[fragmede]

Define 'attack'.

Setting up vulnerable software on your VPS and then exploiting vulnerabilities on that software to allow you, the owner of the VPS, to get root access in a method you would otherwise be unable to, is fine.

Exploiting the VPS itself to exercise a bug in Xen/whatever to gain access to the hypervisor, access you would not originally be granted, is much less clear cut. Amazon has a bug-bounty program for EC2, and would very much like to hear about bugs you find in this space though.

https://aws.amazon.com/security/vulnerability-reporting/

[TempaTaccount]

Definitely the former, not interested in attacking the hypervisor or AWS itself at all.

Just want to generate stuff to investigate in the honeypot.

[mobiplayer]

Do not make it publicly available (e.g. put it behind a VPN). Otherwise someone might be faster than you to get root access and use your server for other illegal stuff (e.g. join a DDoS). You don't want that to happen as it could be considered you've been negligent.