That only goes so far though. A lot of games need internet access, so essentially you are running potentially modified binaries running on your hardware/network, that gets access to the outside. Sure, blast radius becomes somewhat limited, but you still have a potential problem.

The only games that need a network connection are online games. With those you can use a application firewall (which you should anyways) like opensnitch to only allow connections to sites that make sense and block anything else e.g. internal connection.

Unless you get your cracks from google.com it will be fine.

I know OCI isn't popular around here, but it ticks all the boxes you listed. Managed Postgres, Terraform, and Toronto/Vancouver regions. It'll end up being roughly half the cost of AWS at list for your average EC2/RDS/S3 workload.

I worked at a startup that was a supplier to Oracle for a while and had to work directly with their OCI API team. While I loathed the hubris of the “I work for Oracle” employees - the one thing they were absolutely militant about was legacy support and ensuring that if something was working it stayed working.

That said, part of the desire to get off AWS is finding slightly less nefarious set of characters to hand money to and Ellison (and his lot) doesn’t fit the bill.