AWS provides a broad array of services, tools, and constructs that can be used to design, operate, and deliver SaaS applications. In this session, Tod Golding, the AWS Partner Solutions Architect, shares the wisdom and lessons learned from working with dozens of customers and partners building SaaS solutions on AWS. We discuss key architectural strategies and patterns that are used to deliver multi-tenant SaaS models on AWS and dive into the full spectrum of SaaS design and architecture considerations, including tenant isolation models, tenant identity management, serverless SaaS, and multi-tenant storage strategies. This session connects the dots between general SaaS best practices and what it means to realize these patterns on AWS, weighing the architectural tradeoffs of each model and assessing its influence on the agility, manageability, and cost profile of your SaaS solution.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tod Golding, Partner Solutions Architect
November 2016
Architecting Next Generation
SaaS Applications on AWS
ARC 301

2. Where Does SaaS Fit?
Identity
Billing &
Metering
Management
& Monitoring
Analytics
Scale &
Availability
Storage
Partitioning
Continuous
Delivery
Agility
SaaS

3. Multi-Tenancy Patterns
Tenant Tenant
Tenant Tenant
Tenant TenantTenant
Tenant TenantTenant
Tenant TenantTenant
Silo Bridge Pool

4. Partitioning Tug of War
Silo Model Pool Model
• Compliance alignment
• Partitioned environments
• No cross-tenant impacts
• Tenant-specific tuning
• Tenant level availability
• Cost
• Agility compromised
• Management complexity
• Deployment challenges
• Analytics/metering aggregation
• Agility
• Cost optimization
• Centralized management
• Simplified deployment
• Analytics/metering aggregation
• Cross-tenant impacts
• Compliance challenges
• All or nothing availability
Pros
Cons
Pros
Cons

5. SaaS Reference Architecture Landscape
Identity
Tenant Isolation
Data Partitioning
Management&Monitoring
Profiling&Analytics
Metering,Billing&Tenant
Administration
Operational View
ApplicationView
Technical/Business Agility

6. SaaS Identity: Beyond the Front Door
Injecting Tenant
Context
Security &
Isolation
Tenant
Access
Tenant
Provisioning

7. On-Boarding a Tenant
New Tenant
On-Boarding
Tenant
Identity Broker
Identity
Provider
Tenant
Management
Billing
• User: bob@test.com
• TenantID: 491048735
• TenantID: 491048735
• Domain: abc.com
• Tier: Platinum
• Status: Active
Domain
Provisioning SSL
Certificate
Tenant
IAM Policy
User Identity + Tenant Identity = SaaS Identity

8. SaaS Identity Flow
Web
Application
Tenant
Identity Broker
Identity
Provider
Multi-Factor
Authentication
AWS Cloud
IAM Policy
UserID: bob@abc.com
TenantID: “93194942”
Role: “Admin”

9. IAM Policies Scope Tenant Access
Web Tier
App Tier
Tenant1 Access
Policy
CustomerTable
Tenant2 Access
Policy
T1-Bucket T2-Bucket

10. Applying Tenant Context
Tenant
Access Control
Homepage
Access Control
Catalog
Service
Access Control
Cart Service
TenantContext
{
UserID: “bob@abc.com”
Role: “Admin”,
TenantID: “93194942”
}
JWT Token
Authorization: Bearer<JWT>
Authorization: Bearer<JWT>
Authorization: Bearer<JWT>
Access Control
Auth ServiceTenant Service

11. SaaS Identity Considerations
• SaaS identity is bigger than authentication
• Leave the heavy lifting, risk, and innovation to someone
else
• Use identity broker pattern to decouple from identity
providers
• Automate role and policy provisioning/management
• Add tenant context to identity token to limit bottlenecks
• If your identity solution is invasive, you’re doing it wrong

12. Tenant Isolation
Layered Isolation
App Tier
Web Tier
App Tier
Full Stack Isolation Network Isolation

13. Full Stack Isolation
EC2 Full Stack Isolation
Container Isolation
Container
Instance
Container
Instance
Container
Instance
Container
Instance
Tenant 1 Tenant 2
Tenant 1
Web Tier
App Tier
Tenant 2
On-Boarding, Billing, Provisioning, Routing
Web Tier
App Tier

14. Account Isolation
Tenant 1 (AWS Account A) Tenant 2 (AWS Account B)
Auto Scaling Group
Web Server Web Server
Auto Scaling Group
App Server App Server
Availability Zone 1
Availability Zone 2
Region
Auto Scaling Group
Web Server Web Server
Auto Scaling Group
App Server App Server
Availability Zone 1
Availability Zone 2
Region
On-Boarding, Billing, Provisioning, Routing

15. Hybrid Isolation
Mix of single and multi-tenant models
Web Tier
App Tier
Tenant 1
Web Tier
App Tier
Tenant 2
Web Tier
Tenants 3 … N
(multi-tenant shared)
App Tier
• Build with pooled model in mind
• Unified on-boarding and billing
• Siloes are a standalone instance of
the pooled environment
• Avoid one-off customization
• Shared tooling and provisioning
• New features go to all tenants (agility)

16. Network Isolation
Web Tier
App Tier
Web Tier
App Tier
Tenant 1 Tenant 2
T2– App SubnetT1 – App Subnet
T2 – Web SubnetT1 – Web Subnet
VPC Partitioning Subnet Partitioning

17. Layered Tenant Isolation
Billing
Administration
On-Boarding
Tenant 1 Tenant 2
Web
App
Web
App
Route 53
Web Tier
App: Tenant 1 App: Tenant 2
Billing
Administration
On-Boarding Route 53
Web Tier
Billing
Administration
On-Boarding Route 53
AppTier

18. Serverless SaaS
REST API
Static web content
AWS Lambda Functions
Amazon
CloudFront
Storage Services
• Finer-grained mapping of tenant
consumption
• Simplifies scaling policies
• Improved fault tolerance model
• Better deployment agility
• Separates API management from
execution
Aligning with SaaS Tenets

19. Compute Partitioning Considerations
• Don’t assume isolation is required for all tenants
• Start with pooled and let isolation earn its way in
• Resist the temptation for one-off tenant customization
• Create an aggregate view of health and activity
• Adjust service limits when provisioning new tenants
• Use tags to identify tenant resources
• Limit the impact of partitioning on agility

20. Data Partitioning
Separate database
for each tenant
Tenant 1 Tenant 2
Storage Storage
Tenant 1
Tenant 2
Schema
Schema
Single database,
multiple schemas
Tenant Id Item Id
A93-9494 239
B38-3929 3434
Schema
Shared database,
single schema

21. The Hot Key Problem
Tenant Key Distribution
TenantID Shard
Tenant1 1
Tenant7 2
Tenant9 1
Tenant4 3
Shard1
Shard2
Shard3
Shard of Shards

22. Multi-Tenant RDS
Tenant 1
Instance
Tenant 2
Instance
Tenant 2
Tenant 1
Instance Per Tenant Table Per Tenant Multi-Tenant Tables
Tenant 1 84049-49 True
Tenant 2 82-84-949 False
Tenant 1 Bob Smith
Tenant 2 Lisa Johnson
Tables partitioned by tenant id

23. Multi-Tenant DynamoDB: Silo Model
Tenant1_Account Tenant1_CustomerIAM_Tenant1_Role
Tenant3_Account Tenant3_Customer
IAM_Tenant3_Role
Tenant2_Account Tenant2_Customer
IAM_Tenant2_Role

24. Multi-Tenant DynamoDB: Pool Model
Partition Key Attributes
TenantID
Tenant1
CustomerTable
{
ShardCount: 3,
ShardSize: [4, 9, 5],
ShardIds: [“93”, “932”, “21”]
}
AccountTable
{
ShardCount: 4,
ShardSize: [3, 4, 4, 5],
ShardIds: [“43”, “19”, “971”, “85”]
}
Partition Key Attributes
ShardID
93
CustomerID
4923000093
Name
Bob Jones
ShardID
932
CustomerID
9839839939
Name
Sally Smith
ShardID
932
CustomerID
4394992099
Name
Mary Young
Partition Key Attributes
ShardID
43
AccountID
739193984
Status
Active
ShardID
43
AccountID
113948390
Status
Active
ShardID
19
AccountID
732933209
Status
Inactive
CustomerTable
AccountTable
TenantLookup

25. Real-Time Optimization: Dynamic DynamoDB
• Dynamic configuration of PIOPS
• Aligns storage throughput with
real-time tenant load
• Optimizes tenant costs
• Improves tenant experience
Average consumed write capacity
Provisioned write capacity

26. Minimizing Tenant Awareness
Service Authorization (RBAC)
Your Service Code
Data Access
ServiceLifecycle
(config,bootstrap,discovery)
Logging Analytics
Tenant
Configuration
Metrics
System
Configuration
• Abstracting away tenant awareness & policies
• Maximizing developer productivity

27. Management & Monitoring
S3
CloudWatch
AWS Config
CloudTrailTenantContext
Splunk
Sumologic
Kibana
• Create custom views that aggregate
and summarize cross-tenant activity
• Proactively identify cross-tenant issues
• Introduce cross tenant policies
Application Services
Catalog
Service
Cart
Service
Ratings
Service
Tax
Service

28. Capturing Tenant Level Metrics
Application Flows
Service Activity
Storage Activity
Scaling Activity
…
Tenant-Level Metrics
Order Service Cart Service
Tenant-centric Dashboard
• Use system and tenant level metrics to drive optimization
• Must attribute resource consumption to individual tenants
Tenant1: Catalog search
Tenant4: Ship order
Tenant2: Cart update IOPS
Tenant7: Ship order
CloudWatch

29. Takeaways
• Always have an eye on agility
• Third-party solutions free you up to focus on innovation
• Weigh business and technical merits when selecting a
partitioning scheme
• Isolation must be enforced through policies
• Storage must consider impact of tenant data distribution
• Tenant aware monitoring is essential to SaaS agility
• Metering and metrics will drive the evolution and
optimization of your SaaS architecture model

30. Thank you!

31. Remember to complete
your evaluations!

32. Related Sessions
ARC408 - Optimizing SaaS Solutions for AWS
ARC304 - Effective Application Data Analytics for Modern Applications
ARC310 - Cost Optimizing Your Architecture: Practical Design Steps
For Big Savings
ARC402 - Serverless Architectural Patterns and Best Practices