5 Best Practices While Building a Multi-Tenant SaaS Application using AWS Serverless/AWS EKS

The multi-tenant data center market is expected to grow at a rapid CAGR of 11.36% between 2021 and 2026. Some of the growth drivers include the fast-expanding business processes spurring the demand for data centers that have resulted in the evolution of multi-tenant data centers.

Multi-tenant data centers refer to a software application being shared by multiple clients, including enterprises and cloud providers, at some level. Improved client servicing is one of the biggest advantages of being on a multi-tenant data center. It also enables:

• Continuous technology upgradation with minimum disruption and costs
• Scalability and cost-effectiveness because of sharing of resources such as web servers, databases, and computing resources
• Lower demand on IT services
• Faster response and deployment
• Security
• Cost Optimization

However, data centers also can become rigid over a period of time and also present security concerns.

Amazon Elastic Kubernetes Service (EKS)

Amazon Elastic Kubernetes Service (Amazon EKS) is one of the popular orchestration platforms used by organizations moving towards a SaaS (software-as-a-service) model of delivery

One of the many advantages of EKS is that it provides multiple options for designing and creating a multi-tenant SaaS solution, though each comes with its own limitations. With each, the impact on the effort needed for implementation, cost efficiency, and operational complexity will vary

Some of the models that are available under EKS include:

• A cluster-per-tenant model where tenants are isolated, but this may prove to be a costly option
• A shared computing model allows tenants to comingle within the cluster while isolation and namespace are managed at the application level. This can be efficient operationally as well as cost-wise, but may not be suitable as an isolation model.
• Namespace-per-tenant isolation is a via media where multiple tenants are deployed in one cluster but namespaces and a series of native and Kubernetes constructs enable separating them. Also called a silo model, it allows the allocation of resources for each tenant separately. It facilitates isolation cost-efficiently.

Some of the key elements for running this environment include:

• Web Applications: Three applications, built using Angular, are available to interact with the environment’s backend services of the environment. These include:
  • The admin console for the SaaS provider administrators
  • The landing/sign-up application that allows new tenants to public register themselves for the service
  • An e-commerce application called the Sample SaaS commerce application

• Shared Services: This enables onboarding and managing tenant and users of the application. They help to manage, authenticate, and configure shared services and handle the operations and data required to onboard tenants.

• Application Services: Application services represent the microservices providing business functionality of the application. Based on the tenant’s tier, the role and deployment of these application services will vary.

• Data Storage: Storage in a multi-tenant environment can be challenging and confusing due to there being many options, each with its own pros and cons. AWS also provides many storage models, including Amazon Redshift, Amazon DynamoDB, and Amazon Relational Database Service (Amazon RDS). Scoping, managing, and data security in each of these models is unique and needs to be partitioned to align with the needs of each enterprise’s SaaS environment.

You might be interested in: Using AWS for Your SaaS application–Here’s What You Need to Do for Data Security

5 Best Practices for AWS EKS usage in Multi-Tenant Applications

Given these complexities and varieties, the effectiveness of AWS EKS can be improved by implementing the following best practices:

Best Practice #1: Create Separate Namespaces for Each Tenant

It is important for each client in a multi-tenant SaaS application to have a separate namespace to make dividing resources across multiple clients in a single cluster resource easy. The namespace is the primary isolation unit in Kubernetes for multi-tenant architecture and a core feature in Amazon EKS. This enables enforcing data privacy without having to create a separate cluster for each client, thereby reducing the cost of computing resources and AWS hosting.

Best Practice #2: Resource Consumption Management with ResourceQuota

In a multi-tenant SaaS application, multiple tenants access the same Kubernetes cluster resources parallelly. Disproportionately high usage of resources by one tenant can deprive others of access. With ResourceQuota, caps can be set on the resources that each container can use.

Best Practice #3: Network Policies for Network Isolation

Isolation is an essential requirement in a multi-tenant environment since the Kubernetes production cluster permits namespaces to interact with each other, which is to be avoided. Tenant isolation network policy and network segmentation on Amazon EKS using Calico on Amazon EKS can help assign network policies and effect the isolation.

Best Practice #4: PersistentVolume and PersistentVolumeClaim for Storage Isolation

For allocating storage resources too, Amazon EKS provides PersistentVolume (PV) for seamlessly assigning and managing storage for the tenants. PersistentVolumeClaim (PVC) allows a tenant to send a storage request. Being a namespaced resource, it helps isolate storage for different tenants easily.

Best Practice #5: Integrating IAM Integration with Amazon EKS for Access Management

EKS enables the administration of Role-Based Access Control (RBAC) by integrating with AWS IAM on a Kubernetes cluster. The AWS IAM authenticator authenticates the tenant namespace and defines access based on roles. In addition, ClusterRole and Role policy provisioning on the cluster can help adopt a tight security posture.

Indium–An AWS Partner

Indium Software is an authorized AWS partner with experience and expertise to facilitate building a secure and effective multi-tenant application using AWS Serverless/EKS. Our experts work closely with the client to understand their business requirements and data governance and security policies. In addition, we implement the best practices to help businesses derive optimum benefits from their SaaS applications.