SaaS Factory (The Series) — Tenant Isolation: Tenant Isolation Architectures in SaaS (Part 1/3)

In this post, we will talk about Tenant Isolation: Tenant Isolation Architectures in SaaS.

Tenant Isolation Overview

The multi-tenant nature of SaaS solutions demands a stronger focus on making sure every effort is made to isolate tenant resources. The multi-tenant architecture model you choose, the AWS services you are using, the nature of your domain — all of them can shape and influence your isolation approach. Understanding which strategies to employ and which AWS services can help is essential to building secure SaaS solutions on AWS.

Introduction to Tenant Isolation

More and more, the way enterprise solutions are delivered is shifting toward the software as a service (SaaS) model, but architecting a SaaS solution can be challenging. There are many aspects that need to be taken care of, and a variety of options for deploying SaaS solutions on AWS. There are different SaaS deployment models and combinations of AWS services that can be used to achieve a scalable, available, secure, high-performance and cost-effective SaaS offering.

SaaS design must be aligned with the tenant profile. In this sense, you need to assess and understand the requirements of each tenant. To do so, you can map these requirements with a few questions:

• What are your tenants’ security requirements?
• Which isolation levels are relevant to your tenants?
• Do your tenants need to meet specific compliance criteria?
• What is the typical tenant load profile (variable, standard…)?
• What kind of SLAs are expected of your application?
• How much customization is needed for each tenant?
• Which features will distinguish each tier of your SaaS offering?

There is a variety of solutions that can be deployed in a SaaS model, and they share a number of similarities and common patterns. Among the points we will cover, we will look at:

• Common solution components: these are recommended aspects for operating the core of the application, related to the solution and functional components, such as billing, monitoring and analytics;
• SaaS solution: tenant isolation architecture patterns. A solution can be deployed in several ways on AWS. In this part, we will cover the different strategies for tenant isolation.

There are many aspects and components that must be considered in a SaaS architecture, and we will explore each of them in this series. However, when it comes to designing and architecting APIs and application components, it is essential to consider a few aspects:

• The solution should be designed from the perspective of minimizing cross-tenant impact;
• Manage equivalent infrastructure consumption
• A single tenant should never disproportionately consume resources and degrade the performance of the whole environment;
• Build a fault-tolerant application;
• Apply per-tenant “circuit breakers”;
• Provision asynchronous messaging;
• Support partial outages;
• Establish tenant-specific SLAs.

Common Solution Components

In addition to building the core functional components of your SaaS solution, it is highly recommended that you create additional supporting components that will help future-proof your solution and make it easier to manage. Building additional supporting components will also let you grow easily and add more tenants over time. Among the common components, we can list:

• Security and Connectivity (Tenant Isolation Modeling)
• Identity, Authentication and Authorization
• Monitoring, Logging and Application Performance Management
• Analytics
• Configuration Management and Provisioning
• Storage, Backup and Restorability
• Tagging
• Metering and Billing

In the next post, we will continue talking about tenant isolation architectures, detailing each of the common solution components.

SaaS Factory (The Series) — How to Build Software as a Service Solutions on AWS

See you then! =)