[JorgeGT]

While this is true, I have the feel that third party VPN companies would be more interesting targets for intrusions, both from private and state-backed actors. Also, VPN-company traffic logs could be a tempting asset to sell or steal.

On the other hand, your lonely AWS instance is a drop in the sea of Amazon vast traffic. Amazon has plenty of other valuable assets and revenue streams that would be more interesting than traffic logs. Nor has Amazon a reason to analyze outbound traffic for each of their millions and millions of instances.

Of course, if someone is actually tracking you, identifies your instance and has the capability to collect and filter outbound AWS traffic leaving your instance, this approach is not valid.

Then again, if someone like this is tracking you, VPNs are probably the least of your worries...

[nickpsecurity]

"While this is true, I have the feel that third party VPN companies would be more interesting targets for intrusions, both from private and state-backed actors. Also, VPN-company traffic logs could be a tempting asset to sell or steal."

Exactly. They'll either be malicious themselves or have a pile of secrets in one place increasing the odds that those who come a hackin' have more skill and dedication than average. I also haven't seen evidence that they're great at securing systems on average. That could be a sampling error but lots of security suppliers aren't that secure. A well-vetted, open solution that can be deployed on user-controlled hardware or VM's is more trustworthy.