Mappru

VPC Route Tables

Manage VPC route tables and routes as reviewable Ruby code

Manages: Amazon VPC Route Tables
Language: Ruby
Package: mappru
CLI: mappru
Config file: Routetable

The mappru repository is archived on GitHub with no activity since 2018, so treat it as legacy tooling and prefer Terraform for new VPC routing setups.

Routetable

vpc "vpc-12345678" do
  route_table "foo-rt" do
    subnets "subnet-12345678"
    route destination_cidr_block: "0.0.0.0/0", gateway_id: "igw-12345678"
    route destination_cidr_block: "192.168.100.101/32", network_interface_id: "eni-12345678"
    route destination_cidr_block: "192.168.100.200/32", ignore: true
  end
end

In short

Mappru is a Ruby command-line tool that manages Amazon VPC route tables as code. It exports your route tables, routes, and subnet associations into one file called a Routetable. You review each change in Git, dry-run it, then apply it idempotently.

What is Mappru?

Mappru is a Ruby command-line tool in the codenize-tools family. It manages VPC route tables as code. You describe the route tables you want in one file, and Mappru updates the VPC to match. It follows the same codenization pattern as the rest of the family.

Routing is some of the riskiest config in a VPC. A wrong default route or a deleted peering route can take a whole environment offline. Yet people edit route tables by hand during incidents and never write it down. Mappru makes the routing layer plain text. Each route table declares:

Routes - a destination CIDR plus the gateway, NAT, or interface it points to.
Subnet associations - which subnets use the table.
Ignored routes - entries left for other systems to manage.

Every route now lives in Git, so a change is a diff a colleague can review before it hits the network. Mappru rounds out the VPC layer alongside Piculet for security groups.

Key facts

Manages VPC route tables, their routes, and subnet associations.
The whole routing layer lives in one Ruby DSL file, the Routetable.
Mark a route ignore: true to leave appliance-managed entries alone.
Scope a run by --vpc-id or --rt-name to keep blast radius small.
A dry-run shows every route change first; the apply is idempotent.
Rounds out the VPC layer with Eipmap for Elastic IPs.

Illustration: Amazon VPC Route Tables managed as code with Mappru

Getting started

Install and run Mappru

Install

Install the mappru gem (Ruby required).

$ gem install mappru

Export current state

Pull the live VPC Route Tables configuration into a Routetable.

$ mappru -e -o Routetable

Dry-run, then apply

Preview the diff, then apply the change for real.

$ mappru -a --dry-run

Mappru runs the export, review, apply loop on the part of AWS where mistakes hurt most. Begin in export mode (the -e flag) to pull the current route tables, scoping with --vpc-id if needed, and commit the Routetable to Git.

Every routing change is then a pull request. Edit the file, run the apply with --dry-run, and include the diff so it is clear which routes will be created, replaced, or deleted. After approval, apply for real. The apply is idempotent. Because people also edit routes by hand during incidents, a scheduled dry-run doubles as drift detection: any emergency console change shows up as a diff to codify or revert.

Pro tip

Read the dry-run twice before applying to a production VPC. A single wrong default route can black-hole an entire subnet, so treat routing diffs with extra care.

Capabilities

What Mappru can do

Routes and associations per VPC

Route tables sit inside vpc blocks with their subnet associations and routes. Internet gateway, NAT, and interface targets all read in one file.

Ignore flag for external routes

A route marked ignore: true is left untouched. Routes managed by appliances or controllers can coexist with codenized ones.

Export the current routing state

Export mode dumps existing route tables into the DSL. Adopting Mappru on a long-lived VPC starts from reality, not a blank file.

Dry-run before touching the network

The dry-run prints the exact routes and associations that would change. That matters here more than almost anywhere, since routing mistakes cause outages.

Scoped runs by VPC or table

The --vpc-id and --rt-name options take regexes to limit a run to specific VPCs or tables. Blast radius stays small in shared accounts.

Idempotent apply and split export

Re-running the apply makes no duplicate changes. The --split option writes each definition to its own file for cleaner reviews.

Route targets you can declare

Each route in a route_table block points at one of these targets.

DSL key	Routes traffic to
`gateway_id`	An internet gateway or virtual private gateway
`nat_gateway_id`	A NAT gateway for outbound-only access
`network_interface_id`	A specific elastic network interface
`vpc_peering_connection_id`	A peered VPC
`ignore: true`	Nothing; Mappru leaves the route alone

In practice

When teams reach for Mappru

Document routing for multi-tier VPCs

Public, private, and database subnets each carry different default and peering routes. A committed Routetable is living documentation, and unlike a wiki diagram it cannot silently go stale.

Review peering and NAT changes

Adding a peering route or switching a subnet from an internet gateway to a NAT gateway is a one-line change. The pull request and dry-run give it real review.

Coexist with dynamic routing appliances

VPN or firewall appliances sometimes manage their own routes. Marking those ignore: true lets Mappru own the static routes and leave the rest, avoiding fights between automation systems.

FAQ

Mappru questions, answered

What exactly does Mappru manage?

It manages VPC route tables: the tables, their routes (internet gateway, NAT, network interface, and other targets), and their subnet associations. It does not create VPCs, subnets, or gateways, which must already exist.

Is it safe to run against a production VPC?

It is idempotent, has a dry-run that shows every change first, and offers --vpc-id and --rt-name filters to limit scope. Even so, routing changes are high-risk, so always read the dry-run carefully before applying.

What is the ignore: true option for?

Routes flagged ignore: true are excluded from management, so Mappru will not modify or delete them. Use it when appliances, controllers, or other automation maintain some routes outside the file.

Is Mappru still maintained?

No. The repository is archived, with no activity since 2018. It still works as an export and audit tool. For new environments, consider Terraform's aws_route_table, aws_route, and aws_route_table_association resources, which are actively maintained.