Hi everyone, I’m trying to build a prototype for a “multi-tenant app” (let’s say a Shopify, something similar to seed.run) which might turn kinda complex, here are the main features: • Teams/ACL support: so you can create a team and invite members to manage or access the app (depending on permissions). • Each team (tenant) has it’s own list of items (let’s say products), store settings and so In my mind there is an app for the dashboard where the user can manage it’s team and the team can manage the items of the store and then there is a separated table for each store and their stuff. That said here are my questions: Do you think it makes sense to create an individual table for each store (+ also a dedicated bucket for each store’s assets)?; it make sense to me b/c that way I can have a better accuracy on the actual billing for each customer (team) Have you seen any example for these kind of situations? (I was just able to find a issue without any other reference: https://github.com/AnomalyInnovations/serverless-stack-com/issues/331) This is pretty much a complex scenario, right, but also I think it’s a common one so I just wanted to have thoughts on what would make more sense here for the SST and serverless approach.

If you are using dynamodb one limitation I can think of is the max 256 tables per account limit

@Kujtim Hoxha ouch, I wasn’t aware of that limit… then I guess a single table is the way to go no matter what.

I need to double check id it is a hard or soft limit (meaning it can be raised on your account if you request it)

Awesome 😄

One thing you could also do is instead of having one single table for every tenant you could group some tenants into one table and only have a dedicated table for a big tenant

that makes sense

You can keep the data in a single table and let the PK be the thing that segregate tenants data.. you can even use this: https://aws.amazon.com/blogs/aws/fine-grained-access-control-for-amazon-dynamodb/ I've used in my project and works great to make Fine-Grained Access Control...

Oh that is awesome I need this

yep you can.. let me get a better doc

@Gabriel Araújo that’s pretty cool, I wasn’t aware of how much you can restrict at IAM level on dynamodb, this is so interesting; so I guess my db would have some sort of partition where the PK would be the user and the ST would be the role+store (like: ADMIN#123 or SUPPORT#123) and then let IAM handle the access right?

@Gabriel Araújo thanks for sharing this this helps a lot

you can map your user to reader group that would map to reader role that has a policy that allows to interact with table x and only get item with this pk

interesting, omg this is so awesome (and I like the fact of this “security” layer which users the user’s credentials itself to call dynamo

@Tonny (sstNerd) it really depends of your use case.. but: you need to use the pk to create groups of data... and create IAM policies that allow read/update/delete this groups of data.. this is only possible with pk since this is the only thing you have to explicit provide to dynamo

@Gabriel Araújo I did not check the docs since I am on my phone just wondering if you know if you can use ‘starts with’ condition on the PK

sure! let me get something i've used in my project

Thanks

in my case i've used the identity pool id

ty so much for this @Gabriel Araújo

@Gabriel Araújo do you know where a list of all the variable replacements that can be used are?

it can be any arbitrary value.. like a tenantKey for example... just remember to pass this policy as inline to sts when using arbitrary values with the actual value.. lets say:

Condition:
      "ForAllValues:StringLike":
        "dynamodb:LeadingKeys": "my-tenant-key"

@Gabriel Araújo one last question 😅 how are you making the db interactions as the logged in user and not the lambda iam role?

it's a process called sts.. you assume the user role and aws will give you a pair of credentials..

Ok awesome I will need to read about that this seems very much needed I have a very similar scenario

basically you generate a credentials for the user role.. it has a max duration of 15 min.. you can pass in custom policies mention above or just use the role policy.. it will return a access_key and secret_key that you can instantiate aws-sdk and call any services as the "user"

Thanks for the help here, I will read it if you post it 😂

@Garret Harp https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html forgot this one.. so the global and this one