【SaaS架构】在单个控制平面上跨多个SaaS产品管理租户

Environment: PoC or pilot

Technologies: SaaS

AWS services: Amazon API Gateway; Amazon Cognito; AWS Lambda; AWS Step Functions; Amazon DynamoDB

Establish the requirements for your multi-tenant SaaS platform.

Establish detailed requirements for the following:

• Tenants

• Users

• Roles

• SaaS products

• Subscriptions

• Profile exchanges

Set up the Amazon Cognito service.

Follow the instructions in Getting started with Amazon Cognito in the Amazon Cognito Developer Guide.

Configure the required IAM policies.

Create the required IAM policies for your use case. Then, map the policies to IAM roles in Amazon Cognito.

For more information, see Managing access using policies and Role-based access control in the Amazon Cognito Developer Guide.

Configure the required API permissions.

Set up API Gateway access permissions by using IAM roles and policies, and Lambda authorizers.

For instructions, see the following sections of the Amazon API Gateway Developer Guide:

• Control access to an API with IAM permissions

• Use API Gateway Lambda authorizers

Create the required data catalogs.

1. Create DynamoDB tables to store data for the user catalogs. Make sure that you include user attributes and roles. Also, make sure that you perform data modeling on the catalog tables to maintain the required and optional attributes for each user and role.

2. Create DynamoDB tables to store data for the product catalogs. Make sure that you model the specific use cases for your SaaS products.

3. Create DynamoDB tables to store data for the tenant catalogs. Make sure that you set up subscription models for tenants, products and licensing for multi-SaaS subscriptions, and tags.

For more information, see Setting up DynamoDB in the Amazon DynamoDB Developer Guide.

Create Lambda functions and API Gateway APIs to run required control plane tasks.

Create separate Lambda functions and API Gateway APIs to add, delete, and manage the following:

• Users

• Tenants

• Products

For more information, see Using AWS Lambda with Amazon API Gateway in the AWS Lambda Developer Guide.

Identify the tasks that AWS Step Functions workflows must run.

Identify and document the detailed AWS Step Functions workflow requirements for the following:

• Users

• Tenants

• Products

Important: Make sure that key stakeholders approve the requirements.

Create the required AWS Step Functions workflows.

1. Create the required workflows for users, tenants, and products in AWS Step Functions. For more information, see the AWS Step Functions Developer Guide.

2. Identify the retry and error handling mechanisms. For more information, see Handling errors, retries, and adding alerting to Step Function State Machines on the AWS Blog.

3. Implement the workflow steps by using Lambda functions. For instructions, see Creating a Step Functions state machine that uses Lambda in the AWS Step Functions Developer Guide.

4. Integrate any external services with AWS Step Functions as needed.

5. Maintain each workflow’s status in a DynamoDB table and communicate each workflow’s status by using Amazon SNS.

Create Amazon SNS topics.

Create Amazon SNS topics to receive notifications about the following:

• Workflow statuses

• Errors

• Retries

For more information, see Creating an SNS topic in the Amazon SNS Developer Guide.

Subscribe endpoints to each Amazon SNS topic.

To receive messages published to an Amazon SNS topic, you must subscribe an endpoint to each topic.

For more information, see Subscribing to an Amazon SNS topic in the Amazon SNS Developer Guide.

Activate logging for each component of the common tenant solution.

Activate logging at the component level for each resource in the common tenant solution that you created.

For instructions, see the following:

• How do I turn on CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API? (AWS Knowledge Center)

• Logging using CloudWatch Logs (AWS Step Functions Developer Guide)

• AWS Lambda function logging in Python (AWS Lambda Developer Guide)

• Logging and monitoring in Amazon Cognito (Amazon Cognito Developer Guide)

• Monitoring with Amazon CloudWatch (Amazon DynamoDB Developer Guide)

Note: You can consolidate logs for each resource into a centralized logging account by using IAM policies. For more information, see Centralized logging and multiple-account security guardrails.

Create CloudFormation templates.

Automate the deployment and maintenance of the full common tenant solution and all its components by using CloudFormation templates.

For more information, see the AWS CloudFormation User Guide.