mirror of
https://github.com/swift-server/swift-aws-lambda-runtime.git
synced 2026-06-02 07:27:33 +00:00
2abe7eb7de
Address https://github.com/awslabs/swift-aws-lambda-runtime/issues/605 NEW Lambda Tenant isolation capability: https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html # Add Support for Lambda Tenant Isolation Mode ## Summary This PR adds support for AWS Lambda's tenant isolation mode to the Swift AWS Lambda Runtime, enabling developers to build multi-tenant applications with strict execution environment isolation per tenant. ## Changes ### Runtime Support - Added `tenantID` property to `LambdaContext` to expose the tenant identifier - Extended `InvocationMetadata` to capture the `Lambda-Runtime-Aws-Tenant-Id` header - Added `AmazonHeaders.tenantID` constant for the tenant ID header - Added trace logging for invocation headers to aid debugging ### New Example: MultiTenant A complete working example demonstrating tenant isolation mode: - **Request tracking system** that maintains separate counters and histories per tenant - **Actor-based storage** (`TenantDataStore`) for thread-safe tenant data management - **Immutable data structures** (`TenantData`) following Swift best practices - **API Gateway integration** with tenant ID passed via query parameter - **SAM template** configured with `TenancyConfig.TenantIsolationMode: PER_TENANT` - **Comprehensive documentation** covering architecture, deployment, testing, and best practices ### Testing - Added unit test for tenant ID extraction from invocation headers - Integrated MultiTenant example into CI/CD pipeline ### Documentation The example includes detailed documentation on: - When to use tenant isolation (user code execution, sensitive data processing) - How tenant isolation works (dedicated environments, no cross-tenant reuse) - Concurrency limits and scaling considerations - Pricing implications - Security best practices - CloudWatch monitoring with tenant dimensions ## Files Changed - `Sources/AWSLambdaRuntime/LambdaContext.swift` - Added tenantID property - `Sources/AWSLambdaRuntime/ControlPlaneRequest.swift` - Capture tenant ID from headers - `Sources/AWSLambdaRuntime/Utils.swift` - Added tenantID header constant - `Sources/AWSLambdaRuntime/Lambda.swift` - Pass tenant ID to context - `Sources/AWSLambdaRuntime/LambdaRuntimeClient+ChannelHandler.swift` - Added trace logging - `Tests/AWSLambdaRuntimeTests/InvocationTests.swift` - Added tenant ID test - `Examples/MultiTenant/*` - New complete example with SAM template - `.github/workflows/pull_request.yml` - Added MultiTenant to CI pipeline ## Testing Instructions 1. Build and deploy the example: bash cd Examples/MultiTenant swift package archive --allow-network-connections docker sam deploy --guided 2. Test with different tenants: bash curl "https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id= alice" curl "https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id= bob" 3. Verify isolation by checking that each tenant maintains separate request counts ## Related Documentation - [AWS Lambda Tenant Isolation](https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html) - [AWS Blog: Streamlined Multi-Tenant Application Development](https://aws.amazon.com/blogs/aws/streamlined-multi-tenant-application-development-with-tenant-isolation-mode-in-aws-lambda/) --------- Co-authored-by: Sebastien Stormacq <stormacq@amazon.lu> Co-authored-by: Tim Condon <0xTim@users.noreply.github.com>
75 lines
3.0 KiB
YAML
75 lines
3.0 KiB
YAML
name: swift-aws-lambda-runtime-build
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, reopened, synchronize]
|
|
|
|
# As per Checkov CKV2_GHA_1
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
soundness:
|
|
name: Soundness
|
|
uses: swiftlang/github-workflows/.github/workflows/soundness.yml@main
|
|
with:
|
|
license_header_check_project_name: "SwiftAWSLambdaRuntime"
|
|
shell_check_enabled: true
|
|
python_lint_check_enabled: true
|
|
api_breakage_check_container_image: "swift:6.2-noble"
|
|
docs_check_container_image: "swift:6.2-noble"
|
|
format_check_container_image: "swift:6.2-noble"
|
|
yamllint_check_enabled: true
|
|
|
|
unit-tests:
|
|
name: Unit tests
|
|
uses: apple/swift-nio/.github/workflows/unit_tests.yml@main
|
|
with:
|
|
linux_5_9_enabled: false
|
|
linux_5_10_enabled: false
|
|
linux_nightly_next_arguments_override: "--explicit-target-dependency-import-check error"
|
|
linux_nightly_main_arguments_override: "--explicit-target-dependency-import-check error"
|
|
|
|
integration-tests:
|
|
name: Integration Tests
|
|
uses: ./.github/workflows/integration_tests.yml
|
|
with:
|
|
name: "Integration tests"
|
|
examples_enabled: true
|
|
matrix_linux_command: "LAMBDA_USE_LOCAL_DEPS=../.. swift build"
|
|
# We pass the list of examples here, but we can't pass an array as argument
|
|
# Instead, we pass a String with a valid JSON array.
|
|
# The workaround is mentioned here https://github.com/orgs/community/discussions/11692
|
|
examples: "[ 'APIGatewayV1', 'APIGatewayV2', 'APIGatewayV2+LambdaAuthorizer', 'BackgroundTasks', 'HelloJSON', 'HelloWorld', 'HelloWorldNoTraits', 'HummingbirdLambda', 'MultiSourceAPI', 'MultiTenant', 'ResourcesPackaging', 'S3EventNotifier', 'S3_AWSSDK', 'S3_Soto', 'Streaming', 'Streaming+Codable', 'ServiceLifecycle+Postgres', 'Testing', 'Tutorial' ]"
|
|
archive_plugin_examples: "[ 'HelloWorld', 'ResourcesPackaging' ]"
|
|
archive_plugin_enabled: true
|
|
|
|
swift-6-language-mode:
|
|
name: Swift 6 Language Mode
|
|
uses: apple/swift-nio/.github/workflows/swift_6_language_mode.yml@main
|
|
|
|
semver-label-check:
|
|
name: Semantic Version label check
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 1
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- name: Check for Semantic Version label
|
|
uses: apple/swift-nio/.github/actions/pull_request_semver_label_checker@main
|
|
|
|
# until there is a support for musl in swiftlang/github-workflows
|
|
# https://github.com/swiftlang/github-workflows/issues/34
|
|
musl:
|
|
runs-on: ubuntu-latest
|
|
container: swift:6.0.2-noble
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@v4
|
|
- name: Install SDK
|
|
run: swift sdk install https://download.swift.org/swift-6.0.2-release/static-sdk/swift-6.0.2-RELEASE/swift-6.0.2-RELEASE_static-linux-0.0.1.artifactbundle.tar.gz --checksum aa5515476a403797223fc2aad4ca0c3bf83995d5427fb297cab1d93c68cee075
|
|
- name: Build
|
|
run: swift build --swift-sdk x86_64-swift-linux-musl
|