The pmapperCommand in runAllChecksCommand was missing the
PmapperDataBasePath parameter, causing --pmapper-data-basepath to be
ignored for the pmapper module when running all-checks. (Fixes#105)
The instances module had a race condition where role analysis ran before
the receiver goroutine finished collecting all MappedInstances. This
caused IsAdminRole and CanPrivEscToAdmin columns to appear empty in
all-checks despite pmapper data being available. Fixed by signaling
the receiver to stop and waiting for it to drain before running role
analysis.
Version bumped to 2.0.4.
awsservicemap v1.1.0 switched to URL-based service slugs, breaking all
commands that used the old identifiers. Affected slugs and their fixes:
secretsmanager -> secrets-manager (resource-trusts, inventory)
ssm -> systems-manager (inventory)
elb -> elasticloadbalancing (endpoints, inventory, network-ports)
es -> opensearch-service (endpoints, inventory, resource-trusts)
mq -> amazon-mq (endpoints, inventory)
stepfunctions -> step-functions (inventory)
sagemaker -> sagemaker-ai (env-vars)
clouddirectory -> directoryservice (directory-services)
kinesis -> streams (inventory)
lightsail -> amazonlightsail.com (endpoints, env-vars, network-ports)
Each mismatch caused IsServiceInRegion to return false for all regions,
silently skipping enumeration of that service entirely.
awsservicemap v1.1.0 changed to a URL-based service identification format.
The secrets module was passing old-style slugs ("secretsmanager", "ssm") to
IsServiceInRegion, which never matched the new URL-derived slugs
("secrets-manager", "systems-manager"). This caused 0 tasks to be queued
and no secrets to be returned despite secrets existing in the account.
Joseph Barcia