The common mantra of the cloud is still at play here. It is just other peoples computers. Yes, you can attach persistent storage, EBS or Elastic Block Storage,

The common mantra of the cloud is still at play here. It is just other peoples computers. Yes, you can attach persistent storage, EBS or Elastic Block Storage, to an instance. Or if you are worried about the boot drive, your golden image could be infected and every instance you start using that image will be bad. When asking about the cloud, there are 2 main things to worry about, 1) Can my deployments on the cloud be targeted and infected? Definitely, just like managing your own servers, you can need to manage your stack. This means keeping on top of security patches, proper info sec, least privileges for all tools and people, etc. You control your security, the cloud does not fix that, in fact, it offers new ways to screw up. AWS, and all other platforms, offer a lot of identity and security options, tons of networking options, etc. Like anything in security, the more secure you make it, the more hoops and red tape you put in the way of effective engineers that just want to get shit done. One thing that is easier in the cloud is letting any developer spin up some new instance to test something out. This is useful as it allowed them to be productive without waiting for 3 levels of approval, but it could be some untrusted binary with malware or could just be really shitty and cost 20K over the weekend. 2) The second thing to worry about with the cloud is, can the cloud platform be attacked? Absolutely yes. This was the worry with attacks on virtualization and CPUs themselves. I don't recall the specifics of Spectre and Meltdown, and there was another Intel specific one, but in general, they broke out of isolation. Amazon is very tight lipped on how they do virtualization[1], but if one of these attacks worked, it would be bad news. Just being on the platform could affect you by someone else launching their own EC2 instance. I will bet you dollars to donuts that AWS puts a ton of money and effort to protect against this. [1] by this point, AWS probably runs their own internal virtualization stack based on something open source from a decade ago. This is so core to their business that they would want full control. They want to squeeze every cycle they can from a CPU to charge to customers and pack instances in as much as they can, while also measuring usage to charge correctly. I've worked on measuring usage to charge customers. This is hard and I am nowhere near their scale. Additionally, they probably want more hooks for debugging, monitoring, alerting, and as we have been talking about, security.