The catch at `autoscaling_edges.py:60` was written for exactly this loop, and it is aimed one exception class too narrow. A disabled region answers you: the call comes back as an authorization or region error, botocore raises `ClientError`, PMapper logs "Continuing" and moves on. Fifteen regions did that [4][6]. me-south-1 did not answer at all, the connect attempt timed out, and `ConnectTimeoutError` is not a `ClientError`, so it walked straight past the handler and out of the process [5][6].
The second half of the failure is the write strategy. Auto Scaling edges are the first of nine edge checks, and the file is only written after the ninth returns, so the map that four minutes of read calls had assembled was still in memory when the interpreter exited [7]. The arithmetic on the wall clock: 5:52 is 352 seconds [1], the tester puts the inventory phase at roughly the first four minutes, which leaves about 112 seconds spread over sixteen region attempts, near seven seconds each [2]. Retrying buys you the same four minutes and the same crash, because any endpoint in that loop that goes quiet instead of refusing lands on the same handler, and the line has not changed on main since 2022-02-03 [10].
Every later command needs that file. Six of the seven remaining ones ended in `ValueError: Did not find file at` [8]. `graph list` exited cleanly and printed `Account IDs:` with nothing under it [9]. That command's only job is reporting what graph exists, and here it had nothing to report. Seven of the eight commands run returned nothing usable [4].
Getting to the crash costs something too. PMapper 1.1.5 will not import on Python 3.10 or later, because it does `from collections import Mapping`, while its setup metadata advertises Python 3.5+, so pip installs it without complaint and the failure surfaces at runtime; the real ceiling is 3.9, end of life since October 2025 [11]. The tester, writing on dev.to, declined to patch the import on the grounds that a patched copy is not the published tool [12]. cloudfox took under a minute: download the binary, check the hash, run it [13].
cloudfox's run is clean, and its counts describe iam-vulnerable rather than your account [1][14]. The density it reports, roughly 64 permission grants per principal [3], is a property of the lab. What transfers is the column: `CanPrivEscToAdmin?` appears 140 times and every cell reads "Skipping, no pmapper data" [15]. In the lab's three-role chain, one row says `ending-role` trusts `intermediate-role` and is admin, and the row below says `intermediate-role` trusts `starting-role`, so every step is present and the traversal is left to you [18]. A head-to-head on path finding turned into one engine plus a display layer for it [19].
