LUX MED Group builds security and speed into its insurance platform on AWS

LUX MED Group is Poland's leading private healthcare group and part of the international Bupa family. The group's offering also includes insurance, with over a million insured patients, and that business runs on AWS end to end: quoting, policy administration, claims intake and billing, delivered by microservices across more than 35 AWS accounts and built jointly by in-house teams and external development partners.

The platform had grown quickly and successfully, with several teams delivering to it. That pace brought the natural side effects of scale: infrastructure concentrated in one large codebase, environments that took real effort to keep aligned, and security findings spread across every account with no single place to review them. At the same time, regulatory expectations for insurers kept rising, with DORA joining GDPR from 2025.

Where a platform prices risk, issues policies and pays out claims, security is not a project with an end date. LUX MED Group recognized that the platform's foundations should keep pace with the business and decided to invest in them, engaging AWS Partner Chaos Gears under the Migration Acceleration Program (MAP) to modernize governance, network, security operations, privileged access, and the way infrastructure itself is built and changed.

Solution Governance: strong foundations, small blast radius

Working closely with Chaos Gears, LUX MED Group set out to translate its regulatory obligations into a multi-account AWS structure with hard boundaries built in from the start. Together, the two teams designed dedicated accounts that enforce separation of duties at the platform level, keeping the security stack and the audit trail beyond the reach of workload teams. LUX MED Group's own understanding of its compliance requirements shaped the account model directly: each environment, from development through UAT and pre-production to production, runs in its own workload account, so experimental work stays away from production data by construction, not just by policy.

Behind each requirement sits a named AWS service. AWS Organizations underpins the boundaries themselves. AWS CloudTrail records activity across the organization into a central archive, making every action attributable, which supports both the security measures GDPR requires and the organization's ability to demonstrate them. AWS Config maintains a complete history of configuration changes, giving the change-management traceability the compliance team relies on. AWS KMS customer-managed keys deliver encryption at rest for sensitive data, and AWS IAM Identity Center, federated with the corporate identity provider, ensures permissions are granted, reviewed and revoked in a single place.

The network follows the same philosophy. A hub-and-spoke design built on AWS Transit Gateway connects the accounts, traffic to AWS services stays private thanks to centralized VPC endpoints, and DNS is resolved consistently through shared Amazon Route 53 resolvers. Each of these decisions was documented as an architecture decision record and handed over to LUX MED Group, so the reasoning stays with the platform.

One view of security for the entire organization

Visibility was the challenge, so Chaos Gears made centralization the core of the solution. AWS Security Hub runs under central configuration from a delegated administrator in the dedicated security account: security standards and policies are defined once and applied to every account in the organization automatically, with findings aggregated across accounts and regions into a single view.

Amazon GuardDuty provides threat detection across the entire organization: enabled once in the security account, it enrolls every member account automatically, with runtime monitoring watching workloads as they run. Amazon Inspector was enabled organization-wide for Amazon EC2 instances, container images in Amazon ECR and AWS Lambda functions, with findings retained and routed through Amazon EventBridge into alerts: a newly detected vulnerability reaches the right team in under 15 minutes, where the previous review cycle was measured in days. Each account also runs AWS IAM Access Analyzer as part of its baseline, flagging unintended external access to resources. AWS Config records configuration changes in every account, evaluating them against over 300 automated controls, and a cross-account aggregator gives the compliance team one place to check the state of the whole estate.

The effect is straightforward: instead of checking the same thing across more than 35 accounts one by one, the security team checks it once.

Privileged access with an expiry date

Standing administrative access is one of the largest risks in any regulated environment. LUX MED Group and Chaos Gears addressed it by deploying an industry-leading third-party PIM/PAM solution on AWS: a credential vault, automated credential rotation through the Central Policy Manager, and Privileged Session Manager components that record every administrative session. Built around LUX MED Group's own access requirements, Secure Infrastructure Access provides just-in-time, time-boxed elevation, so administrators receive access when they need it and lose it when they do not.

The entire stack was delivered as Infrastructure as Code with automated tests, and day-to-day engineer access is federated from the corporate identity provider through AWS IAM Identity Center, with role assignments kept in code and reviewed like any other change. For auditors this means session recordings and an approval trail. For engineers it means access that simply works, without anyone accumulating permanent privileges.

From big repositories to a hundred building blocks

The deepest change was to how infrastructure itself is made. Chaos Gears led a modernization program that restructured the shared infrastructure codebase into standardized, versioned Terraform modules, with Terragrunt keeping configuration consistent across accounts and environments. The platform is now assembled from more than 100 such modules. A security fix or improvement is now made once, in one module, and rolled out 6x faster than before the split.

This was a transformation of people and processes as much as technology. The module standards, review rules and release discipline introduced by Chaos Gears are now the shared way of working for LUX MED Group's engineers and their software vendors alike. On these foundations LUX MED Group's teams built out automated delivery, and the numbers followed: deployments that used to take 3 weeks now complete in under a day.

Outcome Security and speed, not a trade-off

Security posture for the whole organization is now visible in one place, backed by evidence. Accounts inherit the same baseline automatically, configuration changes are reported as they happen, and privileged sessions can be replayed on demand. When an auditor asks how something is controlled, the answer is a report, not a search.

The numbers make the point. Security tooling coverage went from partial to 100% of accounts, enforced automatically through central configuration, so a new account is fully covered from the moment it exists. Standing administrative access is gone entirely: permanent admin accounts have been retired in favour of just-in-time, time-boxed elevation, with every session recorded.

Delivery got faster at the same time. With environments defined entirely as code and infrastructure assembled from standardized modules, deployment lead time dropped from 3 weeks to under a day, and new environments are created by reusing building blocks instead of reinventing them. Security and speed stopped being a trade-off, which is exactly what a regulated insurer needs.

This project is one chapter of a broader story. The near real-time data platform described in our earlier case study is still growing, with new source systems and use cases coming on board, and our teams continue to work with LUX MED Group across multiple areas. It's the kind of collaboration we value most: not a single delivery, but a partnership that compounds.