Case Study: Transforming an Enterprise IdP Solution into SaaS with AWS SaaS Builder Toolkit

AirCUVE transformed its on-premises IAM/MFA solution V-FRONT into a multi-tenant SaaS based on AWS SaaS Builder Toolkit(SBT), listing it on AWS Marketplace in just 3 months.

The key to the transformation was quickly applying a standard architecture for SaaS operations while simplifying it to fit the project goals. By restructuring SBT's original 4-Stack structure into a 2-Stack structure, they applied the Rapid SaaS Architecture, reducing initial development complexity and speeding up time to market.

The tenant strategy was divided into two tiers based on customer needs.

• Pooled Tier: For small and medium businesses, logical isolation, provisioning within 5~10 minutes
• Silo Tier: For financial and public institutions, physical isolation, provisioning within 15~20 minutes

During the cloud migration process, they built a container-based execution environment using Amazon ECS, AWS Fargate, Application Load Balancer, and AWS WAF, and codified infrastructure with AWS CDK to automatically generate tenant resources. For deployment, they applied a GitLab Branch strategy for the Control Plane and Trunk-based Development for the Application Plane, separating stability from speed.

Hybrid integration was solved with AWS PrivateLink, and observability was secured through Amazon CloudWatch, structured JSON logs, and tracing based on AWS X-Ray and OpenTelemetry. Service levels were defined as 99.99% availability, 1,000 TPS per tenant, and failure recovery within 15 minutes. In load testing, with 100 concurrent logins maintained for 15 minutes, they recorded Auth-Portal 95th percentile 416ms, Self-Service Portal 1.3s, and a total of 2,283 successful authentications.

Security and compliance were also built into the design from the start. They applied Zero Trust, TLS 1.3, AES-256, AWS KMS, and an audit system based on CloudTrail, and prepared for CSAP, ISO 27001, SOC 2 Type II, and GDPR compliance.

Entering the Marketplace also changed their sales approach. Initially, they chose a Contract model instead of complex usage-based billing, and planned to expand to Pay-as-you-go in the future. Technically, they set up a Landing API and Entitlements Handler, currently using an SNS → Lambda → DynamoDB structure but planning to upgrade to SNS → SQS → Lambda in the future to reduce event loss and race conditions. On top of this, they added CPPO(Channel Partner Private Offer) to establish a foundation for expansion into the AWS and partner ecosystem.