透過經濟高效的多租戶架構釋放 SaaS 潛力

在本文中，我們提出了一種經濟高效的池化多租戶無伺服器架構，該架構提供資料隔離，允許使用者屬於多個租戶並在它們之間無縫切換。透過利用 Amazon DynamoDB、AWS Lambda、Amazon API Gateway 和 Amazon Cognito 等託管服務，該架構透過 IAM 策略、二級索引和自訂 Cognito 使用者群組確保資料安全和租用戶隔離。本文也探討了使用 DynamoDB 功能和使用者屬性在租戶環境中實現自訂使用者角色，提供了一種簡單且經濟高效的方法，而無需引入新服務。

Unlock the Potential of Multi-Tenant SaaS Applications with a Cost-Effective Pooled Architecture

透過經濟高效的池化架構釋放多租戶 SaaS 應用程式的潛力

In the ever-evolving realm of Software-as-a-Service (SaaS) applications, providers strive to cater to a vast user base while optimizing costs and operational efficiency. To achieve this while meeting demanding security requirements and feature expectations can be a daunting task.

在不斷發展的軟體即服務 (SaaS) 應用程式領域，提供者努力滿足廣大用戶群的需求，同時優化成本和營運效率。要實現這一目標，同時滿足嚴格的安全要求和功能期望，可能是一項艱鉅的任務。

Serverless Architecture: A Game-Changer for SaaS Applications

無伺服器架構：SaaS 應用程式的遊戲規則改變者

Embracing a serverless model where managed services and precise scaling of resources eliminate the need for pre-investments presents a compelling solution for SaaS applications. This approach offers unparalleled flexibility and cost-effectiveness, empowering providers to scale their offerings without compromising performance or security.

採用無伺服器模型，其中託管服務和精確的資源擴展消除了預先投資的需要，為 SaaS 應用程式提供了一個引人注目的解決方案。這種方法提供了無與倫比的靈活性和成本效益，使提供者能夠在不影響效能或安全性的情況下擴展其產品。

Introducing a Cost-Effective Multi-Tenant Architecture

引進經濟高效的多租戶架構

Building upon the core concepts of multi-tenant SaaS solutions, this article proposes an innovative cost-effective pooled multi-tenant serverless architecture that addresses critical requirements:

本文基於多租戶 SaaS 解決方案的核心概念，提出了創新且經濟高效的池化多租戶無伺服器架構，可滿足關鍵需求：

• Ensures tenant data isolation
• Enables users to belong to multiple tenants
• Facilitates seamless switching between tenants
• Provides granular role-based permissions for tenant admins

Leveraging Managed Services for a Robust Solution

確保租用戶資料隔離使用戶能夠屬於多個租用戶促進租用戶之間的無縫切換為租用戶管理員提供基於角色的精細權限利用託管服務打造穩健的解決方案

This architecture utilizes the following managed services to provide a comprehensive solution:

該架構利用以下託管服務來提供全面的解決方案：

• Amazon DynamoDB: A fully managed NoSQL database renowned for its cost-effectiveness, scalability, and consistent performance.
• AWS Lambda: A serverless compute service that handles backend code, authorization, and tenant administration within the control plane.
• Amazon API Gateway: A fully managed API Gateway service that simplifies API creation and management.
• Amazon Cognito: A powerful identity management service that provides user authentication and temporary AWS credentials.

Enhancing Data Protection with DynamoDB

Amazon DynamoDB：完全託管的NoSQL 資料庫，以其成本效益、可擴展性和一致的效能而聞名。 API Gateway：完全託管API 閘道服務，可簡化 API 建立和管理。

DynamoDB serves as the central data repository, offering several advantages for multi-tenant applications:

DynamoDB 作為中央資料儲存庫，為多租戶應用程式提供了多項優勢：

• Cost Optimization: A single table design reduces operational overhead by eliminating the need for separate resources for new tenants.
• Simplified Feature Deployment: Consistent query performance and effective data modeling ensure seamless feature deployments and database updates.
• Enhanced Security: IAM policies on the DynamoDB table enforce access controls, providing an extra layer of protection beyond application logic.

Customizing Access with DynamoDB's Partitioning Capabilities

成本優化：單表設計消除了新租戶對單獨資源的需求，從而降低了營運開銷。性：DynamoDB 表上的IAM 策略強制執行存取控制，提供超出應用程式邏輯的額外保護層。

To ensure tenant data privacy, IAM policies are applied to DynamoDB's partition keys, granting access to specific partitions based on tenant or user IDs. This approach leverages wildcards to implement partition key sharding, distributing data evenly across multiple partitions for improved parallelism and overall throughput.

為了確保租用戶資料隱私，IAM 策略套用於 DynamoDB 的分區鍵，根據租用戶或使用者 ID 授予對特定分區的存取權。這種方法利用通配符來實現分區鍵分片，將資料均勻地分佈在多個分區上，以提高並行性和整體吞吐量。

Secondary Indexes for Flexible Data Access

用於靈活資料存取的二級索引

In addition to the primary index, secondary indexes are employed to cater to additional access patterns. For example, a global secondary index can enable users to belong to multiple tenants while maintaining secure access controls.

除了主索引之外，還使用輔助索引來滿足其他存取模式。例如，全域二級索引可以使用戶屬於多個租用戶，同時保持安全的存取控制。

Empowering Identity Management with Amazon Cognito

使用 Amazon Cognito 增強身分管理

Amazon Cognito plays a pivotal role in identity management, providing:

Amazon Cognito 在身分管理中發揮關鍵作用，提供：

• Centralized User Authentication: Cognito serves as the sole identity provider, authenticating users and managing their profiles.
• Tenant-Scoped Access: IAM policies with PrincipalTag variables grant tenant-specific access to the DynamoDB table.
• Flexible User-Tenant Relationships: Cognito user groups enable users to belong to multiple tenants, facilitating seamless switching between organizations.

Enabling Tenant Switching with Cognito's Custom Attributes

集中式使用者驗證：Cognito 充當唯一的身分提供者，對使用者進行身份驗證並管理其個人資料。 -租戶關係：Cognito 使用者群組支援使用者屬於多個租戶，促進組織之間的無縫切換。

To accommodate user requirements for switching tenants, the 'custom:tenant_id' attribute is employed. This mutable attribute allows users to request scoped credentials for the relevant tenant while maintaining security.

為了滿足使用者切換租用戶的要求，使用了「custom:tenant_id」屬性。此可變屬性允許使用者請求相關租戶的範圍憑證，同時保持安全性。

Streamlining Database Access with Lambda Authorizers

使用 Lambda 授權者簡化資料庫訪問

Lambda authorizers are utilized by API endpoints to validate ID tokens and acquire short-lived access credentials. This process initializes the DynamoDB SDK with the appropriate credentials, ensuring that database calls are restricted to the user's authorized scope.

API 端點利用 Lambda 授權方來驗證 ID 令牌並取得短期存取憑證。此程序使用適當的憑證初始化 DynamoDB SDK，確保資料庫呼叫僅限於使用者的授權範圍。

Custom Roles for Granular Access Control

用於精細存取控制的自訂角色

Beyond tenant data isolation, this architecture empowers tenants to define custom roles and permissions within their organizations, without resorting to complex IAM policies or exceeding resource quotas. By leveraging DynamoDB features and user attributes, simple and cost-effective role management is achieved, suitable for applications with relatively simple permission logic.

除了租用戶資料隔離之外，該架構還使租用戶能夠在其組織內定義自訂角色和權限，而無需訴諸複雜的 IAM 策略或超出資源配額。利用DynamoDB的特性與使用者屬性，實現簡單且經濟高效的角色管理，適合權限邏輯相對簡單的應用。

Implementation Scenarios

實施場景

The architecture's versatility is demonstrated through practical implementation scenarios:

該架構的多功能性透過實際實施場景得到證明：

Tenant Registration and Creation: Users sign up, create tenants, and are automatically assigned to the newly created organization.

租戶註冊和建立：使用者註冊、建立租戶並自動分配給新建立的組織。

Tenant Switching: Users effortlessly switch between tenants with a single click, prompted by a menu of available organizations.

租戶切換：根據可用組織選單的提示，使用者只需單擊即可輕鬆在租戶之間切換。

Custom Role Administration: Tenant admins create roles with specific action lists, empowering users within the organization with tailored permissions.

自訂角色管理：租用戶管理員建立具有特定操作清單的角色，為組織內的使用者授予自訂權限。

Fine-Grained Access Control: Backend Lambda functions validate user roles against requested actions, ensuring granular access control within each tenant.

細粒度的存取控制：後端 Lambda 函數會根據要求的操作驗證使用者角色，確保每個租用戶內的細粒度存取控制。

Conclusion

結論

Building upon the foundational principles of data isolation and role-based authorization, this proposed architecture provides a comprehensive solution for multi-tenant SaaS applications. By leveraging managed services and implementing innovative techniques, SaaS providers can effectively address the challenges of secure data management, flexible user-tenant relationships, and customized tenant permissions.

該架構以資料隔離和基於角色的授權的基本原則為基礎，為多租戶 SaaS 應用程式提供了全面的解決方案。透過利用託管服務和實施創新技術，SaaS 供應商可以有效應對安全資料管理、靈活的使用者-租用戶關係和自訂租用戶權限的挑戰。

With this cost-effective solution, SaaS providers can confidently scale their offerings while ensuring the security, reliability, and flexibility that modern applications demand.

借助這種經濟高效的解決方案，SaaS 供應商可以自信地擴展其產品，同時確保現代應用所需的安全性、可靠性和靈活性。