Aligning AWS security capabilities with standards and security frameworks for the Betting and Gaming industry – Part 1

The Betting and Gaming industry operates in one of the most heavily regulated environments in technology. Gaming operators and suppliers must demonstrate compliance with rigorous technical standards, many of which reference standards published by Gaming Laboratories International (GLI). The most widely referenced GLI standards for this industry are GLI-19 (Interactive Gaming Systems) and GLI-33 (Event Wagering Systems), establishing technical benchmarks for platform security, data integrity, player protection, and operational transparency.

For customers, the challenge isn’t whether to implement robust security, but how to do so efficiently using AWS services. This blog post describes how Amazon Web Services (AWS) security best practices, using the AWS Security Improvement Program (SIP) and the Security pillar of the AWS Well-Architected Framework, can help operators strengthen their cloud security posture in areas that are commonly relevant to regulated industries, including real money gaming. This is Part 1 of a two-part series and covers foundational security capabilities.

Important: The descriptions herein are framed as general-purpose capability overviews. Nothing in this document constitutes regulatory, legal, or compliance advice. Customers are solely responsible for determining how, or whether, AWS services address their specific regulatory obligations. The AWS Shared Responsibility Model defines the division of security responsibilities between AWS and its customers. AWS is responsible for security of the cloud (physical infrastructure, hardware, networking, and managed service components), while customers are responsible for security in the cloud (data, access management, application configurations, and compliance obligations). Using AWS services doesn’t automatically make your use case compliant. The controls described in this post represent AWS customers’ responsibility within the AWS Shared Responsibility Model. Your compliance posture depends on how you configure and use AWS services for your use case.

GLI standards overview

GLI-19 (Interactive Gaming Systems) is the global benchmark for iCasino, online poker, and iLottery platforms. GLI-19 defines technical requirements across nine domains: architecture, information security, player account management, random number generation (RNG) integrity, geolocation, encrypted communications, audit and reporting, responsible gaming, and change management.

GLI-33 (Event Wagering Systems v1.1) addresses online and mobile sports betting platforms across 20 domains and 66 controls. These controls include architecture, information security, geolocation, know-your-customer (KYC), responsible wagering, financial controls, anti-fraud monitoring, data feed integrity, change control, and independent certification.

GLI also publishes the Gaming Security Framework (GLI-GSF), a suite of information security audits (GSF-1 through GSF-5) covering controls, technical assessments, vendor audits, and both land-based and online environments. GLI-GSF aligns closely with the CIS principles.

Both GLI-19 and GLI-33 share common security themes that are relevant to the five pillars of the AWS Security Improvement Program (SIP), as described in the AWS re:Post article on SIP. The pillars are:

• Identity and access management
• Detection and monitoring
• Infrastructure protection
• Data protection
• Incident response

The following sections describe ways you can configure AWS services to support your security objectives. This content reflects generally available AWS capabilities as of the date of publication and is informational only.

Information security and data protection

Security theme: Comprehensive security management, encryption at rest and in transit, regular security assessments, and personally identifiable information (PII) protection.

AWS capabilities:

• AWS Key Management Service (AWS KMS) with customer-managed keys enforces default encryption across data stores, with full control over rotation and access policies.
• Amazon Macie provides continuous, automated personally identifiable information (PII) discovery across Amazon Simple Storage Service (Amazon S3) buckets.
• AWS CloudHSM provides Federal Information Processing Standards (FIPS) 140-2 Level 3 hardware-validated cryptography for workloads that require it.
• AWS Security Hub aggregates security findings with CIS and NIST conformance packs into a consolidated view of security posture across accounts.
• Amazon Inspector provides automated, continuous vulnerability scanning.

Identity and access management

Security theme: Multi-factor authentication (MFA), know-your-customer (KYC) verification, role-based access control (RBAC), session timeout controls, and separation of duties.

AWS capabilities:

• Amazon Cognito threat protection provides adaptive multi-factor authentication (MFA), compromised-credential detection, and risk-based authentication challenges. If you require KYC verification for your gaming platforms, you can integrate your chosen third-party KYC providers using Amazon API Gateway. AWS doesn’t provide, certify, or manage KYC solutions. The selection, integration, and regulatory compliance associated with any KYC solution is your sole responsibility.
• AWS Identity and Access Management (IAM) permission boundaries and AWS Organizations service control policies (SCPs) enable least-privilege enforcement and functional separation between production and administrative environments.
• Attribute-based access control (ABAC) using federated session tags dynamically scopes engineer access by jurisdiction without role sprawl.
• IAM Access Analyzer identifies unintended resource sharing.

Audit trail and logging

Security theme: Complete, tamper-evident audit trails for all transactions, time-synchronized logs, log retention for regulator-specified periods (often 5–7 years), and regulator access to audit data.

AWS capabilities:

• AWS CloudTrail records all API activity across all AWS Regions with log file integrity validation, producing cryptographically verifiable audit records.
• Amazon S3 Object Lock in compliance mode (write-once-read-many) prevents log data from being deleted or modified during the configured retention period.
• A centralized Log Archive account (part of the AWS Security Reference Architecture) with AWS KMS encryption managed through a dedicated security account prevents operational teams from modifying audit data.
• Amazon Time Sync Service provides sub-millisecond accuracy critical to transaction sequencing.
• Amazon CloudWatch metric filters and alarms enable detection of specific API patterns.

Network security and infrastructure protection

Security theme: Encrypted communications between all components, network segmentation, intrusion detection, distributed denial of service (DDoS) protection, and secure remote access.

AWS capabilities:

• Amazon Virtual Private Cloud (Amazon VPC) enables multi-tier network architectures separating workloads across public, private, and isolated subnets.
• AWS Shield Advanced provides distributed denial of service (DDoS) protection with always-available access to the Shield Response Team, which is critical for enhanced protection during peak demand periods.
• Amazon GuardDuty provides continuous threat detection across accounts, and AWS WAF provides Open Worldwide Application Security Project (OWASP) rules, rate limiting, and bot control.
• AWS Direct Connect with MACsec encryption provides dedicated, encrypted network connectivity for environments using AWS Outposts.
• AWS Lambda can drive automated threat response, such as AWS WAF IP deny list updates triggered by log anomaly detection.

Multi-account strategy

A multi-account structure (part of the AWS Security Reference Architecture) is an AWS best practice for customers operating across multiple regulatory environments, regardless of industry. At minimum, use separate accounts for production, staging, QA, log archive, and security tooling. You can further segment production accounts based on your operational and compliance requirements; for example, you can segment accounts by business unit, geography, or workload classification.

AWS Organizations SCPs can help enforce preventive guardrails that apply uniformly regardless of IAM permissions within member accounts. Examples include denying resource creation outside approved AWS Regions or preventing the disabling of CloudTrail. This structure helps confine a security event to a single account and keeps audit evidence independently verifiable.

Continued in Part 2

Part 2 of this series covers gaming-specific controls and resilience, including geolocation and jurisdictional compliance, random number generation, responsible gaming and anti-fraud, change management and incident response, and disaster recovery, along with a recommended getting-started sequence.

Disclaimer: This article represents general architectural guidance and does not constitute legal, regulatory, or compliance advice. AWS services described herein are general-purpose capabilities available to customers across all industries. Nothing in this document should be interpreted as a representation by AWS that any service, configuration, or architectural pattern satisfies any regulatory requirement, certification standard, or legal obligation.

Customers are solely responsible for assessing and fulfilling their own compliance and regulatory obligations, including consulting their own legal counsel, licensed gaming suppliers, and the relevant regulatory authorities for their jurisdictions.