AWS におけるマルチテナント SaaS の実装パターン  ~ サーバーレス編

# Deploy the tenant template for platinum tier(silo)
if [[ $TIER == "PLATINUM" ]]; then
  STACK_NAME="serverless-saas-ref-arch-tenant-template-$CDK_PARAM_TENANT_ID"
  export CDK_PARAM_CONTROL_PLANE_SOURCE='sbt-control-plane-api'
  export CDK_PARAM_ONBOARDING_DETAIL_TYPE='Onboarding'
  export CDK_PARAM_PROVISIONING_DETAIL_TYPE=$CDK_PARAM_ONBOARDING_DETAIL_TYPE
  export CDK_PARAM_OFFBOARDING_DETAIL_TYPE='Offboarding'
  export CDK_PARAM_DEPROVISIONING_DETAIL_TYPE=$CDK_PARAM_OFFBOARDING_DETAIL_TYPE
  export CDK_PARAM_PROVISIONING_EVENT_SOURCE="sbt-application-plane-api"
  export CDK_PARAM_APPLICATION_NAME_PLANE_SOURCE="sbt-application-plane-api"
  cdk deploy $STACK_NAME --require-approval never
fi

# Create tenant admin user
aws cognito-idp admin-create-user \
  --user-pool-id "$SAAS_APP_USERPOOL_ID" \
  --username "$TENANT_ADMIN_USERNAME" \
  --user-attributes Name=email,Value="$TENANT_ADMIN_EMAIL" Name=email_verified,Value="True" Name=phone_number,Value="+11234567890" Name="custom:userRole",Value="TenantAdmin" Name="custom:tenantId",Value="$CDK_PARAM_TENANT_ID" Name="custom:tenantTier",Value="$TIER" \
  --desired-delivery-mediums EMAIL

# Create tenant user group
aws cognito-idp create-group \
  --user-pool-id "$SAAS_APP_USERPOOL_ID" \
  --group-name "$CDK_PARAM_TENANT_ID"

# Add tenant admin user to tenant user group
aws cognito-idp admin-add-user-to-group \
  --user-pool-id "$SAAS_APP_USERPOOL_ID" \
  --username "$TENANT_ADMIN_USERNAME" \
  --group-name "$CDK_PARAM_TENANT_ID"

# Create JSON response of output parameters
export tenantConfig=$(jq --arg SAAS_APP_USERPOOL_ID "$SAAS_APP_USERPOOL_ID" \
  --arg SAAS_APP_CLIENT_ID "$SAAS_APP_CLIENT_ID" \
  --arg API_GATEWAY_URL "$API_GATEWAY_URL" \
  -n '{"userPoolId":$SAAS_APP_USERPOOL_ID,"appClientId":$SAAS_APP_CLIENT_ID,"apiGatewayUrl":$API_GATEWAY_URL}')
export tenantStatus="Complete"

{
  "userPoolId": "us-west-2_2EEEXZ51f",
  "appClientId": "7terkehljf7b2m2evgne50ddps",
  "apiGatewayUrl": "https://4jaef73j55.execute-api.us-west-2.amazonaws.com/prod/"
}

public setTenantConfig(tenantName: string): Promise<any> {
    const url = `${environment.regApiGatewayUrl}/tenant-config/` + tenantName;
    this.params$ = this.http.get<string>(url);
    const setup$ = this.params$.pipe(
      map((val:unknown) => {
        // remove trailing slash (/) if present
        console.log("setTenantConfig val: ", val);
        this.params = val as ConfigParams;
        this.params.apiGatewayUrl = this.params.apiGatewayUrl.replace(
          /\/$/,
          ''
        );
        localStorage.setItem('userPoolId', this.params.userPoolId);
        localStorage.setItem('tenantName', tenantName);
        localStorage.setItem('appClientId', this.params.appClientId);
        localStorage.setItem('apiGatewayUrl', this.params.apiGatewayUrl);

if (props.isPooledDeploy) {
    this.usagePlanBasicTier = props.apiGateway.addUsagePlan('UsagePlanBasicTier', {
        quota: {
            limit: 1000,
            period: Period.DAY,
        },
        throttle: {
            burstLimit: 50,
            rateLimit: 50,
        },
    });

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "xray:PutTelemetryRecords",
                "xray:PutTraceSegments"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "dynamodb:BatchWriteItem",
                "dynamodb:DeleteItem",
                "dynamodb:DescribeTable",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-west-2:123456789:table/serverless-saas-ref-arch-tenant-template-pooled-ServicesOrderMicroserviceTable53CF6217-1J6YZZIPYEJ93"
            ],
            "Effect": "Allow"
        }
    ]
}

iam_policy = auth_manager.getPolicyForUser(
    user_role, utils.Service_Identifier.BUSINESS_SERVICES.value, tenant_id, region, aws_account_id)
logger.info(iam_policy)

role_arn = authorizer_access_role
# "arn:aws:iam::{}:role/authorizer-access-role".format(
#     aws_account_id)

assumed_role = sts_client.assume_role(
    RoleArn=role_arn,
    RoleSessionName="tenant-aware-session",
    Policy=iam_policy,
)
credentials = assumed_role["Credentials"]

# pass sts credentials to lambda
context = {
    # $context.authorizer.key -> value
    'accesskey': credentials['AccessKeyId'],
    'secretkey': credentials['SecretAccessKey'],
    'sessiontoken': credentials["SessionToken"],
    'userName': user_name,
    'tenantId': tenant_id,
    'idpDetials': str(idp_details),
    'apiKey': api_key,
    'userRole': user_role
}

authResponse['context'] = context

def __get_dynamodb_table(event, dynamodb):
    """ Determine the table name based upo pooled vs silo model

    Args:
        event ([type]): [description]

    Returns:
        [type]: [description]
    """
    if (is_pooled_deploy=='true'):
        accesskey = event['requestContext']['authorizer']['accesskey']
        secretkey = event['requestContext']['authorizer']['secretkey']
        sessiontoken = event['requestContext']['authorizer']['sessiontoken']    
        dynamodb = boto3.resource('dynamodb',
                aws_access_key_id=accesskey,
                aws_secret_access_key=secretkey,
                aws_session_token=sessiontoken
                )        
    else:
        if not dynamodb:
            dynamodb = boto3.resource('dynamodb')
        
    return dynamodb.Table(table_name)

const defaultLambdaReserveConcurrency = '1';

const lambdaReserveConcurrency = Number(
  process.env.CDK_PARAM_LAMBDA_RESERVE_CONCURRENCY || defaultLambdaReserveConcurrency
);

# Deploy the tenant template for platinum tier(silo)
if [[ $TIER == "PLATINUM" ]]; then
  ...
  # 以下の1行を追加
  export CDK_PARAM_LAMBDA_RESERVE_CONCURRENCY="10"
  cdk deploy $STACK_NAME --require-approval never
fi

{
  "stacks": [
    {
      "stackName": "serverless-saas-ref-arch-tenant-template-pooled",
      "tenantId": "pooled",
      "commitId": "rs_CaHKHetb8eZr0e68lzxQhCjcw2.CY",
      "waveNumber": 1
    },
    {
      "stackName": "serverless-saas-ref-arch-tenant-template-e54440d9-dfad-4822-8a86-db06b8f9f04f",
      "tenantId": "e54440d9-dfad-4822-8a86-db06b8f9f04f",
      "commitId": "rs_CaHKHetb8eZr0e68lzxQhCjcw2.CY",
      "waveNumber": 2
    },
    {
      "stackName": "serverless-saas-ref-arch-tenant-template-53fb645c-1170-4976-8db9-78ee3342ba1e",
      "tenantId": "53fb645c-1170-4976-8db9-78ee3342ba1e",
      "commitId": "rs_CaHKHetb8eZr0e68lzxQhCjcw2.CY",
      "waveNumber": 3
    }
  ]
}

"""Log with tenant context. Extracts tenant context from the lambda events
"""
def log_with_tenant_context(event, log_message):
    logger.structure_logs(append=True, tenant_id= event['requestContext']['authorizer']['tenantId'])
    logger.info (log_message)
server/src/OrderService/order_service.py
@tracer.capture_lambda_handler
def get_order(event, context):
    tenantId = event['requestContext']['authorizer']['tenantId']
    tracer.put_annotation(key="TenantId", value=tenantId)

    logger.log_with_tenant_context(event, "Request received to get a order")