Ask HN: Learning pentesting – pwnable Amazon AMIs?

I've been interested in pentesting for the entirety of my cs career. I realized recently, that one of the barriers to entry is having a lab that I can play with. Do there exist pwnable Amazon AMIs?

I'd like to be able to spin up an AMI with a known exploit on it (maybe specified to me, maybe not), and then work out the puzzle of exploiting it. I'm also willing to pay money for a service that does this (but not ~$800/month for the OSCP lab)