# InfraMap: generating a simplified Terraform graph from tfstate or HCL files

> InfraMap reads Terraform tfstate or HCL input and returns a filtered graph that shows only the resources most relevant to each supported cloud provider, cutting the noise that terraform graph produces. Five providers have specific logic; all others fall through to an unfiltered resource listing.

**cycloidio/inframap** — Read your tfstate or HCL to generate a graph specific for each provider, showing only the resources that are most important/relevant.

- Repository: https://github.com/cycloidio/inframap
- Stars: 2,071 · Forks: 108
- Language: Go
- License: MIT
- Published: 2026-10-11 · Updated: 2026-10-11 · Language: en
- Canonical page: https://hysenlabs.com/projects/cycloidio-inframap

## InfraMap reduces the terraform graph output to a human-readable filtered diagram

Terraform's built-in graph command produces every dependency in a state or HCL configuration: provider nodes, variable nodes, data sources and resources are all rendered together. For a non-trivial infrastructure definition, reading the result requires effort, and much of what appears is scaffolding rather than meaningful architecture. InfraMap takes a different approach by reading the same tfstate or HCL input and returning only the resources the project considers most important or relevant.

The README compares the two tools directly using a Magento stack as a reference. The terraform graph output for that stack includes provider and variable nodes alongside resources. InfraMap's output for the same input, after running `inframap generate ./terraform/module-magento/ | dot -Tpng > inframap.png`, shows a filtered diagram of significant resources. Three flags control how much filtering is applied: the default applies full provider logic, `--connections=false` shows nodes without connection lines, and `--raw` reverts to an unfiltered view close to what terraform graph would produce, which helps confirm whether resources were parsed correctly.

For providers InfraMap does not specifically support, the output is the full resource set with no simplification, but also without the provider and variable nodes that terraform graph adds.

## Static node and edge lists drive the filtering, and the dependencies key drives the graph for tfstate

For each supported provider, InfraMap maintains a static list of which resource types can be nodes and which can be edges. Edges are the connecting resources, such as security groups or routing attachments. Once InfraMap identifies those edges, it creates a single connection between the resources they link, collapsing what would otherwise appear as multiple intermediate nodes in the raw graph.

For tfstate input, the algorithm reads the `dependencies` key. Terraform configurations written before version 0.13 use `depends_on` instead of `dependencies`, and InfraMap internally replaces those references before building the graph, extending compatibility without requiring the user to convert the state. TFState versions 3 and 4 are the only formats that the project supports.

For HCL input, InfraMap uses interpolation references to establish the base graph, then applies provider-specific logic. Directories passed as arguments default to HCL processing. Input type detection is automatic: if the input parses as valid JSON, InfraMap treats it as TFState; otherwise it falls back to HCL. Passing `--hcl` or `--tfstate` overrides that detection and forces a specific mode regardless of the file content.

## brew install inframap gets the binary; piping to dot or graph-easy renders the output

On macOS with Homebrew:

```sh
brew install inframap
```

Linux users can install from the AUR package or download a prebuilt binary from the GitHub Releases page. A Docker image is available at cycloid/inframap on Docker Hub. Building from source requires Go 1.22 and the repository's Makefile:

```shell
git clone https://github.com/cycloidio/inframap
cd inframap
go mod download
make build
```

The binary compiles to a file named inframap in the working directory. Once available, the main use case pipes the generate subcommand to a rendering tool. With Graphviz installed locally:

```shell
inframap generate state.tfstate | dot -Tpng > graph.png
```

For terminal output without generating an image file, graph-easy works instead:

```shell
inframap generate state.tfstate | graph-easy
```

The Docker image bundles graphviz, so PNG generation does not require a local Graphviz installation when using Docker:

```shell
docker run --rm -v ${PWD}:/opt --entrypoint "/bin/ash" cycloid/inframap -c './inframap generate /opt/PATH_TO_HCL_STATE | dot -Tpng > /opt/graph.png'
```

The resulting image lands in the host directory that was mounted as /opt. The prune subcommand strips sensitive data from a tfstate file before sharing it, though HCL input is not yet supported by prune.

## AWS has external nodes and grouping in progress; the other four providers get nodes and edges only

Five providers have dedicated logic: AWS, Google Cloud, Azure, OpenStack and FlexibleEngine. Their treatment differs in three feature columns: Grouping, External Nodes and IAM.

External Nodes, which show the ingress points of the resources in the graph, are available for AWS and not for the other four. Grouping, which clusters resources that share a VPC or region, is listed as a work-in-progress for AWS (linked to an open GitHub issue) and marked as not available for Google Cloud, Azure, OpenStack and FlexibleEngine.

IAM connections are absent for every provider. The table marks IAM as not supported for all five, with the AWS IAM column pointing to a separate open issue. This means a graph that depends on IAM role assumptions to explain how services communicate will not show those relationships for any cloud, including AWS.

For providers outside these five, InfraMap returns all resources from the state or HCL with no simplification. The README states plainly that the resulting representation will be all resources present without any simplification or refinement. The output in that case gives the same information as a terraform graph listing, minus provider and variable nodes.

## TFState outside versions 3 and 4, HCL prune and empty graphs are the three common failure modes

TFState version support is bounded. State files outside versions 3 and 4 are not processed correctly, and there is no documented fallback or error message described in the README. Checking the Terraform version that produced a state file before running InfraMap is the practical step to avoid a silent failure.

The prune subcommand exists to sanitize a tfstate file by removing sensitive data before the file is shared or committed. HCL input to prune is documented as not yet supported. Teams working with HCL configurations rather than state files need to redact secrets manually before sharing.

An empty graph is the third common issue the FAQ addresses. When InfraMap returns an empty graph for a recognized provider, the explanation the FAQ gives is specific: the provider is identified, but InfraMap finds no recognized connections or relevant nodes in the input. Running with the `--raw` flag shows the full unfiltered graph, which makes it possible to confirm whether resources were parsed at all and whether the problem is the filtering logic or the input itself.

The `--hcl` and `--tfstate` flags also matter here: if InfraMap incorrectly guesses the input type, forcing the correct type with a flag may produce a result where the auto-detect path produced nothing.

## v0.8.1 on 2026-04-23, three target platforms, and no new release since the last push

Three releases appear in the repository: v0.7.0 on 2024-06-09, v0.8.0 on 2025-08-13 and v0.8.1 on 2026-04-23. The last push was on 2026-04-23, the same day as the v0.8.1 release. The repository is not archived.

The Makefile defines three target platforms: darwin, linux and windows, with two target architectures: 386 and amd64. A build-all target in the Makefile compiles binaries for each combination, and a build-compress target handles compression. The Dockerfile builds from golang:1.22.4-alpine and produces a final image on plain alpine with graphviz and ttf-dejavu installed alongside the binary. The adduser and addgroup lines in the Dockerfile set a non-root user with uid 1000, so the container does not run as root by default.

A CHANGELOG.md and a CONTRIBUTING.md both sit at the repository root. The go.mod declares a dependency on hashicorp/terraform v0.15.3 for the graph internals, hashicorp/hcl/v2 v2.13.0 for HCL parsing and awalterschulze/gographviz v2.0.3 for the graph output format.

## MIT licence and the gap between InfraMap and the provider logic it does not yet cover

InfraMap is licensed under MIT. The MIT licence permits use, modification and distribution with the attribution requirement the full LICENSE file describes. Nothing in the repository restricts commercial use.

The project is positioned as a step beyond terraform graph, but it is also limited in scope: five providers, no IAM, no Grouping outside the AWS work-in-progress, and TFState versions 3 and 4 only. For AWS users, External Nodes and the eventual Grouping feature give more context than a basic resource list. For users on Google Cloud, Azure, OpenStack or FlexibleEngine, the practical value is fewer distracting nodes compared to terraform graph, but not the deeper connectivity analysis that the AWS path aims for.

Terraform users who want IAM relationships in a graph, or who use providers outside the five with specific logic, need a different tool. Options in that space include tools that read Terraform provider schemas directly or generate graphs from cloud API data rather than from static HCL or state files. InfraMap does not document integration with any such external source, and its graph is only as current as the tfstate or HCL file supplied to it.

## Conclusion

InfraMap suits Terraform users who need a readable graph of their AWS, Google Cloud, Azure, OpenStack or FlexibleEngine infrastructure and want to skip the noise of provider and variable nodes that terraform graph emits. Avoid it when your infrastructure uses providers outside those five, because unsupported providers receive no simplification and the output is essentially a full resource listing. Before a first run on a production state file, use the prune subcommand to remove sensitive data from the tfstate, noting that prune does not support HCL input yet and that TFState versions outside 3 and 4 are not supported. IAM connection mapping is absent for every provider, including AWS.

## FAQ

### What is InfraMap?

InfraMap is a Go CLI tool that reads Terraform tfstate or HCL files and generates a graph showing only the most important resources for each supported cloud provider, producing a more readable output than terraform graph.

### How do I install InfraMap?

On macOS, brew install inframap adds the binary. Linux users can use the AUR package or download a prebuilt binary from the GitHub Releases page. A Docker image is available at cycloid/inframap on Docker Hub, and building from source requires Go 1.22 with make build.

### Why does InfraMap generate an empty graph?

An empty graph means InfraMap recognizes one of the providers in the input but finds no recognized connections or relevant nodes. Running with the --raw flag shows the unfiltered graph and confirms whether resources were parsed at all.

### Which cloud providers does InfraMap support?

Five providers have specific logic: AWS, Google Cloud, Azure, OpenStack and FlexibleEngine. All other providers are supported in a basic mode that returns all resources without simplification.

### What Terraform state versions does InfraMap support?

InfraMap supports TFState versions 3 and 4. State files from other versions are not covered, and the README does not document a fallback for them.

## Sources

- [cycloidio/inframap on GitHub](https://github.com/cycloidio/inframap)
- [Issues](https://github.com/cycloidio/inframap/issues)
- [License: MIT](https://github.com/cycloidio/inframap/blob/master/LICENSE)
- [README](https://github.com/cycloidio/inframap/blob/master/README.md)
- [Releases](https://github.com/cycloidio/inframap/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/cycloidio-inframap