Files
swift-aws-lambda-runtime/Sources/AWSLambdaRuntime/ControlPlaneRequest.swift
T
2abe7eb7de Add support for Lambda Tenants (#608)
Address https://github.com/awslabs/swift-aws-lambda-runtime/issues/605

NEW Lambda Tenant isolation capability: 
https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html 


# Add Support for Lambda Tenant Isolation Mode

## Summary

This PR adds support for AWS Lambda's tenant isolation mode to the Swift
AWS Lambda Runtime, enabling developers to build multi-tenant
applications with strict execution environment isolation per tenant.

## Changes

### Runtime Support
- Added `tenantID` property to `LambdaContext` to expose the tenant
identifier
- Extended `InvocationMetadata` to capture the
`Lambda-Runtime-Aws-Tenant-Id` header
- Added `AmazonHeaders.tenantID` constant for the tenant ID header
- Added trace logging for invocation headers to aid debugging

### New Example: MultiTenant
A complete working example demonstrating tenant isolation mode:
- **Request tracking system** that maintains separate counters and
histories per tenant
- **Actor-based storage** (`TenantDataStore`) for thread-safe tenant
data management
- **Immutable data structures** (`TenantData`) following Swift best
practices
- **API Gateway integration** with tenant ID passed via query parameter
- **SAM template** configured with `TenancyConfig.TenantIsolationMode:
PER_TENANT`
- **Comprehensive documentation** covering architecture, deployment,
testing, and best practices

### Testing
- Added unit test for tenant ID extraction from invocation headers
- Integrated MultiTenant example into CI/CD pipeline

### Documentation
The example includes detailed documentation on:
- When to use tenant isolation (user code execution, sensitive data
processing)
- How tenant isolation works (dedicated environments, no cross-tenant
reuse)
- Concurrency limits and scaling considerations
- Pricing implications
- Security best practices
- CloudWatch monitoring with tenant dimensions

## Files Changed
- `Sources/AWSLambdaRuntime/LambdaContext.swift` - Added tenantID
property
- `Sources/AWSLambdaRuntime/ControlPlaneRequest.swift` - Capture tenant
ID from headers
- `Sources/AWSLambdaRuntime/Utils.swift` - Added tenantID header
constant
- `Sources/AWSLambdaRuntime/Lambda.swift` - Pass tenant ID to context
- `Sources/AWSLambdaRuntime/LambdaRuntimeClient+ChannelHandler.swift` -
Added trace logging
- `Tests/AWSLambdaRuntimeTests/InvocationTests.swift` - Added tenant ID
test
- `Examples/MultiTenant/*` - New complete example with SAM template
- `.github/workflows/pull_request.yml` - Added MultiTenant to CI
pipeline

## Testing Instructions

1. Build and deploy the example:
   bash
  cd Examples/MultiTenant
  swift package archive --allow-network-connections docker
  sam deploy --guided
  

2. Test with different tenants:
   bash
curl
"https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id=
alice"
curl
"https://<api-id>.execute-api.<region>.amazonaws.com/Prod?tenant-id=
bob"
  


3. Verify isolation by checking that each tenant maintains separate
request counts

## Related Documentation
- [AWS Lambda Tenant
Isolation](https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html)
- [AWS Blog: Streamlined Multi-Tenant Application
Development](https://aws.amazon.com/blogs/aws/streamlined-multi-tenant-application-development-with-tenant-isolation-mode-in-aws-lambda/)

---------

Co-authored-by: Sebastien Stormacq <stormacq@amazon.lu>
Co-authored-by: Tim Condon <0xTim@users.noreply.github.com>
2025-11-21 21:14:15 +01:00

95 lines
3.2 KiB
Swift

//===----------------------------------------------------------------------===//
//
// This source file is part of the SwiftAWSLambdaRuntime open source project
//
// Copyright SwiftAWSLambdaRuntime project authors
// Copyright (c) Amazon.com, Inc. or its affiliates.
// Licensed under Apache License v2.0
//
// See LICENSE.txt for license information
// See CONTRIBUTORS.txt for the list of SwiftAWSLambdaRuntime project authors
//
// SPDX-License-Identifier: Apache-2.0
//
//===----------------------------------------------------------------------===//
import NIOCore
import NIOHTTP1
@available(LambdaSwift 2.0, *)
enum ControlPlaneRequest: Hashable {
case next
case invocationResponse(String, ByteBuffer?)
case invocationError(String, ErrorResponse)
case initializationError(ErrorResponse)
}
@available(LambdaSwift 2.0, *)
enum ControlPlaneResponse: Hashable {
case next(InvocationMetadata, ByteBuffer)
case accepted
case error(ErrorResponse)
}
@usableFromInline
@available(LambdaSwift 2.0, *)
package struct InvocationMetadata: Hashable, Sendable {
@usableFromInline
package let requestID: String
@usableFromInline
package let deadlineInMillisSinceEpoch: Int64
@usableFromInline
package let invokedFunctionARN: String
@usableFromInline
package let traceID: String
@usableFromInline
package let clientContext: String?
@usableFromInline
package let cognitoIdentity: String?
@usableFromInline
package let tenantID: String?
package init(headers: HTTPHeaders) throws(LambdaRuntimeError) {
guard let requestID = headers.first(name: AmazonHeaders.requestID), !requestID.isEmpty else {
throw LambdaRuntimeError(code: .nextInvocationMissingHeaderRequestID)
}
guard let deadline = headers.first(name: AmazonHeaders.deadline),
let unixTimeInMilliseconds = Int64(deadline)
else {
throw LambdaRuntimeError(code: .nextInvocationMissingHeaderDeadline)
}
guard let invokedFunctionARN = headers.first(name: AmazonHeaders.invokedFunctionARN) else {
throw LambdaRuntimeError(code: .nextInvocationMissingHeaderInvokeFuctionARN)
}
self.requestID = requestID
self.deadlineInMillisSinceEpoch = unixTimeInMilliseconds
self.invokedFunctionARN = invokedFunctionARN
self.traceID =
headers.first(name: AmazonHeaders.traceID) ?? "Root=\(AmazonHeaders.generateXRayTraceID());Sampled=0"
self.clientContext = headers["Lambda-Runtime-Client-Context"].first
self.cognitoIdentity = headers["Lambda-Runtime-Cognito-Identity"].first
self.tenantID = headers[AmazonHeaders.tenantID].first
}
}
struct ErrorResponse: Hashable, Codable {
var errorType: String
var errorMessage: String
}
extension ErrorResponse {
func toJSONBytes() -> [UInt8] {
var bytes = [UInt8]()
bytes.append(UInt8(ascii: "{"))
bytes.append(contentsOf: #""errorType":"#.utf8)
self.errorType.encodeAsJSONString(into: &bytes)
bytes.append(contentsOf: #","errorMessage":"#.utf8)
self.errorMessage.encodeAsJSONString(into: &bytes)
bytes.append(UInt8(ascii: "}"))
return bytes
}
}