Biggest take aways from the AWS SaaS Factory live stream: • Multi-tenancy is very much a security and access control game. • Multi-tenancy and security are much easier to get right when you are starting than after you have a mess and an incident on your hands. • A lot of decisions around security, compliance and tenant isolation are business requirements (sometimes a bit obscured behind pricing, costs, tiering and capabilities) • In startups, you know from day 1 that your business will experiment with things - tiers, pricing, tenant customization. There are a lot of known design patterns that give you flexibility, start with those. • Israel should be renamed "SaaS Nation"

• If you invite Gwen to a show, she brings a great following and conversation with her. • If you are actually in Israel, the show is 4pm rather than 6am 🥱

Nice points. Regarding multi-tenancy - Have anyone used SQL proxy in prod? Basically we are creating separate DB for each tenant but this bring another complexity to manage connections at service end. Also DB host have limit on max connections as well. Hence instead of writing our own logic we could use connection management in SQL proxy (with long live connection pool) to route request to proper tenant DB. Please share any critical feedback in this arch.

I haven't looked at SQL proxy specifically, but I used another connection pool manager (ages ago and Oracle specific) and the key memory I have is that you need to be careful about handling cases where the pool is exhausted. We had cases where we deadlocked because the pool was exhausted, but the threads that were waiting for connections were also the one holding connections (for another task). Be careful not to create an async mess and shoot yourself in the foot. (On the plus side, I got my early start at giving conference talks by discussing connection management and concurrency issues).

Wow let me have a look into pgbouncer. I was checking this https://proxysql.com/

@Lalit Pagaria - Assuming you are building on AWS, are you using self managed DB, or RDS? Not to muddy the waters with yet another option, there is an AWS service called RDS Proxy which works with Aurora and RDS and many SQL engines. It comes with some distinct advantages - fully managed, more integrated security story with IAM and Secrets Manager...

@Bill Tarr yeah that is an option but it is pricey and not covered in their free tier plan. T3 small instance will cost $23 but on-demand of the same size will cost $15. Also one instance we may be able to connect RDS of different AZ. In fact we are not using EKS because they charge $70 instead we are using ECS which is free. We are a bootstrap startup with wafer thin margins so staying positive since the beginning is what we like, at least we hope 😅

Joining the complaint about EKS costs. I span one up for testing, thought I deleted it, turned out that I didn't. 50% of our cloud costs for the month was from this one test cluster. I'm testing with

kind

now 😅

I'll share those comments with the containers team channel for sure

We are seeing now reverse trends https://world.hey.com/dhh/why-we-re-leaving-the-cloud-654b47e0

I saw this earlier today. Seems insane with a small team.

Yeah but cloud cost is going crazy. One of my known people told me that they were able to source GPU at $1 per hour which cost approx 4-5$ per hour on public cloud. And now they are launching an ML training startup.

Charity Majors once said that most startups end up selling arbitrage on cloud costs. Not 100% true, but many are.

Two major make and break stages for many SaaS startups 😅 • When free tier ends • When they run out of cloud credits

LOL. It is a game of getting to enough revenue and economy of scale before you run out of free.

the article is an interesting argument, but pretty myopic to their use case. I probably shouldn't get into the business of defending the public cloud, since I have a vested interest 🙂 but I don't just think of the public cloud as renting computers, especially for SaaS. Compliance, multi-region, serverless, public marketplaces, security backbone... just a lot of things that would be a challenging at best to build out. Just my two cents...

Yeah agree Bill. Having worked in the data centre building industry I would not like to take that pain for my own startup until absolutely necessary for some regulatory reason.

agreed. Worked in PCI-DSS data centers for a few years... Happy to not be doing that anymore 🙂

This is weird:

Let's take HEY as an example. We're paying over half a million dollars per year for database (RDS) and search (ES) services from Amazon. Yes, when you're processing email for many tens of thousands of customers, there's a lot of data to analyze and store, but this still strikes me as rather absurd.

They are storing emails in RDS? It doesn't sound right.

Might be storing email meta in RDS, text in ES and attachments in S3. I guess they might have a heavy rule-based engine.

oh, makes sense

I have heard a lot about superhuman. Let me check it out.

Not sure it’s worth the cost, personally. But I’m curious if it does for you.

@Gwen Shapira @Bill Tarr its unfortunate i had to deal with fires in house to extinguish. My rant/question was on getting working code towards a saas. As in here is a mom and pop shop running as running a saas using these x/y/z technologies. There are tons of technologies to chose from but just having a PDF talking about well architected design (something AWS does nowadays) is maybe not enough

@Yassin Mohamed are you building with Serverless or EKS perhaps?

good question its a mix of serverless and EKS

we do have reference architectures for both of those... I think you said ECS, strictly speaking, we don't have an ECS reference, but we do have a project called SaaS Boost that is based on ECS...

we want to farm out to serverless from time to time to handle the load

I'd like to speak with you more about what you are building, but in the mean time - https://github.com/aws-samples/aws-saas-factory-ref-solution-serverless-saas

This is actually good timing 🙂 i will ping you on a DM if that is ok ?

sure

@Bill Tarr btw that repo seems like it could answer what i want from my cursory look. I will go and make sure i understand what it is solving and how before ask more questions to both of you ... 🙂 sheers and have a great weekend

if you want a jumpstart,

Note AWS has a nice PDF somewhere about SaaS multi-tenancy options & standards, mostly settling on basic single DB, include account-in-every-row, sorta system as a baseline, but has to be built from scratch that way, so the core code/framework does the work. Auth across the accounts gets messy, as do any multi-account views, though.

hi @Steve Mushero - Let me know if you find that, I'd be curious about the context there. Our team does have a whitepaper that outlines "*SaaS Architecture Fundamentals*" we just published recently, but I'm not sure that's what you are referring too... We have a lot of publications 🙂

SaaS Tenant Isolation Strategies (AWS), from 2020 (an update of the earlier paper I saw): https://d1.awsstatic.com/whitepapers/saas-tenant-isolation-strategies.pdf

yup, that's from our team as well. A good resource, bit more specific than the one I references, but a really good deep dive on isolaiton.

🙂 I thought folks were asking how to separate customers, even separate DBs, etc. so though this appropriate, though perhaps I missed the larger picture. Good basics, though.

Oh not at all, you are spot on for sharing it!