mirror of
https://github.com/swift-server/swift-aws-lambda-runtime.git
synced 2026-06-02 07:27:33 +00:00
Address https://github.com/awslabs/swift-aws-lambda-runtime/issues/605 NEW Lambda Tenant isolation capability: https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html # Add Support for Lambda Tenant Isolation Mode ## Summary This PR adds support for AWS Lambda's tenant isolation mode to the Swift AWS Lambda Runtime, enabling developers to build multi-tenant applications with strict execution environment isolation per tenant. ## Changes ### Runtime Support - Added `tenantID` property to `LambdaContext` to expose the tenant identifier - Extended `InvocationMetadata` to capture the `Lambda-Runtime-Aws-Tenant-Id` header - Added `AmazonHeaders.tenantID` constant for the tenant ID header - Added trace logging for invocation headers to aid debugging ### New Example: MultiTenant A complete working example demonstrating tenant isolation mode: - **Request tracking system** that maintains separate counters and histories per tenant - **Actor-based storage** (`TenantDataStore`) for thread-safe tenant data management - **Immutable data structures** (`TenantData`) following Swift best practices - **API Gateway integration** with tenant ID passed via query parameter - **SAM template** configured with `TenancyConfig.TenantIsolationMode: PER_TENANT` - **Comprehensive documentation** covering architecture, deployment, testing, and best practices ### Testing - Added unit test for tenant ID extraction from invocation headers - Integrated MultiTenant example into CI/CD pipeline ### Documentation The example includes detailed documentation on: - When to use tenant isolation (user code execution, sensitive data processing) - How tenant isolation works (dedicated environments, no cross-tenant reuse) - Concurrency limits and scaling considerations - Pricing implications - Security best practices - CloudWatch monitoring with tenant dimensions ## Files Changed - `Sources/AWSLambdaRuntime/LambdaContext.swift` - Added tenantID property - `Sources/AWSLambdaRuntime/ControlPlaneRequest.swift` - Capture tenant ID from headers - `Sources/AWSLambdaRuntime/Utils.swift` - Added tenantID header constant - `Sources/AWSLambdaRuntime/Lambda.swift` - Pass tenant ID to context - `Sources/AWSLambdaRuntime/LambdaRuntimeClient+ChannelHandler.swift` - Added trace logging - `Tests/AWSLambdaRuntimeTests/InvocationTests.swift` - Added tenant ID test - `Examples/MultiTenant/*` - New complete example with SAM template - `.github/workflows/pull_request.yml` - Added MultiTenant to CI pipeline ## Testing Instructions 1. Build and deploy the example: bash cd Examples/MultiTenant swift package archive --allow-network-connections docker sam deploy --guided 2. Test with different tenants: bash curl "https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id= alice" curl "https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id= bob" 3. Verify isolation by checking that each tenant maintains separate request counts ## Related Documentation - [AWS Lambda Tenant Isolation](https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html) - [AWS Blog: Streamlined Multi-Tenant Application Development](https://aws.amazon.com/blogs/aws/streamlined-multi-tenant-application-development-with-tenant-isolation-mode-in-aws-lambda/) --------- Co-authored-by: Sebastien Stormacq <stormacq@amazon.lu> Co-authored-by: Tim Condon <0xTim@users.noreply.github.com>
108 lines
2.8 KiB
Swift
108 lines
2.8 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This source file is part of the SwiftAWSLambdaRuntime open source project
|
|
//
|
|
// Copyright SwiftAWSLambdaRuntime project authors
|
|
// Copyright (c) Amazon.com, Inc. or its affiliates.
|
|
// Licensed under Apache License v2.0
|
|
//
|
|
// See LICENSE.txt for license information
|
|
// See CONTRIBUTORS.txt for the list of SwiftAWSLambdaRuntime project authors
|
|
//
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
import AWSLambdaEvents
|
|
import AWSLambdaRuntime
|
|
|
|
#if canImport(FoundationEssentials)
|
|
import FoundationEssentials
|
|
#else
|
|
import Foundation
|
|
#endif
|
|
|
|
let tenants = TenantDataStore()
|
|
|
|
let runtime = LambdaRuntime {
|
|
(event: APIGatewayRequest, context: LambdaContext) -> APIGatewayResponse in
|
|
|
|
// Extract tenant ID from context
|
|
guard let tenantID = context.tenantID else {
|
|
return APIGatewayResponse(statusCode: .badRequest, body: "No Tenant ID provided")
|
|
}
|
|
|
|
// Get or create tenant data
|
|
let currentData = await tenants[tenantID] ?? TenantData(tenantID: tenantID)
|
|
|
|
// Add new request
|
|
let updatedData = currentData.addingRequest()
|
|
|
|
// Store updated data
|
|
await tenants.update(id: tenantID, data: updatedData)
|
|
|
|
return try APIGatewayResponse(statusCode: .ok, encodableBody: updatedData)
|
|
}
|
|
|
|
try await runtime.run()
|
|
|
|
actor TenantDataStore {
|
|
private var tenants: [String: TenantData] = [:]
|
|
|
|
subscript(id: String) -> TenantData? {
|
|
tenants[id]
|
|
}
|
|
|
|
// subscript setters can't be called from outside of the actor
|
|
func update(id: String, data: TenantData) {
|
|
tenants[id] = data
|
|
}
|
|
}
|
|
|
|
struct TenantData: Codable {
|
|
struct TenantRequest: Codable {
|
|
let requestNumber: Int
|
|
let timestamp: String
|
|
}
|
|
|
|
let tenantID: String
|
|
let requestCount: Int
|
|
let firstRequest: String
|
|
let requests: [TenantRequest]
|
|
|
|
init(tenantID: String) {
|
|
self.init(
|
|
tenantID: tenantID,
|
|
requestCount: 0,
|
|
firstRequest: "\(Date().timeIntervalSince1970)",
|
|
requests: []
|
|
)
|
|
}
|
|
|
|
func addingRequest() -> TenantData {
|
|
let newCount = requestCount + 1
|
|
let newRequest = TenantRequest(
|
|
requestNumber: newCount,
|
|
timestamp: "\(Date().timeIntervalSince1970)"
|
|
)
|
|
return TenantData(
|
|
tenantID: tenantID,
|
|
requestCount: newCount,
|
|
firstRequest: firstRequest,
|
|
requests: requests + [newRequest]
|
|
)
|
|
}
|
|
|
|
private init(
|
|
tenantID: String,
|
|
requestCount: Int,
|
|
firstRequest: String,
|
|
requests: [TenantRequest]
|
|
) {
|
|
self.tenantID = tenantID
|
|
self.requestCount = requestCount
|
|
self.firstRequest = firstRequest
|
|
self.requests = requests
|
|
}
|
|
}
|