通过经济高效的多租户架构释放 SaaS 潜力

在本文中，我们提出了一种经济高效的池化多租户无服务器架构，该架构提供数据隔离，允许用户属于多个租户并在它们之间无缝切换。通过利用 Amazon DynamoDB、AWS Lambda、Amazon API Gateway 和 Amazon Cognito 等托管服务，该架构通过 IAM 策略、二级索引和自定义 Cognito 用户组确保数据安全和租户隔离。本文还探讨了使用 DynamoDB 功能和用户属性在租户环境中实现自定义用户角色，提供了一种简单且经济高效的方法，而无需引入新服务。

Unlock the Potential of Multi-Tenant SaaS Applications with a Cost-Effective Pooled Architecture

通过经济高效的池化架构释放多租户 SaaS 应用程序的潜力

In the ever-evolving realm of Software-as-a-Service (SaaS) applications, providers strive to cater to a vast user base while optimizing costs and operational efficiency. To achieve this while meeting demanding security requirements and feature expectations can be a daunting task.

在不断发展的软件即服务 (SaaS) 应用程序领域，提供商努力满足广大用户群的需求，同时优化成本和运营效率。要实现这一目标，同时满足严格的安全要求和功能期望，可能是一项艰巨的任务。

Serverless Architecture: A Game-Changer for SaaS Applications

无服务器架构：SaaS 应用程序的游戏规则改变者

Embracing a serverless model where managed services and precise scaling of resources eliminate the need for pre-investments presents a compelling solution for SaaS applications. This approach offers unparalleled flexibility and cost-effectiveness, empowering providers to scale their offerings without compromising performance or security.

采用无服务器模型，其中托管服务和精确的资源扩展消除了预先投资的需要，为 SaaS 应用程序提供了一个引人注目的解决方案。这种方法提供了无与伦比的灵活性和成本效益，使提供商能够在不影响性能或安全性的情况下扩展其产品。

Introducing a Cost-Effective Multi-Tenant Architecture

引入经济高效的多租户架构

Building upon the core concepts of multi-tenant SaaS solutions, this article proposes an innovative cost-effective pooled multi-tenant serverless architecture that addresses critical requirements:

本文基于多租户 SaaS 解决方案的核心概念，提出了一种创新且经济高效的池化多租户无服务器架构，可满足关键需求：

• Ensures tenant data isolation
• Enables users to belong to multiple tenants
• Facilitates seamless switching between tenants
• Provides granular role-based permissions for tenant admins

Leveraging Managed Services for a Robust Solution

确保租户数据隔离使用户能够属于多个租户促进租户之间的无缝切换为租户管理员提供基于角色的精细权限利用托管服务打造稳健的解决方案

This architecture utilizes the following managed services to provide a comprehensive solution:

该架构利用以下托管服务来提供全面的解决方案：

• Amazon DynamoDB: A fully managed NoSQL database renowned for its cost-effectiveness, scalability, and consistent performance.
• AWS Lambda: A serverless compute service that handles backend code, authorization, and tenant administration within the control plane.
• Amazon API Gateway: A fully managed API Gateway service that simplifies API creation and management.
• Amazon Cognito: A powerful identity management service that provides user authentication and temporary AWS credentials.

Enhancing Data Protection with DynamoDB

Amazon DynamoDB：完全托管的 NoSQL 数据库，以其成本效益、可扩展性和一致的性能而闻名。AWS Lambda：一种无服务器计算服务，可在控制平面内处理后端代码、授权和租户管理。Amazon API Gateway：完全托管API 网关服务，可简化 API 创建和管理。Amazon Cognito：强大的身份管理服务，提供用户身份验证和临时 AWS 凭证。使用 DynamoDB 增强数据保护

DynamoDB serves as the central data repository, offering several advantages for multi-tenant applications:

DynamoDB 作为中央数据存储库，为多租户应用程序提供了多项优势：

• Cost Optimization: A single table design reduces operational overhead by eliminating the need for separate resources for new tenants.
• Simplified Feature Deployment: Consistent query performance and effective data modeling ensure seamless feature deployments and database updates.
• Enhanced Security: IAM policies on the DynamoDB table enforce access controls, providing an extra layer of protection beyond application logic.

Customizing Access with DynamoDB's Partitioning Capabilities

成本优化：单表设计消除了新租户对单独资源的需求，从而降低了运营开销。简化的功能部署：一致的查询性能和有效的数据建模确保无缝的功能部署和数据库更新。增强的安全性：DynamoDB 表上的 IAM 策略强制执行访问控制，提供超出应用程序逻辑的额外保护层。使用 DynamoDB 的分区功能自定义访问

To ensure tenant data privacy, IAM policies are applied to DynamoDB's partition keys, granting access to specific partitions based on tenant or user IDs. This approach leverages wildcards to implement partition key sharding, distributing data evenly across multiple partitions for improved parallelism and overall throughput.

为了确保租户数据隐私，IAM 策略应用于 DynamoDB 的分区键，根据租户或用户 ID 授予对特定分区的访问权限。这种方法利用通配符来实现分区键分片，将数据均匀地分布在多个分区上，以提高并行性和整体吞吐量。

Secondary Indexes for Flexible Data Access

用于灵活数据访问的二级索引

In addition to the primary index, secondary indexes are employed to cater to additional access patterns. For example, a global secondary index can enable users to belong to multiple tenants while maintaining secure access controls.

除了主索引之外，还使用辅助索引来满足其他访问模式。例如，全局二级索引可以使用户属于多个租户，同时保持安全的访问控制。

Empowering Identity Management with Amazon Cognito

使用 Amazon Cognito 增强身份管理

Amazon Cognito plays a pivotal role in identity management, providing:

Amazon Cognito 在身份管理中发挥着关键作用，提供：

• Centralized User Authentication: Cognito serves as the sole identity provider, authenticating users and managing their profiles.
• Tenant-Scoped Access: IAM policies with PrincipalTag variables grant tenant-specific access to the DynamoDB table.
• Flexible User-Tenant Relationships: Cognito user groups enable users to belong to multiple tenants, facilitating seamless switching between organizations.

Enabling Tenant Switching with Cognito's Custom Attributes

集中式用户身份验证：Cognito 充当唯一的身份提供商，对用户进行身份验证并管理其个人资料。租户范围的访问：具有 PrimaryTag 变量的 IAM 策略授予租户特定的对 DynamoDB 表的访问权限。灵活的用户-租户关系：Cognito 用户组支持用户属于多个租户，促进组织之间的无缝切换。使用 Cognito 的自定义属性启用租户切换

To accommodate user requirements for switching tenants, the 'custom:tenant_id' attribute is employed. This mutable attribute allows users to request scoped credentials for the relevant tenant while maintaining security.

为了满足用户切换租户的要求，使用了“custom:tenant_id”属性。此可变属性允许用户请求相关租户的范围凭据，同时保持安全性。

Streamlining Database Access with Lambda Authorizers

使用 Lambda 授权者简化数据库访问

Lambda authorizers are utilized by API endpoints to validate ID tokens and acquire short-lived access credentials. This process initializes the DynamoDB SDK with the appropriate credentials, ensuring that database calls are restricted to the user's authorized scope.

API 端点利用 Lambda 授权方来验证 ID 令牌并获取短期访问凭证。此过程使用适当的凭证初始化 DynamoDB SDK，确保数据库调用仅限于用户的授权范围。

Custom Roles for Granular Access Control

用于精细访问控制的自定义角色

Beyond tenant data isolation, this architecture empowers tenants to define custom roles and permissions within their organizations, without resorting to complex IAM policies or exceeding resource quotas. By leveraging DynamoDB features and user attributes, simple and cost-effective role management is achieved, suitable for applications with relatively simple permission logic.

除了租户数据隔离之外，该架构还使租户能够在其组织内定义自定义角色和权限，而无需诉诸复杂的 IAM 策略或超出资源配额。利用DynamoDB的特性和用户属性，实现简单且经济高效的角色管理，适合权限逻辑相对简单的应用。

Implementation Scenarios

实施场景

The architecture's versatility is demonstrated through practical implementation scenarios:

该架构的多功能性通过实际实施场景得到证明：

Tenant Registration and Creation: Users sign up, create tenants, and are automatically assigned to the newly created organization.

租户注册和创建：用户注册、创建租户并自动分配给新创建的组织。

Tenant Switching: Users effortlessly switch between tenants with a single click, prompted by a menu of available organizations.

租户切换：根据可用组织菜单的提示，用户只需单击一下即可轻松在租户之间切换。

Custom Role Administration: Tenant admins create roles with specific action lists, empowering users within the organization with tailored permissions.

自定义角色管理：租户管理员创建具有特定操作列表的角色，为组织内的用户授予定制权限。

Fine-Grained Access Control: Backend Lambda functions validate user roles against requested actions, ensuring granular access control within each tenant.

细粒度的访问控制：后端 Lambda 函数根据请求的操作验证用户角色，确保每个租户内的细粒度访问控制。

Conclusion

结论

Building upon the foundational principles of data isolation and role-based authorization, this proposed architecture provides a comprehensive solution for multi-tenant SaaS applications. By leveraging managed services and implementing innovative techniques, SaaS providers can effectively address the challenges of secure data management, flexible user-tenant relationships, and customized tenant permissions.

该架构以数据隔离和基于角色的授权的基本原则为基础，为多租户 SaaS 应用程序提供了全面的解决方案。通过利用托管服务和实施创新技术，SaaS 提供商可以有效应对安全数据管理、灵活的用户-租户关系和自定义租户权限的挑战。

With this cost-effective solution, SaaS providers can confidently scale their offerings while ensuring the security, reliability, and flexibility that modern applications demand.

借助这种经济高效的解决方案，SaaS 提供商可以自信地扩展其产品，同时确保现代应用程序所需的安全性、可靠性和灵活性。