RhinoSecurityLabs's cloudgoat environment could be a great addtion to your vulnerable targets list.
Link to repo: https://github.com/RhinoSecurityLabs/cloudgoat
Played with it myself a bit, and it's a great package with little to nothing monthly costs