This paper provides background context on classic intrusion analysis frameworks, and shows how the transition to the cloud undermines some of its key premises, naturally disrupting modern attacker intrusion methods, i.e. “breaking intrusion kill chains”. This paper outlines how to use both the classic intrusion analysis framework and the AWS Cloud to address external threats to your AWS environment’s security.