Global Multi-Tenant B2B SaaS: Tenant Isolation & Metering Engine
Designing a high-growth B2B SaaS platform balancing Silo vs Pool tenant isolation models, dynamic IAM ABAC policies, and fine-grained billing telemetry.
1. Business Problem & Context
A high-growth enterprise CRM SaaS serves over 5,000 corporate clients (tenants). Early in their growth, a software developer forgot to include WHERE tenant_id = ? in a raw SQL query, causing Tenant A to view confidential customer deals belonging to competitor Tenant B.
2. Requirements & Constraints
- Zero Software-Layer Cross-Tenant Data Leaks: Enforce isolation at the infrastructure/IAM layer rather than relying on developer application code.
- Tiered Isolation Models: Pooled multi-tenant architecture for Starter tiers ($99/mo); dedicated Silo database instances for Enterprise tier customers ($10,000/mo).
- Per-Tenant Resource Metering: Calculate exact monthly AWS compute, storage, and API costs per client.
3. Architecture Overview & Data Flow
Interactive Architecture Diagram (Use controls to zoom & pan)
4. AWS Services Used & Rationales
AWS Services Architecture Rationale
Concrete reasons why these specific services were chosen over alternatives
| Service | Category | Architectural Rationale ("Why this service?") |
|---|---|---|
| AWS IAM Attribute-Based Access Control (ABAC) | Security | Dynamically restricts DynamoDB item access using `aws:PrincipalTag/TenantId`, mathematically preventing cross-tenant reads even if developer code is buggy. |
| Amazon DynamoDB (Pooled Model) | Database | Maximizes infrastructure cost efficiency by sharing a single high-throughput table across thousands of standard tenants. |
| API Gateway Usage Plans | Serverless | Enforces API throttling and quota limits per tenant API key. |
5. Key Design Trade-offs
Architecture Decision & Trade-Off Matrix
Evaluating alternative approaches under real-world constraints
Pure Silo Architecture (Dedicated AWS Account per Tenant)
- + Maximum physical isolation
- − Astronomical hosting bill ($500+/tenant baseline)
- − DevOps management nightmare for 5,000+ tenants
Hybrid Tiered Model (Pooled Standard + Silo Enterprise with ABAC) (Chosen)
✓ Chosen Design- + Sub-$2/mo cost per standard tenant in pool
- + IAM-enforced hard isolation prevents data leaks
- + Enterprise tier isolation option
- − Requires sophisticated tenant context propagation in code
6. Implementation Highlights
Security IAM IAM Policy for DynamoDB Row-Level Tenant Isolation
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query"],
"Resource": "arn:aws:dynamodb:us-east-1:123456789:table/saas_pooled_data",
"Condition": {
"LeadingKeys": ["${aws:PrincipalTag/TenantId}"]
}
}]
}7. Results & Key Metrics
- Cross-Tenant Data Exposure: Guaranteed 0.00% leaks enforced by AWS IAM.
- Infrastructure Margin: Increased SaaS gross margin from 61% to 86%.
8. Key Architectural Takeaways
SaaS Architecture Rule: Never rely on developers remembering to add
tenant_idfilters in SQL. Enforce tenant isolation at the IAM and database security policy layer.
