mirror of
https://github.com/swift-server/swift-aws-lambda-runtime.git
synced 2026-06-02 07:27:33 +00:00
Address https://github.com/awslabs/swift-aws-lambda-runtime/issues/605 NEW Lambda Tenant isolation capability: https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html # Add Support for Lambda Tenant Isolation Mode ## Summary This PR adds support for AWS Lambda's tenant isolation mode to the Swift AWS Lambda Runtime, enabling developers to build multi-tenant applications with strict execution environment isolation per tenant. ## Changes ### Runtime Support - Added `tenantID` property to `LambdaContext` to expose the tenant identifier - Extended `InvocationMetadata` to capture the `Lambda-Runtime-Aws-Tenant-Id` header - Added `AmazonHeaders.tenantID` constant for the tenant ID header - Added trace logging for invocation headers to aid debugging ### New Example: MultiTenant A complete working example demonstrating tenant isolation mode: - **Request tracking system** that maintains separate counters and histories per tenant - **Actor-based storage** (`TenantDataStore`) for thread-safe tenant data management - **Immutable data structures** (`TenantData`) following Swift best practices - **API Gateway integration** with tenant ID passed via query parameter - **SAM template** configured with `TenancyConfig.TenantIsolationMode: PER_TENANT` - **Comprehensive documentation** covering architecture, deployment, testing, and best practices ### Testing - Added unit test for tenant ID extraction from invocation headers - Integrated MultiTenant example into CI/CD pipeline ### Documentation The example includes detailed documentation on: - When to use tenant isolation (user code execution, sensitive data processing) - How tenant isolation works (dedicated environments, no cross-tenant reuse) - Concurrency limits and scaling considerations - Pricing implications - Security best practices - CloudWatch monitoring with tenant dimensions ## Files Changed - `Sources/AWSLambdaRuntime/LambdaContext.swift` - Added tenantID property - `Sources/AWSLambdaRuntime/ControlPlaneRequest.swift` - Capture tenant ID from headers - `Sources/AWSLambdaRuntime/Utils.swift` - Added tenantID header constant - `Sources/AWSLambdaRuntime/Lambda.swift` - Pass tenant ID to context - `Sources/AWSLambdaRuntime/LambdaRuntimeClient+ChannelHandler.swift` - Added trace logging - `Tests/AWSLambdaRuntimeTests/InvocationTests.swift` - Added tenant ID test - `Examples/MultiTenant/*` - New complete example with SAM template - `.github/workflows/pull_request.yml` - Added MultiTenant to CI pipeline ## Testing Instructions 1. Build and deploy the example: bash cd Examples/MultiTenant swift package archive --allow-network-connections docker sam deploy --guided 2. Test with different tenants: bash curl "https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id= alice" curl "https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id= bob" 3. Verify isolation by checking that each tenant maintains separate request counts ## Related Documentation - [AWS Lambda Tenant Isolation](https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html) - [AWS Blog: Streamlined Multi-Tenant Application Development](https://aws.amazon.com/blogs/aws/streamlined-multi-tenant-application-development-with-tenant-isolation-mode-in-aws-lambda/) --------- Co-authored-by: Sebastien Stormacq <stormacq@amazon.lu> Co-authored-by: Tim Condon <0xTim@users.noreply.github.com>
56 lines
1.9 KiB
Swift
56 lines
1.9 KiB
Swift
// swift-tools-version:6.2
|
|
|
|
import PackageDescription
|
|
|
|
// needed for CI to test the local version of the library
|
|
import struct Foundation.URL
|
|
|
|
let package = Package(
|
|
name: "swift-aws-lambda-runtime-example",
|
|
platforms: [.macOS(.v15)],
|
|
products: [
|
|
.executable(name: "MultiTenant", targets: ["MultiTenant"])
|
|
],
|
|
dependencies: [
|
|
// during CI, the dependency on local version of swift-aws-lambda-runtime is added dynamically below
|
|
.package(url: "https://github.com/awslabs/swift-aws-lambda-runtime.git", from: "2.0.0"),
|
|
.package(url: "https://github.com/awslabs/swift-aws-lambda-events.git", from: "1.0.0"),
|
|
],
|
|
targets: [
|
|
.executableTarget(
|
|
name: "MultiTenant",
|
|
dependencies: [
|
|
.product(name: "AWSLambdaRuntime", package: "swift-aws-lambda-runtime"),
|
|
.product(name: "AWSLambdaEvents", package: "swift-aws-lambda-events"),
|
|
]
|
|
)
|
|
]
|
|
)
|
|
|
|
if let localDepsPath = Context.environment["LAMBDA_USE_LOCAL_DEPS"],
|
|
localDepsPath != "",
|
|
let v = try? URL(fileURLWithPath: localDepsPath).resourceValues(forKeys: [.isDirectoryKey]),
|
|
v.isDirectory == true
|
|
{
|
|
// when we use the local runtime as deps, let's remove the dependency added above
|
|
let indexToRemove = package.dependencies.firstIndex { dependency in
|
|
if case .sourceControl(
|
|
name: _,
|
|
location: "https://github.com/awslabs/swift-aws-lambda-runtime.git",
|
|
requirement: _
|
|
) = dependency.kind {
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
if let indexToRemove {
|
|
package.dependencies.remove(at: indexToRemove)
|
|
}
|
|
|
|
// then we add the dependency on LAMBDA_USE_LOCAL_DEPS' path (typically ../..)
|
|
print("[INFO] Compiling against swift-aws-lambda-runtime located at \(localDepsPath)")
|
|
package.dependencies += [
|
|
.package(name: "swift-aws-lambda-runtime", path: localDepsPath)
|
|
]
|
|
}
|