Streamlined multi-tenant utility growth with tenant isolation mode in AWS Lambda

Multi-tenant purposes usually require strict isolation when processing tenant-specific code or knowledge. Examples embrace software-as-a-service (SaaS) platforms for workflow automation or code execution the place clients want to make sure that execution environments used for particular person tenants or finish customers stay utterly separate from each other. Historically, builders have addressed these necessities by deploying separate Lambda features for every tenant or implementing customized isolation logic inside shared features which elevated architectural and operational complexity.

As we speak, AWS Lambda introduces a brand new tenant isolation mode that extends the prevailing isolation capabilities in Lambda. Lambda already supplies isolation on the operate stage, and this new mode extends isolation to the person tenant or end-user stage inside a single operate. This built-in functionality processes operate invocations in separate execution environments for every tenant, enabling you to satisfy strict isolation necessities with out extra implementation effort to handle tenant-specific sources inside operate code.

Right here’s how one can allow tenant isolation mode within the AWS Lambda console:

When utilizing the brand new tenant isolation functionality, Lambda associates operate execution environments with customer-specified tenant identifiers. Which means that execution environments for a selected tenant aren’t used to serve invocation requests from different tenants invoking the identical Lambda operate.

The function addresses strict safety necessities for SaaS suppliers processing delicate knowledge or working untrusted tenant code. You keep the pay-per-use and efficiency traits of AWS Lambda whereas gaining execution setting isolation. Moreover, this method delivers the safety advantages of per-tenant infrastructure with out the operational overhead of managing devoted Lambda features for particular person tenants, which might shortly develop as clients undertake your utility.

Getting began with AWS Lambda tenant isolation

Let me stroll you thru tips on how to configure and use tenant isolation for a multi-tenant utility.

First, on the Create operate web page within the AWS Lambda console, I select Creator from scratch possibility.

Then, underneath Further configurations, I choose Allow underneath Tenant isolation mode. Notice that, tenant isolation mode can solely be set throughout operate creation and might’t be modified for present Lambda features.

Subsequent, I write Python code to display this functionality. I can entry the tenant identifier in my operate code via the context object. Right here’s the total Python code:

import json
import os
from datetime import datetime

def lambda_handler(occasion, context):
    tenant_id = context.tenant_id
    file_path="/tmp/tenant_data.json"

    # Learn present knowledge or initialize
    if os.path.exists(file_path):
        with open(file_path, 'r') as f:
            knowledge = json.load(f)
    else:
        knowledge = {
            'tenant_id': tenant_id,
            'request_count': 0,
            'first_request': datetime.utcnow().isoformat(),
            'requests': []
        }

    # Increment counter and add request data
    knowledge['request_count'] += 1
    knowledge['requests'].append({
        'request_number': knowledge['request_count'],
        'timestamp': datetime.utcnow().isoformat()
    })

    # Write up to date knowledge again to file
    with open(file_path, 'w') as f:
        json.dump(knowledge, f, indent=2)

    # Return file contents to point out isolation
    return {
        'statusCode': 200,
        'physique': json.dumps({
            'message': f'File contents for {tenant_id} (remoted per tenant)',
            'file_data': knowledge
        })
    }

Once I’m completed, I select Deploy. Now, I would like to check this functionality by selecting Take a look at. I can see on the Create new take a look at occasion panel that there’s a brand new setting known as Tenant ID.

If I attempt to invoke this operate with out a tenant ID, I’ll get the next error “Add a legitimate tenant ID in your request and take a look at once more.”

Let me attempt to take a look at this operate with a tenant ID known as tenant-A.

I can see the operate ran efficiently and returned request_count: 1. I’ll invoke this operate once more to get request_count: 2.

Now, let me attempt to take a look at this operate with a tenant ID known as tenant-B.

The final invocation returned request_count: 1 as a result of I by no means invoked this operate with tenant-B. Every tenant’s invocations will use separate execution environments, isolating the cached knowledge, international variables, and any information saved in /tmp.

This functionality transforms how I method multi-tenant serverless structure. As a substitute of wrestling with advanced isolation patterns or managing a whole bunch of tenant-specific Lambda features, I let AWS Lambda robotically deal with the isolation. This retains tenant knowledge remoted throughout tenants, giving me confidence within the safety and separation of my multi-tenant utility.

Further issues to know

Right here’s an inventory of extra issues it’s worthwhile to know:

• Efficiency — Identical-tenant invocations can nonetheless profit from heat execution setting reuse for optimum efficiency.
• Pricing — You’re charged when Lambda creates a brand new tenant-aware execution setting, with the value relying on the quantity of reminiscence you allocate to your operate and the CPU structure you utilize. For extra particulars, view AWS Lambda pricing.
• Availability — Obtainable now in all business AWS Areas besides Asia Pacific (New Zealand), AWS GovCloud (US), and China Areas.

This launch simplifies constructing multi-tenant purposes on AWS Lambda, reminiscent of SaaS platforms for workflow automation or code execution. Be taught extra about tips on how to configure tenant isolation in your subsequent multi-tenant Lambda operate within the AWS Lambda Developer Information.

Blissful constructing!

— Donnie