Please accept my apologies. I was under the mistaken impression that I had outlined some of the difficulties previously upthread. Allow me to remedy this error.

Please accept my apologies. I was under the mistaken impression that I had outlined some of the difficulties previously upthread. Allow me to remedy this error. Having control over the virtualization as the host offers a lot of power to protect yourself, contain your infected virtual machines, and perform analysis. Using EC2 instances as your victims means giving up much of that. For example, I don't know of a way offhand to perform a full memory dump of a running EC2 instance without its cooperation. Memory dumps can be very useful forensic data, but Volatility cannot be run against an EC2 instance. Other items that come to mind include the ability to falsify clock behavior, more or less arbitrary simulated hardware, and the ability to pause execution. All of these can be very useful in malware analysis. Also, needless to say, running live malware so you can passively watch its live behavior without isolating it from the world is perhaps not ideal behavior. No responsible engineer wants to see their analysis machine involved in an attack. Such things have happened when insufficiently cautious engineers, with the purest and greatest of intentions, hooked up live malware to the internet. I hope these points have helped you understand. Please don't hesitate to ask if you have further questions.