SlideShare uma empresa Scribd logo
1 de 25
Baixar para ler offline
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Hands-on SaaS: Constructing multi-
tenant solutions with AWS
Tod Golding
Principal Partner Solutions Architect
AWS
S V C 3 0 7
Judah Bernstein
Partner Solutions Architect
AWS
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Workshop goals
• Introduce SaaS architecture fundamentals
• Build the working elements of a SaaS environment
• Introduce real-world strategies for addressing common multi-
tenant practices
• Provide a foundation that can inform the creation of your own
SaaS solutions
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The SaaS motive
Web
App
Customer
Web
App
Customer
Web
App
Tenant Tenant Tenant
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Key concepts
On-boarding
Data partitioningApplication
services
Authentication
Service
Tenant isolation
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Not here, but key to SaaS
• Management and monitoring
• Analytics
• Operations
• Billing
• SaaS DevOps
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
High-level flow
Lab 1: Tenant onboarding
Lab 2: Multi-tenant services
Lab 3: Tenant isolation
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecting SaaS applications on AWS
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Lab 1: Onboarding
• Configure an identity provider
• Review user management service
• Provision a new user via REST API
• Review tenant management service
• Provision a new tenant via REST API
• Register a tenant via web app
• Authenticate as the new user
• Inspect the JWT token
Identity
management
Tenant
management
Tenant registration &
authentication
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Onboarding architecture
User manager
Tenant
manager
Tenant registration
Authentication
manager
Web application
Amazon API Gateway
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Configuring Amazon Cognito
User pool
User
management
POST / user
Validation
Attributes
Policies
Identity pool
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Tenant management
Tenant
manager
Generated tenant identifier
492c83ba-d565-47a8-a987-634bd01189db
Status
Active / inactive
Tier
Basic, advanced
• UserID
• TenantID
• Name
• Status
• Role
1: Many
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Onboarding flow
Amazon S3
Web
application
Authenticate
Register
Tenant
registration
Authentication
manager
APIGateway
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecting SaaS applications on AWS
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Lab 2: A multi-tenant progression
Single tenant
product manager
Multi-tenant product
manager
Add tenant security
context
• Single tenant table in Amazon DynamoDB
• Use ProductId as partition key
• No awareness of tenant identity
• Multi-tenant, pooled table in DynamoDB
• Use TenantId as partition key
• Tenant supplied as REST parameter
• Add security token to HTTP headers
• Load products for two tenants
• Verify tenant partitioning in DynamoDB
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Building application services
Application service
Identity & tenant context
Multi-tenant data partitioning
Tenantawarelogging,
metering,andanalytics
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Data partitioning model
Partition Key Product ID Title
Tenant-1 ECHO-123 Echo Dot
Tenant-3 ECHO-456 Echo Show
Tenant-1 ECHO-456 Echo Show
Tenant-4 ECHO-910 Echo Spot
Pooled multi-tenant table
Product ID Title
ECHO-123 Echo Dot
ECHO-456 Echo Show
ECHO-456 Echo Show
ECHO-910 Echo Spot
Single tenant table
Product manager Product manager
/product/id=TenantId/product
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Injecting tenant context
Product manager
JWT token
1
GetTenantId(Token)
Token manager
2
TenantId
3
4
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecting SaaS applications on AWS
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Isolating tenant data
• Alter the product manager service
• Manually inject a tenant identifier
• Verify cross tenant access enable
• Leverage policies to restrict tenant access
• Edit existing policies
• Introduce leading key conditions
• Examine roles emitted by provisioning
• Examine Amazon Cognito’s role mapping
• View the tenant admin/user mapping
• Deploy the web application
• Register a tenant
• Authenticate the new user
Cross tenant
access
Configure
policies
Map role to
policies
Get scoped
credentials
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Cross tenant access
Tenant 1
Tenant 2
Tenant-11943
Tenant-9492 Product table
Tenant identifier
Partition Key Sort Key
Tenant-9492 14019
Tenant-11943 49104
Tenant-11943 91044
Tenant-9492 85145
Tenant identifier
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Tenant-scoped policies
{
"Sid": "TenantReadOnlyOrderTable",
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:BatchGetItem",
"dynamodb:Query",
"dynamodb:DescribeTable"
],
"Resource": [
"arn:aws:dynamodb:us-east-1:000000000000:table/Order"
],
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": [
"3aecf790-7dfd-4aef-a95a-b63fc413bdc9"
]
}
}
}
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Mapping tenant roles to policies
IAM policiesAmazon Cognito
role mapping
Tenant
admin role
Tenant user
role
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Temporary credentials (the payoff)
getCredentialsForIdentity(idToken)
Application
service
Cognito
IAM role
polices
{
”custom:tenantId” : ”8391-9393-9933”
“custom:role” : “TenantAdmin”
}
Cognito ID Token (JWT)
Match role
Return role scoped credentials
Credentials": {
"SecretKey":"2gZ8QJQqkAHBzebQmghavFAfgmYpKWRqexample",
"AccessKeyId":"ASIAJIOA37R6EXAMPLE"
}
https://dashboard.eventengine.run
Launch your environment (with hash key):
https://github.com/aws-samples/aws-saas-factory-bootcamp
GitHub repository (start here):
Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

Mais conteúdo relacionado

Mais procurados

Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...
Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...
Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...Amazon Web Services
 
Living the AWS Well Architected Framework
Living the AWS Well Architected FrameworkLiving the AWS Well Architected Framework
Living the AWS Well Architected FrameworkAdam Dillman
 
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Amazon Web Services
 
마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)
마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)
마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)Amazon Web Services Korea
 
AWS Well Architected Framework - Walk Through
AWS Well Architected Framework - Walk ThroughAWS Well Architected Framework - Walk Through
AWS Well Architected Framework - Walk ThroughKaushik Mohanraj
 
Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...
Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...
Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...Amazon Web Services
 
SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...
SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...
SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...Amazon Web Services
 
Introduction to Identity and Access Management (IAM)
Introduction to Identity and Access Management (IAM)Introduction to Identity and Access Management (IAM)
Introduction to Identity and Access Management (IAM)Amazon Web Services
 
Authentication & Authorization for Connected Mobile & Web Applications using ...
Authentication & Authorization for Connected Mobile & Web Applications using ...Authentication & Authorization for Connected Mobile & Web Applications using ...
Authentication & Authorization for Connected Mobile & Web Applications using ...Amazon Web Services
 
AWS Black Belt Online Seminar AWS Key Management Service (KMS)
AWS Black Belt Online Seminar AWS Key Management Service (KMS) AWS Black Belt Online Seminar AWS Key Management Service (KMS)
AWS Black Belt Online Seminar AWS Key Management Service (KMS) Amazon Web Services Japan
 
Aws intro to cloud_economics
Aws intro to cloud_economicsAws intro to cloud_economics
Aws intro to cloud_economicsjtaylor707
 
AWS Cloud Security & Compliance Basics Webinar
AWS Cloud Security & Compliance Basics WebinarAWS Cloud Security & Compliance Basics Webinar
AWS Cloud Security & Compliance Basics WebinarAmazon Web Services
 
Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks
Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech TalksDeep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks
Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech TalksAmazon Web Services
 

Mais procurados (20)

AWS Cloud Security Fundamentals
AWS Cloud Security FundamentalsAWS Cloud Security Fundamentals
AWS Cloud Security Fundamentals
 
Migrating to the Cloud
Migrating to the CloudMigrating to the Cloud
Migrating to the Cloud
 
Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...
Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...
Hands-on SaaS: Constructing a Multi-Tenant Solution on AWS (ARC327-R1) - AWS ...
 
Living the AWS Well Architected Framework
Living the AWS Well Architected FrameworkLiving the AWS Well Architected Framework
Living the AWS Well Architected Framework
 
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...Security and governance with AWS Control Tower and AWS Organizations - SEC204...
Security and governance with AWS Control Tower and AWS Organizations - SEC204...
 
마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)
마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)
마이크로 서비스를 위한 AWS Cloud Map & App Mesh - Saeho Kim (AWS Solutions Architect)
 
AWS Well Architected Framework - Walk Through
AWS Well Architected Framework - Walk ThroughAWS Well Architected Framework - Walk Through
AWS Well Architected Framework - Walk Through
 
Fundamentals of AWS Security
Fundamentals of AWS SecurityFundamentals of AWS Security
Fundamentals of AWS Security
 
Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...
Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...
Unleash the Power of Temporary AWS Credentials (a.k.a. IAM roles) (SEC390-R1)...
 
SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...
SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...
SaaS Reference Architectures: Review of Real-World Patterns & Strategies (GPS...
 
Introduction to Identity and Access Management (IAM)
Introduction to Identity and Access Management (IAM)Introduction to Identity and Access Management (IAM)
Introduction to Identity and Access Management (IAM)
 
Authentication & Authorization for Connected Mobile & Web Applications using ...
Authentication & Authorization for Connected Mobile & Web Applications using ...Authentication & Authorization for Connected Mobile & Web Applications using ...
Authentication & Authorization for Connected Mobile & Web Applications using ...
 
AWS Black Belt Online Seminar AWS Key Management Service (KMS)
AWS Black Belt Online Seminar AWS Key Management Service (KMS) AWS Black Belt Online Seminar AWS Key Management Service (KMS)
AWS Black Belt Online Seminar AWS Key Management Service (KMS)
 
Intro to AWS: Security
Intro to AWS: SecurityIntro to AWS: Security
Intro to AWS: Security
 
Amazon API Gateway
Amazon API GatewayAmazon API Gateway
Amazon API Gateway
 
Aws intro to cloud_economics
Aws intro to cloud_economicsAws intro to cloud_economics
Aws intro to cloud_economics
 
AWS Cloud Security & Compliance Basics Webinar
AWS Cloud Security & Compliance Basics WebinarAWS Cloud Security & Compliance Basics Webinar
AWS Cloud Security & Compliance Basics Webinar
 
Managing Security on AWS
Managing Security on AWSManaging Security on AWS
Managing Security on AWS
 
AWS Security Best Practices
AWS Security Best PracticesAWS Security Best Practices
AWS Security Best Practices
 
Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks
Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech TalksDeep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks
Deep Dive on User Sign-up Sign-in with Amazon Cognito - AWS Online Tech Talks
 

Semelhante a Hands-on SaaS: Constructing multi-tenant solutions with AWS - SVC307 - New York AWS Summit

AWS DevDay Cologne - CI/CD for modern applications
AWS DevDay Cologne - CI/CD for modern applicationsAWS DevDay Cologne - CI/CD for modern applications
AWS DevDay Cologne - CI/CD for modern applicationsCobus Bernard
 
SID305 AWS Certificate Manager Private CA
SID305 AWS Certificate Manager Private CASID305 AWS Certificate Manager Private CA
SID305 AWS Certificate Manager Private CAAmazon Web Services
 
Certificate management concepts in AWS - SEC205 - New York AWS Summit
Certificate management concepts in AWS - SEC205 - New York AWS SummitCertificate management concepts in AWS - SEC205 - New York AWS Summit
Certificate management concepts in AWS - SEC205 - New York AWS SummitAmazon Web Services
 
CICDforModernApplications-Oslo.pdf
CICDforModernApplications-Oslo.pdfCICDforModernApplications-Oslo.pdf
CICDforModernApplications-Oslo.pdfAmazon Web Services
 
Serverless-First Function: Serverless application security
Serverless-First Function: Serverless application securityServerless-First Function: Serverless application security
Serverless-First Function: Serverless application securityRobSutter2
 
Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...
Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...
Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...Amazon Web Services
 
How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...
How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...
How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...Amazon Web Services
 
Control your cloud environment with AWS management tools
Control your cloud environment with AWS management toolsControl your cloud environment with AWS management tools
Control your cloud environment with AWS management toolsAmazon Web Services
 
Capital One case study: Addressing compliance and security within AWS - FND21...
Capital One case study: Addressing compliance and security within AWS - FND21...Capital One case study: Addressing compliance and security within AWS - FND21...
Capital One case study: Addressing compliance and security within AWS - FND21...Amazon Web Services
 
Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...
Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...
Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...Amazon Web Services
 
Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018
Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018
Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018Amazon Web Services
 
Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...
Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...
Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...Amazon Web Services
 
PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...
PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...
PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...Amazon Web Services
 
Modern Applications Development on AWS
Modern Applications Development on AWSModern Applications Development on AWS
Modern Applications Development on AWSBoaz Ziniman
 
Evolving perimeters with guardrails, not gates: Improving developer agility -...
Evolving perimeters with guardrails, not gates: Improving developer agility -...Evolving perimeters with guardrails, not gates: Improving developer agility -...
Evolving perimeters with guardrails, not gates: Improving developer agility -...Amazon Web Services
 
You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018
You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018
You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018Amazon Web Services
 
JFokus 2020 - How to migrate an application to serverless
JFokus 2020 - How to migrate an application to serverlessJFokus 2020 - How to migrate an application to serverless
JFokus 2020 - How to migrate an application to serverlessMarcia Villalba
 
Identity and access control for custom enterprise applications - SDD412 - AWS...
Identity and access control for custom enterprise applications - SDD412 - AWS...Identity and access control for custom enterprise applications - SDD412 - AWS...
Identity and access control for custom enterprise applications - SDD412 - AWS...Amazon Web Services
 
Websites go Serverless - AWS Summit Berlin
Websites go Serverless - AWS Summit BerlinWebsites go Serverless - AWS Summit Berlin
Websites go Serverless - AWS Summit BerlinBoaz Ziniman
 
2020-04-02 DevConf - How to migrate an existing application to serverless
2020-04-02 DevConf - How to migrate an existing application to serverless2020-04-02 DevConf - How to migrate an existing application to serverless
2020-04-02 DevConf - How to migrate an existing application to serverlessMarcia Villalba
 

Semelhante a Hands-on SaaS: Constructing multi-tenant solutions with AWS - SVC307 - New York AWS Summit (20)

AWS DevDay Cologne - CI/CD for modern applications
AWS DevDay Cologne - CI/CD for modern applicationsAWS DevDay Cologne - CI/CD for modern applications
AWS DevDay Cologne - CI/CD for modern applications
 
SID305 AWS Certificate Manager Private CA
SID305 AWS Certificate Manager Private CASID305 AWS Certificate Manager Private CA
SID305 AWS Certificate Manager Private CA
 
Certificate management concepts in AWS - SEC205 - New York AWS Summit
Certificate management concepts in AWS - SEC205 - New York AWS SummitCertificate management concepts in AWS - SEC205 - New York AWS Summit
Certificate management concepts in AWS - SEC205 - New York AWS Summit
 
CICDforModernApplications-Oslo.pdf
CICDforModernApplications-Oslo.pdfCICDforModernApplications-Oslo.pdf
CICDforModernApplications-Oslo.pdf
 
Serverless-First Function: Serverless application security
Serverless-First Function: Serverless application securityServerless-First Function: Serverless application security
Serverless-First Function: Serverless application security
 
Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...
Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...
Enabling a Digital Platform with Microservices Architecture (ARC218-S) - AWS ...
 
How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...
How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...
How Verizon is Accelerating Cloud Adoption and Migration with the AWS Service...
 
Control your cloud environment with AWS management tools
Control your cloud environment with AWS management toolsControl your cloud environment with AWS management tools
Control your cloud environment with AWS management tools
 
Capital One case study: Addressing compliance and security within AWS - FND21...
Capital One case study: Addressing compliance and security within AWS - FND21...Capital One case study: Addressing compliance and security within AWS - FND21...
Capital One case study: Addressing compliance and security within AWS - FND21...
 
Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...
Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...
Root CA hierarchies for AWS Certificate Manager (ACM) Private CA - FND320 - A...
 
Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018
Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018
Security in Amazon Elasticsearch Service (ANT392) - AWS re:Invent 2018
 
Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...
Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...
Migrating Single-Tenant Applications to Multi-Tenant SaaS (ARC326-R1) - AWS r...
 
PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...
PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...
PrivateLink for Partners: Connectivity, Scale, Security (GPSTEC306) - AWS re:...
 
Modern Applications Development on AWS
Modern Applications Development on AWSModern Applications Development on AWS
Modern Applications Development on AWS
 
Evolving perimeters with guardrails, not gates: Improving developer agility -...
Evolving perimeters with guardrails, not gates: Improving developer agility -...Evolving perimeters with guardrails, not gates: Improving developer agility -...
Evolving perimeters with guardrails, not gates: Improving developer agility -...
 
You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018
You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018
You've Decided to Buy Cloud Services, Now What? (WPS203) - AWS re:Invent 2018
 
JFokus 2020 - How to migrate an application to serverless
JFokus 2020 - How to migrate an application to serverlessJFokus 2020 - How to migrate an application to serverless
JFokus 2020 - How to migrate an application to serverless
 
Identity and access control for custom enterprise applications - SDD412 - AWS...
Identity and access control for custom enterprise applications - SDD412 - AWS...Identity and access control for custom enterprise applications - SDD412 - AWS...
Identity and access control for custom enterprise applications - SDD412 - AWS...
 
Websites go Serverless - AWS Summit Berlin
Websites go Serverless - AWS Summit BerlinWebsites go Serverless - AWS Summit Berlin
Websites go Serverless - AWS Summit Berlin
 
2020-04-02 DevConf - How to migrate an existing application to serverless
2020-04-02 DevConf - How to migrate an existing application to serverless2020-04-02 DevConf - How to migrate an existing application to serverless
2020-04-02 DevConf - How to migrate an existing application to serverless
 

Mais de Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateAmazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSAmazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsAmazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareAmazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSAmazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAmazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareAmazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWSAmazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckAmazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without serversAmazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceAmazon Web Services
 

Mais de Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Hands-on SaaS: Constructing multi-tenant solutions with AWS - SVC307 - New York AWS Summit

  • 1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Hands-on SaaS: Constructing multi- tenant solutions with AWS Tod Golding Principal Partner Solutions Architect AWS S V C 3 0 7 Judah Bernstein Partner Solutions Architect AWS
  • 2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Workshop goals • Introduce SaaS architecture fundamentals • Build the working elements of a SaaS environment • Introduce real-world strategies for addressing common multi- tenant practices • Provide a foundation that can inform the creation of your own SaaS solutions
  • 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T The SaaS motive Web App Customer Web App Customer Web App Tenant Tenant Tenant
  • 4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Key concepts On-boarding Data partitioningApplication services Authentication Service Tenant isolation
  • 5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Not here, but key to SaaS • Management and monitoring • Analytics • Operations • Billing • SaaS DevOps
  • 6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T High-level flow Lab 1: Tenant onboarding Lab 2: Multi-tenant services Lab 3: Tenant isolation
  • 7. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Architecting SaaS applications on AWS
  • 8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Lab 1: Onboarding • Configure an identity provider • Review user management service • Provision a new user via REST API • Review tenant management service • Provision a new tenant via REST API • Register a tenant via web app • Authenticate as the new user • Inspect the JWT token Identity management Tenant management Tenant registration & authentication
  • 9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Onboarding architecture User manager Tenant manager Tenant registration Authentication manager Web application Amazon API Gateway
  • 10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Configuring Amazon Cognito User pool User management POST / user Validation Attributes Policies Identity pool
  • 11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Tenant management Tenant manager Generated tenant identifier 492c83ba-d565-47a8-a987-634bd01189db Status Active / inactive Tier Basic, advanced • UserID • TenantID • Name • Status • Role 1: Many
  • 12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Onboarding flow Amazon S3 Web application Authenticate Register Tenant registration Authentication manager APIGateway
  • 13. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Architecting SaaS applications on AWS
  • 14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Lab 2: A multi-tenant progression Single tenant product manager Multi-tenant product manager Add tenant security context • Single tenant table in Amazon DynamoDB • Use ProductId as partition key • No awareness of tenant identity • Multi-tenant, pooled table in DynamoDB • Use TenantId as partition key • Tenant supplied as REST parameter • Add security token to HTTP headers • Load products for two tenants • Verify tenant partitioning in DynamoDB
  • 15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Building application services Application service Identity & tenant context Multi-tenant data partitioning Tenantawarelogging, metering,andanalytics
  • 16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Data partitioning model Partition Key Product ID Title Tenant-1 ECHO-123 Echo Dot Tenant-3 ECHO-456 Echo Show Tenant-1 ECHO-456 Echo Show Tenant-4 ECHO-910 Echo Spot Pooled multi-tenant table Product ID Title ECHO-123 Echo Dot ECHO-456 Echo Show ECHO-456 Echo Show ECHO-910 Echo Spot Single tenant table Product manager Product manager /product/id=TenantId/product
  • 17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Injecting tenant context Product manager JWT token 1 GetTenantId(Token) Token manager 2 TenantId 3 4
  • 18. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Architecting SaaS applications on AWS
  • 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Isolating tenant data • Alter the product manager service • Manually inject a tenant identifier • Verify cross tenant access enable • Leverage policies to restrict tenant access • Edit existing policies • Introduce leading key conditions • Examine roles emitted by provisioning • Examine Amazon Cognito’s role mapping • View the tenant admin/user mapping • Deploy the web application • Register a tenant • Authenticate the new user Cross tenant access Configure policies Map role to policies Get scoped credentials
  • 20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Cross tenant access Tenant 1 Tenant 2 Tenant-11943 Tenant-9492 Product table Tenant identifier Partition Key Sort Key Tenant-9492 14019 Tenant-11943 49104 Tenant-11943 91044 Tenant-9492 85145 Tenant identifier
  • 21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Tenant-scoped policies { "Sid": "TenantReadOnlyOrderTable", "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:BatchGetItem", "dynamodb:Query", "dynamodb:DescribeTable" ], "Resource": [ "arn:aws:dynamodb:us-east-1:000000000000:table/Order" ], "Condition": { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": [ "3aecf790-7dfd-4aef-a95a-b63fc413bdc9" ] } } }
  • 22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Mapping tenant roles to policies IAM policiesAmazon Cognito role mapping Tenant admin role Tenant user role
  • 23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Temporary credentials (the payoff) getCredentialsForIdentity(idToken) Application service Cognito IAM role polices { ”custom:tenantId” : ”8391-9393-9933” “custom:role” : “TenantAdmin” } Cognito ID Token (JWT) Match role Return role scoped credentials Credentials": { "SecretKey":"2gZ8QJQqkAHBzebQmghavFAfgmYpKWRqexample", "AccessKeyId":"ASIAJIOA37R6EXAMPLE" }
  • 24. https://dashboard.eventengine.run Launch your environment (with hash key): https://github.com/aws-samples/aws-saas-factory-bootcamp GitHub repository (start here):
  • 25. Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.