Secure, Audit-Ready AWS Foundation for a Canadian iGaming Operator

About the Client

The client is a fast-growing iGaming operator serving players across Canada with online sports betting and casino products in a highly regulated and competitive market.

As the Canadian iGaming operator scaled and entered newly regulated provincial markets, it needed a cloud platform that could support rapid product delivery while meeting the strict security, compliance, and operational requirements of the iGaming industry.

The client partnered with ITGix to rapidly establish a secure, governed AWS environment and prepare its infrastructure for upcoming MGA, SOC 2, Ontario (AGCO / iGaming Ontario), and Alberta iGaming compliance requirements.

Customer Requirements

The client needed to establish a production-ready cloud foundation without compromising the security and controls required by multiple gaming regulators and industry standards.

The key requirements included:

Production-ready AWS environment to support the launch and scaling of the iGaming platform.
Multi-account governance and security with centralized identity, security tooling, and consistent baseline security configuration.
Secure and scalable networking with connectivity to the existing on-premises datacenter in Malta.
Modern application platform enabling development teams to build, deploy, and operate applications with strong observability and cost efficiency.
Protection for public-facing applications against web-based attacks and abuse.
Snowflake integration for analytics and regulatory reporting.
Repeatable automated load testing to validate capacity and stability before each go-live.
Independent external penetration testing to validate the security posture of the environment.

Solution

ITGix designed and implemented the AWS foundation and application platform for the client using the ITGix AWS Landing Zone and ITGix Application Development Platform (ADP).

The Landing Zone provided a governed AWS organization with centralized identity, security tooling, baseline security controls, and a centralized hub-and-spoke network. On top of this foundation, ITGix deployed the ADP to provide the client’s engineering teams with a production-grade, Kubernetes-based application platform.

The environment was designed to be audit-ready against the applicable gaming and security standards. The primary AWS region is ca-central-1 (Canada), with us-east-1 used only for global services such as CloudFront-scoped WAF.

AWS Landing Zone: Governance & Security

The ITGix AWS Landing Zone established a structured multi-account AWS Organization, separating governance, security, shared services, and workloads into dedicated accounts and Organizational Units.

The environment included:

Management – organization root, consolidated billing and budgets, and Identity Center home.
Security – delegated administrator for security services and Identity Center.
Logging & Audit – centralized CloudTrail, AWS Config, and log archive.
Shared Services – centralized networking, CI/CD pipelines, and shared workloads.
Dev – development workloads.
Staging – staging workloads.
Production – production workloads.
Key governance and security capabilities included:
AWS IAM Identity Center (SSO) providing federated, least-privilege access across all accounts, with per-account CLI profiles for engineers.
Just-in-Time (JIT) access through the TEAM tool, providing time-bound, approved privilege elevation instead of standing privileged access.
Centralized security tooling including Amazon GuardDuty, AWS Security Hub, Amazon Macie, Amazon Inspector, AWS CloudTrail, and AWS Config.
Findings and logs aggregated into dedicated Security and Logging & Audit accounts.
Service Control Policies (SCPs) enforcing preventive guardrails, including approved-region restrictions, encryption enforcement, and protection against log deletion.
A consistent baseline security configuration across accounts, with logging and evidence collection structured to support MGA, SOC 2, and provincial iGaming audits.

Centralized Hub-and-Spoke Networking

The network follows a centralized hub-and-spoke model, with the Shared Services account acting as the hub.

AWS Transit Gateway interconnects the spoke application VPCs and shared services, with dedicated route tables enforcing segmentation between environments.
AWS Network Firewall inspects and filters all outbound traffic from the VPCs, with firewall rules managed as code in Terraform.
AWS Client VPN provides secure engineer access to internal-only tooling such as ArgoCD and Grafana.
AWS Site-to-Site VPN connects the AWS Transit Gateway to the on-premises datacenter in Malta over redundant IPsec tunnels.
Standardized automated VPC provisioning ensures consistent subnet design, routing, and security controls across accounts.

Application Development Platform (ADP)

On top of the Landing Zone, ITGix deployed the Application Development Platform (ADP) – a Kubernetes-based platform giving Canadian iGaming operator’s engineering teams a standardized, GitOps-driven way to build, deploy, and operate their applications, with observability and autoscaling built in.

The platform is built entirely on open-source components, avoiding vendor lock-in and applying security practices used in FinTech and payment environments, making it ready to support SOC 2 / PCI-DSS-grade requirements.

Core platform components

Amazon EKS (Kubernetes) – container orchestration foundation for application workloads.
ArgoCD – GitOps-based continuous delivery and declarative deployments.
Prometheus – metrics collection and monitoring.
Grafana – dashboards, visualization, and alerting.
Loki + Fluent Bit – centralized log aggregation and shipping, also forwarded to CloudWatch in the Logging & Audit account.
Karpenter – just-in-time node autoscaling for cost-optimized compute.
External Secrets Operator (ESO) – synchronizes secrets from AWS Secrets Manager into Kubernetes as native Secret objects.
External DNS + AWS Load Balancer Controller – automated DNS records and ingress/ALB management.
Kyverno – Kubernetes policy enforcement.
Amazon Aurora MySQL (Serverless) – managed relational database backing the applications.

The delivery platform operates across dev2, dev, staging, and prod, with each environment having its own EKS cluster and ArgoCD/Grafana endpoints.

GitOps is used across the platform: Kubernetes components and applications are managed by ArgoCD, while infrastructure is defined in Terraform. Amazon Inspector scans ECR images and EKS node OS packages for CVEs, while GuardDuty provides EKS runtime threat detection and findings are triaged in Security Hub.

Data Layer & Backups

The applications are backed by Amazon Aurora MySQL 8.0 clusters with encryption at rest, automated continuous backups, and point-in-time recovery (PITR) to within approximately the last five minutes.

The backup architecture includes:

Daily automated RDS snapshots retained for 5 days per environment.
EFS backups automatically stored in a per-environment vault with 35-day retention.
A backup vault provisioned by the Landing Zone in each account, reserved as an additional future backup layer, with vault lock available for compliance.
Immutable infrastructure practices, with infrastructure rebuilt from Terraform and application containers redeployed from images in Amazon ECR, reducing the need for traditional backups for these components.

Data Ingestion & Snowflake Integration

To support analytics, regulatory reporting, and marketing operations, ITGix implemented automated data ingestion pipelines centered on a dedicated production data lake S3 bucket.

The architecture includes:

Data lake → Snowflake storage integration – Snowflake reads curated data from the production data lake bucket by assuming a scoped cross-account IAM role secured with an external-ID condition, following Snowflake storage-integration best practices with read-only, least-privilege access.
Snowpipe auto-ingest – GeoComply transaction-log files in Parquet format landing under a dedicated data-lake prefix automatically trigger S3 event notifications to a Snowflake Snowpipe queue.
GeoComply ingestion pipeline – a containerized EKS pipeline using IAM Roles for Service Accounts (IRSA) for keyless, least-privilege S3 access.
Marketing leads → Snowflake – partners upload lead files through managed SFTP using AWS Transfer Family into S3; an s3:ObjectCreated event triggers a container-image Lambda that loads the leads into Snowflake.
AWS Secrets Manager – used to retrieve Snowflake credentials rather than embedding them in pipelines.
Amazon SNS – used to notify business stakeholders by email when ingestion failures occur.
Amazon MSK Serverless / Kafka – supports push-messaging services, with EKS workloads authenticating through IAM SASL and IRSA.
Sigma BI integration – a dedicated prefix-scoped storage-integration role allows the Sigma analytics platform to manage audit logs in the data lake.

All ingestion roles are least-privilege and defined as code in the Landing Zone Terraform, while credentials are stored in Secrets Manager.

Malta On-Prem & Database Replication

The client operates an existing on-premises datacenter in Malta, which is integrated with AWS and provides an additional off-cloud data resilience layer.

The environment includes:

Two HPE ProLiant DL360 Gen10 servers, configured as primary and secondary systems.
A Cisco Catalyst C9300 switch providing the access layer.
Hardened, IP-whitelisted management access.
AWS Site-to-Site VPN connectivity between the Malta datacenter and AWS Transit Gateway through two redundant IPsec tunnels using strongSwan, IKEv2, and AES-256/SHA-512.
Active/passive routed connectivity between the on-premises network and AWS VPC address space.
AWS DMS (Serverless) replication of the production Aurora database to the on-premises servers in Malta.

As a last-resort disaster recovery path, the database dump maintained on the Malta backup server can be transferred back into AWS over the existing VPN connection and imported into a fresh Aurora cluster, providing data recovery even in the event of complete cloud-side data loss.

Edge Protection: Cloudflare & AWS WAF

Public-facing applications are protected through a layered edge security architecture.

Cloudflare provides DNS, CDN, and DDoS protection in front of the applications.
Cloudflare Zero Trust gates access to sensitive back-office applications such as the CMS/back-office.
AWS WAF Web ACLs are attached to the public-facing load balancers for application front ends and wallet/back-office services.

The WAF rule set includes:

AWS IP reputation to block known-bad IPs early.
Rate limiting at 2,000 requests per 5 minutes per IP, with an exception for trusted internal NAT gateway IPs.
AWS Bot Control for inspecting and labeling bot traffic.
Allowance for verified bots based on AWS Bot Control labels.
AWS Managed Rules covering Common, SQLi, Known Bad Inputs, and Linux rule sets.
Public access to /images/*.
Geo allow for requests where cf-ipcountry = CA.
IP allow-lists for trusted ITGix, developer, and payment-provider IPs outside Canada.
Default action: BLOCK.

The wallet backend service is additionally protected through an IP allow-list implemented using a managed prefix list on its load balancer security group.

Disaster Recovery

The environment is designed for fast, code-driven recovery.

RPO: ~0 (zero data loss) – application containers are stateless; source code and images are stored in Git and ECR, while application state resides in the database and is restored from a point-in-time snapshot.
RTO: 30–60 minutes – redeploying an existing image from ECR through the CI/CD pipeline takes minutes, while rebuilding from source adds approximately 5–10 minutes.
Infrastructure as Code – VPCs, Transit Gateway, VPN, Network Firewall, IAM, Identity Center, EKS, and security controls are declared in Terraform with state stored in versioned S3 buckets.
Database recovery – Aurora PITR provides typical recovery in 15–30 minutes, with AWS Backup and the Malta on-premises dump serving as secondary and last-resort options.

Compliance & Audit Readiness

The platform was built to be audit-ready across multiple standards in parallel:

MGA – Malta Gaming Authority
SOC 2
Ontario – AGCO / iGaming Ontario
Alberta iGaming

Supporting controls include organization-wide CloudTrail and Config, centralized logging with SCP-enforced log-deletion protection, encryption at rest and in transit, time synchronization through chrony on EKS nodes, documented change and incident management, patch management for infrastructure and application images, and structured evidence collection.

Security Validation: External Penetration Test

An independent external penetration test was performed on the infrastructure by GLI.

The assessment resulted in 0 critical findings, while the remaining lower-priority findings were patched and resolved within two weeks after the penetration test report was created.

Automated Load Testing & Go-Live Readiness

To de-risk each go-live, ITGix built an automated load-testing platform and ran multiple rounds of testing against staging and production.

The solution includes:

A containerized k6 test runner executing load tests as containerized tasks on an Amazon ECS Fargate cluster in the Shared Services account.
GitHub Actions orchestrating repeatable, on-demand, version-controlled tests.
AWS SSM Parameter Store controlling test parameters including target environment, product, scenario type, virtual users, and ramp-up / hold / ramp-down durations.
Multiple test suites covering login/session, game browsing, sign-up, wallet/payments, staff journeys, and realistic end-to-end journeys.
Parallel test execution with controlled handling of Cloudflare WAF rate limiting.
Self-service HTML reporting published automatically to an S3 + CloudFront site.
Full observability through Grafana, Loki, Tempo, and RDS Performance Insights.

Testing was performed progressively, from approximately 100 up to 500+ virtual users, together with individual feature scenarios, steadily increasing confidence in platform capacity and stability ahead of launch.

Application Performance Optimization

Beyond building and operating the platform, ITGix added software developers to the project to work directly alongside the Canadian iGaming operator’s engineering teams and optimize application performance ahead of go-live.

Using load-testing results and platform observability data from Grafana, Loki, Tempo, and RDS Performance Insights, the teams:

Identified and helped resolve application-level bottlenecks such as long container startup and cache-warmup times, expensive per-request queries, and blocking initialization on the critical path.
Advised on database access patterns, including separating read and write traffic across the Aurora writer and reader endpoints to support horizontal scaling under load.
Tuned connection pooling, readiness/startup probes, and cache-warmup behavior to improve startup times and stability during traffic spikes.
Fed the findings back to the development teams as prioritized recommendations and validated the improvements in subsequent testing rounds.

This hands-on collaboration ensured that performance issues were identified and addressed before launch rather than in production, reducing go-live risk.

Business Outcomes

By combining the ITGix AWS Landing Zone with the ITGix Application Development Platform, the client gained a secure, governed, and audit-ready AWS foundation in a short timeframe.

Secure & Governed AWS Environment

The multi-account organization, centralized SSO, JIT access, security tooling, and SCP-enforced baseline established a consistent and enforceable security posture across the environment.

Scalable Application Platform

The Kubernetes-based ADP enabled development teams to deploy and operate applications rapidly, with strong observability through Prometheus, Grafana, Loki, and Fluent Bit, together with cost-efficient scaling through Karpenter.

Resilient Data Architecture

Production data resilience was reinforced through Aurora PITR, automated snapshots, AWS Backup, and replication of the production database to the Malta on-premises servers through AWS DMS.

Strong Edge Protection

Cloudflare Zero Trust, Cloudflare DDoS protection, and a layered AWS WAF rule set protected public-facing applications and sensitive back-office services.

Governed Analytics & Regulatory Reporting

Automated data ingestion pipelines integrated the environment with Snowflake through an S3 data lake, Snowpipe auto-ingest, GeoComply, SFTP-based marketing lead ingestion, and Kafka-based streaming.

Validated Security & Performance

The infrastructure was independently validated through an external GLI penetration test with 0 critical findings, while automated k6 load testing and platform observability were used to validate capacity and stability ahead of go-lives.

Ready for Regulated Growth

The client is now positioned to meet the security and compliance requirements of the MGA, SOC 2, Ontario, and Alberta iGaming regulators, while having a scalable foundation for continued growth.