We investigate three recent AWS security incidents and discuss how canaries could help you detect these early, and throughout the attack lifecycle.