What vectors and attack surfaces do we consider when creating an attack tree for applications hosted on AWS resources?

Question

When illustrating an attack tree for web and mobile applications hosted on AWS resources what vectors do we include. To start out I can include taking over a sub domain using S3 and EC2.

I have gone through these as an aid to get started:

https://downloads.cloudsecurityalliance.org/initiatives/top_threats/The_Notorious_Nine_Cloud_Computing_Top_Threats_in_2013.pdf

https://aws.amazon.com/whitepapers/#security