AWS におけるマルチテナント SaaS の実装パターン

git clone https://github.com/aws-samples/saas-reference-architecture-ecs.git
cd saas-reference-architecture-ecs/scripts
./build-application.sh 
./install.sh {管理者用のメールアドレスを入力}

const ec2Tier = ['advanced', 'premium'];
const isEc2Tier: boolean = ec2Tier.includes(props.tier.toLowerCase());
const rProxy = ['advanced', 'premium'];
const isRProxy: boolean = rProxy.includes(props.tier.toLowerCase());

new AwsCustomResource(this, 'CreateTenantMapping', {
  installLatestAwsSdk: true,
  onCreate: {
    service: 'DynamoDB',
    action: 'putItem',
    physicalResourceId: PhysicalResourceId.of('CreateTenantMapping'),
    parameters: {
      TableName: props.tenantMappingTable.tableName,
      Item: {
        tenantId: { S: props.tenantId },
        stackName: { S: cdk.Stack.of(this).stackName },
        codeCommitId: { S: props.commitId },
        waveNumber: { S: waveNumber }
      }
    }
  },

const provisioningJobRunnerProps = {
  permissions: PolicyDocument.fromJson(
    JSON.parse(`
{
  "Version":"2012-10-17",
  "Statement":[
      {
        "Action":[
            "*"
        ],
        "Resource":"*",
        "Effect":"Allow"
      }
  ]
}
`)
  ),
  script: fs.readFileSync('../scripts/provision-tenant.sh', 'utf8'),

# Deploy the tenant template for premium && advanced tier(silo)
if [[ $TIER == "PREMIUM" || $TIER == "ADVANCED" ]]; then
  STACK_NAME="tenant-template-stack-$CDK_PARAM_TENANT_ID"
  if [[ $TIER == "ADVANCED" ]]; then
    export CDK_ADV_CLUSTER=$(aws ecs describe-clusters --cluster prod-advanced-${ACCOUNT_ID} | jq -r '.clusters[0].status')
  fi

  export CDK_PARAM_CONTROL_PLANE_SOURCE='sbt-control-plane-api'
  export CDK_PARAM_ONBOARDING_DETAIL_TYPE='Onboarding'
  export CDK_PARAM_PROVISIONING_DETAIL_TYPE=$CDK_PARAM_ONBOARDING_DETAIL_TYPE
  export CDK_PARAM_OFFBOARDING_DETAIL_TYPE='Offboarding'
  export CDK_PARAM_DEPROVISIONING_DETAIL_TYPE=$CDK_PARAM_OFFBOARDING_DETAIL_TYPE
  export CDK_PARAM_PROVISIONING_EVENT_SOURCE="sbt-application-plane-api"
  export CDK_PARAM_APPLICATION_NAME_PLANE_SOURCE="sbt-application-plane-api"
  export CDK_PARAM_TIER=$TIER
  cdk deploy $STACK_NAME --exclusively --require-approval never 
fi

this.apiGateway = new ApiGateway(this, 'ApiGateway', {
  tenantId: 'ecs-sbt',
  isPooledDeploy: props.isPooledDeploy,
  lambdaEcsSaaSLayers: lambdaEcsSaaSLayers,
  nlb: nlb,
  apiKeyBasicTier: {
    apiKeyId: basicKey.apiKey.keyId,
    value: basicKey.apiKeyValue
   },
  apiKeyAdvancedTier: {
    apiKeyId: advanceKey.apiKey.keyId,
    value: advanceKey.apiKeyValue
   },
  apiKeyPremiumTier: {
    apiKeyId: premiumKey.apiKey.keyId,
    value: premiumKey.apiKeyValue
   },
  apiKeyPlatinumTier: {
    apiKeyId: platinumKey.apiKey.keyId,
    value: platinumKey.apiKeyValue
   },
  stageName: props.stageName
});

this.usagePlanBasicTier = props.apiGateway.addUsagePlan('UsagePlanBasicTier', {
    quota: {
     limit: 1000,
     period: Period.DAY
    },
    throttle: {
     burstLimit: 50,
     rateLimit: 50
    }
});

  user_name = response["cognito:username"]
  tenant_id = response["custom:tenantId"]
  user_role = response["custom:userRole"]
  tenant_tier = response["custom:tenantTier"]

if (tenant_tier.upper() == utils.TenantTier.PLATINUM.value.upper()):
  api_key = platinum_tier_api_key
elif (tenant_tier.upper() == utils.TenantTier.PREMIUM.value.upper()):
  api_key = premium_tier_api_key
elif (tenant_tier.upper() == utils.TenantTier.ADVANCED.value.upper()):
  api_key = advanced_tier_api_key
elif (tenant_tier.upper() == utils.TenantTier.BASIC.value.upper()):
  api_key = basic_tier_api_key

if (auth_manager.isTenantAdmin(user_role)):
  policy.allowMethod(HttpVerb.ALL, "users")
  policy.allowMethod(HttpVerb.ALL, "orders")
  policy.allowMethod(HttpVerb.ALL, "products")
  policy.allowMethod(HttpVerb.ALL, "users/*")
  policy.allowMethod(HttpVerb.ALL, "orders/*")
  policy.allowMethod(HttpVerb.ALL, "products/*") 
else:
   #if not tenant admin then only allow access to order and product services
  policy.allowMethod(HttpVerb.ALL, "orders")
  policy.allowMethod(HttpVerb.ALL, "products")
  policy.allowMethod(HttpVerb.ALL, "orders/*")        
  policy.allowMethod(HttpVerb.ALL, "products/*")

tenantPath = tenant_id
if (tenant_tier.upper() == utils.TenantTier.BASIC.value.upper()):
  tenantPath = tenant_tier.lower()

const targetGroupHttp = new elbv2.ApplicationTargetGroup(
   this,
   `target-group-${info.name}-${tenantId}`,
   {
    port: info.containerPort,
    vpc: this.vpc,
    protocol: elbv2.ApplicationProtocol.HTTP,
    targetType: elbv2.TargetType.IP,    
    healthCheck: {
      path: `/${info.name}/health`,
      protocol: elbv2.Protocol.HTTP
    }
   }
);

# orders api
location ~ ^/orders {
   # Reject requests with unsupported HTTP method
   if ($request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|DELETE)$) {
    return 405;
   }

  # Only requests matching the expectations will
   # get sent to the application server
  proxy_pass http://orders-api.prod.sc:3010;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection 'upgrade';
  proxy_set_header Host $host;
}

// ECS SG for ALB to ECS communication
this.ecsSG = new ec2.SecurityGroup(this, 'ecsSG', {
  vpc: this.vpc,
  allowAllOutbound: true
});
this.ecsSG.connections.allowFrom(this.albSG, ec2.Port.tcp(80), 'Application Load Balancer');
this.ecsSG.connections.allowFrom(this.ecsSG, ec2.Port.tcp(3010), 'Backend Micrioservice');

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:BatchGetItem", "dynamodb:Query", "dynamodb:Scan", "dynamodb:BatchWriteItem", "dynamodb:UpdateItem", "dynamodb:GetRecords"
      ],
      "Resource": "<TABLE_ARN>",
      "Effect": "Allow"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["dynamodb:*"],
      "Resource": ["arn:aws:dynamodb:*:*:table/{{table}}"],
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": ["{{tenant}}"]
        }
      }
    }
  ]
}