SaaS application vendors know it well: fixed infrastructures, known as single-tenant, are easy to deploy but have their limits, particularly in terms of maintenance. That is why we strongly advise you to move to multi-tenant. Many of you hesitate to take the step. Your fear: that your clients’ data will not be secure. Yet, on AWS, this is possible thanks to the combination of three microservices: Cognito, IAM and DynamoDB.
Having explained what a multi-tenant architecture is, we show you how to use these three services on AWS to implement it.
TABLE OF CONTENTS
- What is a multi-tenant infrastructure?
- How do you do multi-tenant with AWS?
- Organise your databases with DynamoDB
- Create your users
- Define security rules
What is a multi-tenant infrastructure?
Before going any further, let us explain the term “Tenant”: it means “lessee”, “customer”. Each customer bringing together a “group of users”.
Single-tenant model
In a single-tenant architecture, one single application is used by several clients, but each one has its own version of the application installed in a dedicated instance.
This model has several advantages:
- A clear separation between each client, and therefore between each version of the application.
- Client A’s data is not mixed with client B’s.
- Each client has its own database and its own application server.
But it can very quickly become complicated to administer. Indeed:
- The more clients there are, the harder it is to manage the different versions of the application on each infrastructure.
- The fixed cost of each infrastructure can be penalising for low-traffic clients.
- From 100 clients onwards, it is imperative to automate infrastructure management, notably with solutions such as BAM*.
- From 1,000 clients onwards, it is practically no longer manageable.
Multi-tenant model
By contrast, in a multi-tenant architecture, a single application instance serves several clients. Resources (and databases in particular) are shared there.
With a single global infrastructure, instead of one per client:
- It is easier to maintain: when a change is made to a file, every client benefits from it. Updates are simpler to carry out.
- You reduce your usage costs on the Cloud.
- Response times are much faster.
- Client management is simplified, whether there are 10 of them or 10,000.
In return, since clients’ data is mixed together, the software has to be developed to separate client data logically. We will see later that the technologies built into AWS make this difficulty easy to resolve.
Hybrid model
There is also a hybrid approach that makes it possible to optimise your infrastructure without having to make many changes to your application.
In a hybrid approach, only the application is shared. In this case, each client has a dedicated database within the same instance, as well as a login and a password. This solution has the advantage of being easy to implement while starting to make economies of scale on infrastructure costs.
How do you do multi-tenant with AWS?
When building a multi-tenant architecture, the crucial issue is, of course, to secure the data so that it is not accessible to everyone.
SaaS application developers must be able to identify a user, to link a piece of data to its tenant, but also a user to its tenant, and to know which rights have been granted to which user.
For that, on the AWS Cloud, we advise you to combine the DynamoDB, Cognito and IAM services.
Organise your databases with DynamoDB
In DynamoDB, every table in your database must have a column for storing a reference to the Tenant. As a general rule, this is a client identifier (organizationId).
Create your users
Alongside this table management, Amazon Cognito lets you add users to your SaaS applications. In a multi-tenant infrastructure, this service will list the different clients (and therefore their users and their groups) along with their identifiers. It will also associate custom attributes with each user according to the tenant they are tied to, in order to secure their authentication and manage their permissions.
What is more, AWS handles all the security and the sign-in for you. All the latest standards, notably multi-factor authentication, are available without any development on your part.
Each user is a member of a group. You can therefore manage access to data in a fine-grained way according to group.
Define security rules
Finally, with IAM (Identity and Access Management), you will define the security rules (policies) associated with each group. Thanks to these rules, filters (LeadingKey) will be created in the DynamoDB database. The user will therefore access only the data linked to the filter. They will be unable to see the rest, as if they were in a dedicated enclave.
Conclusion
Between single-tenant and multi-tenant, we advise you to choose the second infrastructure model, because it offers considerable benefits: easier maintenance, lower costs, simplified client management…
What is more, thanks to the combination of the three AWS services (DynamoDB, Cognito and IAM), data security is guaranteed there. And managing access rights to client data does not have to be done by the developer in their code. It is managed separately with AWS. This has several advantages:
- Multi-tenant management is independent of the rest of the code.
- More generally, managing access control to the data is thus independent of the SaaS application code.
- It is possible to use other services to produce statistics on data by client, notably with QuickSight.
* BAM (Build Automation Machine) is an innovative solution created by Premaccess. It automates the management and the lifecycle of your infrastructures and their deployment on AWS.
Do not hesitate to contact us with any questions or projects!