration — Generate Terraform with compliance-ready module sources (16 verified frameworks, 21 modules) — prevention at terraform apply paired with RepliMap's runtime drift detection
Audit-Ready Reports — Generate markdown reports your auditor can read directly
Risk Exemptions — Document and track accepted risks with expiry dates
Data Sovereignty — Everything runs locally. No data leaves your machine.

Quick Start

Installation

# Using pipx (recommended)
pipx install replimap

# Using pip
pip install replimap

# Verify
replimap --version

Scan and Generate Terraform

# Scan your AWS account
replimap -p prod -r us-east-1 scan

# Generate Terraform from scanned infrastructure
replimap -p prod -r us-east-1 codify -o ./terraform

Check Compliance Drift

# Compare TF state against AWS and check SOC 2 compliance
replimap drift -s terraform.tfstate --compliance soc2

# Generate audit-ready markdown report
replimap drift -s terraform.tfstate -c soc2 -f markdown -o compliance-report.md

# Check all frameworks at once
replimap drift -s terraform.tfstate -c all

# Use risk exemptions
replimap drift -s terraform.tfstate -c all --ignore-file .replimap-ignore.yml

Generate SOC 2 Evidence Report

# Full evidence report with PASS/FAIL for every resource
replimap audit -s terraform.tfstate --company "Acme Corp" --period "2026-Q1" -o soc2-evidence.md

Generate Compliance-Ready Terraform (compliance.tf Integration)

# Codify with SOC 2-compliant module sources
replimap codify -p prod -r us-east-1 -c soc2 -o ./terraform

# Other frameworks (16 verified): hipaa, pci-dss, nist, fedramp,
# iso27001, gdpr, nis2, cis, and versioned variants
replimap codify -p prod -c pci-dss -o ./terraform
replimap codify -p prod -c nist    -o ./terraform

# After apply, verify no drift from the compliance baseline
cd ./terraform
terraform login soc2.compliance.tf      # or: tofu login soc2.compliance.tf
terraform init && terraform apply
replimap drift -s terraform.tfstate --compliance soc2

RepliMap covers the detection layer (what's drifted in production); compliance.tf covers the prevention layer (what gets deployed). Together they form a complete infrastructure control stack.

Generated .tf files use the canonical subdomain (pcidss.compliance.tf, nist80053.compliance.tf, ...), verified via scripts/verify_compliance_tf_subdomains.py. Friendly CLI slugs like pci-dss and nist are resolved to their canonical form before URL construction — terraform init never sees a short slug.

Compliance Coverage

RepliMap maps 18 infrastructure checks to SOC 2, HIPAA, and PCI DSS controls.

Rule	Resource	Check	SOC 2	HIPAA	PCI DSS
s3-encryption-enabled	S3 Bucket	Default encryption	CC6.1	§164.312(a)(2)(iv)	3.4.1
rds-encryption-enabled	RDS Instance	Storage encryption	CC6.1	§164.312(a)(2)(iv)	3.4
kms-key-rotation-enabled	KMS Key	Key rotation	CC6.1	—	—
ebs-encryption-enabled	EBS Volume	Volume encryption	CC6.1	§164.312(a)(2)(iv)	3.4.1
elasticache-at-rest-encryption	ElastiCache Cluster	At-rest encryption	CC6.1	§164.312(a)(2)(iv)	—
elasticache-transit-encryption	ElastiCache Cluster	In-transit encryption	CC6.7	§164.312(e)(1)	—
cloudwatch-log-encryption	CloudWatch Log Group	KMS encryption configured	CC6.1	—	—
sns-encryption-enabled	SNS Topic	KMS encryption configured	CC6.1	—	—
sqs-encryption-enabled	SQS Queue	KMS encryption configured	CC6.1	—	—
s3-no-public-acl	S3 Bucket	ACL not public	CC6.6	§164.312(e)(1)	1.3
rds-not-publicly-accessible	RDS Instance	Not publicly accessible	CC6.6	—	1.3
sg-no-unrestricted-ingress	Security Group	No 0.0.0.0/0 on sensitive ports	CC6.6	—	1.2.1
sg-no-unrestricted-egress	Security Group	No unrestricted egress (0.0.0.0/0 all protocols)	CC6.6	—	—
iam-trust-policy	IAM Role	No wildcard or root principals	CC6.1	—	—
s3-logging-enabled	S3 Bucket	Access logging	CC7.1	§164.312(b)	10.1
s3-versioning-enabled	S3 Bucket	Versioning enabled	CC8.1	—	—
rds-multi-az-enabled	RDS Instance	Multi-AZ availability	CC7.1	—	—
rds-backup-retention	RDS Instance	Backup >= 7 days	CC7.1	—	—

How It Works

DriftEngine compares your Terraform state against actual AWS resources
ComplianceMappingEngine maps attribute diffs to framework controls
Value-aware checking prevents false positives (e.g., fixing publicly_accessible: True → False is not a violation)
Port-aware SG analysis: 0.0.0.0/0 on SSH/RDP/DB ports is critical; HTTP/HTTPS is acceptable

Risk Exemptions

Document accepted risks in .replimap-ignore.yml:

exceptions:
  - resource: aws_s3_bucket.public_website
    attribute: acl
    reason: "Public website bucket, approved by CISO"
    approved_by: "jane@acme.com"
    expires: "2026-12-31"

Exemptions appear as "Accepted Risks" in reports. Expired exemptions are automatically flagged and restored as active findings.

Commands

RepliMap has 23 commands, grouped as shown in replimap --help:

Core

Command	Description
`replimap scan`	Scan AWS resources and build dependency graph
`replimap graph`	Generate visual dependency graph of AWS infrastructure
`replimap load`	Load and display a saved graph
`replimap profiles`	List available AWS profiles

Infrastructure as Code

Command	Description
`replimap codify`	Transform ClickOps AWS infrastructure into a Terraform adoption starting point
`replimap remediate`	Generate Terraform remediation code from an audit JSON file

Analysis

Command	Description
`replimap analyze`	Analyze a resource dependency graph for critical infrastructure
`replimap deps`	Explore dependencies for a resource (Pro+)
`replimap drift`	Detect infrastructure drift between Terraform state and AWS
`replimap drift-offline`	Offline drift detection
`replimap validate`	Validate infrastructure against topology constraints

Security & Compliance

Command	Description
`replimap audit`	Run security audit on AWS infrastructure (Checkov-based, or SOC 2 evidence with `--state`)
`replimap residency`	Validate data residency compliance for NZ/AU sovereignty
`replimap iam`	Generate least-privilege IAM policies from graph analysis
`replimap trust-center`	Trust Center API auditing for compliance

Configuration & Utility

Command	Description
`replimap doctor`	Run environment health checks
`replimap cache`	Credential cache management
`replimap scan-cache`	Scan result cache management
`replimap license`	License management commands
`replimap upgrade`	Upgrade your RepliMap plan
`replimap completion`	Generate shell completion scripts

Help & Debugging

Command	Description
`replimap explain`	Get detailed information about an error code
`replimap errors`	List all error codes

Run replimap <command> --help for full flags and examples.

Architecture

RepliMap is built around a Graph Engine powered by NetworkX. It transforms discrete cloud resources into a connected dependency graph, enabling impact analysis, visualization, and intelligent code generation.

┌──────────────────────────────────────────────────────────────────┐
│                         RepliMap Architecture                    │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│   ┌─────────────┐     ┌─────────────┐     ┌─────────────┐       │
│   │  Scanners   │────>│   Graph     │────>│  Renderers  │       │
│   │  (AWS API)  │     │   Engine    │     │  (Terraform)│       │
│   └─────────────┘     └──────┬──────┘     └─────────────┘       │
│                              │                                   │
│         ┌────────────────────┼────────────────────┐             │
│         │                    │                    │             │
│         v                    v                    v             │
│   ┌───────────┐      ┌─────────────┐      ┌───────────┐        │
│   │ Compliance │      │ Right-Sizer │      │   Drift   │        │
│   │   Engine   │      │   Engine    │      │  Detector │        │
│   └───────────┘      └─────────────┘      └───────────┘        │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘

Supported Resources

Resources are listed here only if RepliMap scans them from the AWS API. Types marked graph only appear in the dependency graph, graph and deps, but codify does not emit them as Terraform (it would need data RepliMap refuses to read, such as function code or secret values, or the type is not generated yet). Everything else is generated as Terraform (scan → codify).

codify also skips resources owned by a CloudFormation stack (tagged aws:cloudformation:stack-id / stack-name): importing them would make Terraform and CloudFormation fight over the same resource. The summary shows how many were skipped; pass --include-cfn-managed to generate them anyway. They stay in the scan graph, and --coverage-state reports them as auto-created rather than actionable. AWS-reserved aws: tags are never written to the generated Terraform.

View all 39 codified resource types (+ 12 graph-only)

Category	Resources
Network	VPC, Subnet, Security Group, Route Table, Internet Gateway, NAT Gateway, VPC Endpoint, Network ACL, Elastic IP
Compute & Load Balancing	EC2 Instance, Launch Template, Auto Scaling Group, Application/Network Load Balancer (+ target groups, listeners)
Database	RDS Instance, Aurora Cluster (+ Cluster Instance), DB Subnet Group, DB Parameter Group, ElastiCache Cluster, ElastiCache Subnet Group, DynamoDB Table
Storage	S3 Bucket, S3 Bucket Policy, EBS Volume
Messaging & Monitoring	SQS Queue, SNS Topic, CloudWatch Log Group, CloudWatch Metric Alarm
IAM	IAM Role, IAM Instance Profile
DNS, CDN & Certificates	Route53 Hosted Zone, Route53 Record (incl. alias, weighted and latency records), ACM Certificate, CloudFront Distribution
Containers (ECS / ECR)	ECS Cluster, ECR Repository; graph only: ECS Service, ECS Task Definition (environment variable values are never stored)
Serverless	Lambda Event Source Mapping; graph only: Lambda Function (no code download; environment variable values are never stored)
Secrets & Encryption	Secrets Manager Secret (metadata only, never the value), KMS Key (customer-managed, including its key policy), KMS Alias; graph only: SSM Parameter (never the value)
API Gateway (graph only)	REST API, REST Stage, REST Custom Domain, REST VPC Link, HTTP/WebSocket API, HTTP/WebSocket Stage, HTTP/WebSocket Custom Domain, HTTP/WebSocket VPC Link

Configuration

AWS Credentials

RepliMap uses standard AWS credential chain:

# AWS CLI profile (recommended)
replimap -p my-profile scan

# Environment variables
export AWS_ACCESS_KEY_ID=xxx
export AWS_SECRET_ACCESS_KEY=xxx
replimap scan

# IAM role (EC2/ECS/Lambda)
replimap scan  # Auto-detects instance role

Required IAM Permissions

RepliMap only needs read-only access. See IAM_POLICY.md for the minimal policy.

Security & Privacy

Your data never leaves your machine.

RepliMap runs entirely client-side
No cloud account required
Read-only AWS access (no modifications)
Sensitive data (passwords, keys) automatically redacted
SOC 2-compliant design

See SECURITY.md for details.

Roadmap

compliance.tf integration for codify output (16 verified core frameworks, 21 modules, shared --compliance alias resolution across codify/drift/audit)
Not yet supported: EKS, EFS, CloudTrail, VPC Flow Logs (Lambda functions, ECS services/task definitions, API Gateway and SSM parameters are graph only)
CI/CD integration templates (GitHub Actions, Azure DevOps)

Pricing

	Community (Free)	Pro ($29/mo)	Team ($99/mo)	Sovereign ($2,500/mo)
Unlimited scans	✅	✅	✅	✅
Graph / dependency map	✅	✅	✅	✅
Generate Terraform (resource `.tf` files, full account)	✅	✅	✅	✅
Compliance audit	Full scan + score	Full scan + score + report file	Full scan + score + report file	Full scan + score + report file
Drift detection	✅ (experimental)	✅ (experimental)	✅ (experimental)	✅ (experimental)
Import scaffold (`imports.tf` / `imports.sh`)	—	✅	✅	✅
Dependency Explorer (`deps`)	—	✅	✅	✅
Coverage summary (unmanaged resources)	Counts only	Full list	Full list	Full list
CI/CD blocking (`--fail-on-*`) + Trust Center report	—	—	✅	✅
APRA/RBNZ/NZISM regional compliance	—	—	—	✅
Offline activation / digital signatures / white-label	—	—	—	✅

View full pricing

Contributing

We welcome contributions. See CONTRIBUTING.md for guidelines.

git clone git@github.com:RepliMap/replimap.git
cd replimap
pip install -e ".[dev]"
pytest

Documentation

IAM Policy

Support

Purpose	Contact
General inquiries	hello@replimap.com
Technical support	support@replimap.com
Enterprise & Sales	david@replimap.com
Bug reports	GitHub Issues

License

RepliMap is licensed under the Business Source License 1.1.

View full pricing

Website • Docs • Twitter

Made with ☕ in New Zealand

Metadata

Release files for replimap 0.6.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for replimap 0.6.0
File	Size	Uploaded
replimap-0.6.0.tar.gz	2.0 MB	Oct 1, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for replimap 0.6.0
File	Interpreter	ABI	Platform	Reset
replimap-0.6.0-py3-none-any.whl 1.4 MB Oct 1, 2026	Python 3	none	any	Details

Total release size: 3.4 MB

Release files / replimap-0.6.0.tar.gz

Download URL	replimap-0.6.0.tar.gz
Size	2.0 MB
Tags	Source
SHA-256 checksum How to use checksums	`214d86e9494ecd4541affcb09a7b094d3d2faeb4740e69b171e43383002037e1`
BLAKE2b-256 checksum How to use checksums	`74ec96e87b34a1cfa77afd9ed0fa5191774ab5b2f154b77b4ae16b799486468c`
Upload date	Oct 1, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Release files / replimap-0.6.0-py3-none-any.whl

Download URL	replimap-0.6.0-py3-none-any.whl
Size	1.4 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`6c50edd0fa22b501b3bb890faeee911aa267a9ba0d301396e188d7c535135623`
BLAKE2b-256 checksum How to use checksums	`7140fcd71ca2f09336c287ebd87423c6ba7c8241439d609122b1a6a4a9ca9a52`
Upload date	Oct 1, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.13.14`