You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/blog/multi-tenant-system-with-aws-cdk.md
+12-12Lines changed: 12 additions & 12 deletions
Original file line number
Diff line number
Diff line change
@@ -6,19 +6,19 @@ draft: false
6
6
featured: true
7
7
weight: 1
8
8
---
9
-
In this blog I will be taking you on a journey of building the scalable and efficient IaC solution that we build for our multi-tenant system. Here we are not going to debate why we choose the CDK; that will be another discussion that can be highlighted in another blog. Instead, how we approached solving using AWS CDK is going to be discussed in this blog. Even if you are not very familiar with CDK, this blog can help to build a mental model of how we can think while writing the code for the infrastructure of such a complex system.
9
+
In this blog I will be taking you on a journey of building the scalable and efficient IaC solution that we build for our multi-tenant system. Here we are not going to debate why we chose the CDK; that will be another discussion that can be highlighted in another blog. Instead, how we approached solving using AWS CDK is going to be discussed in this blog. Even if you are not very familiar with CDK, this blog can help to build a mental model of how we can think while writing the code for the infrastructure of such a complex system.
10
10
11
11
## What are Multi-tenant Systems?
12
12
13
13
A multi-tenancy architecture uses a single instance of a software application to serve multiple customers. Each customer is referred to as a tenant. Tenants can customize certain aspects of the application, such as the color of the user interface or business rules, but they cannot change the application's code.
14
14
15
-
While there are mainly three types of multi-tenant architecture.
15
+
There are three main types of multi-tenant architecture.
16
16
17
17
1. One Application, One Database: All tenants share a single database.
18
-
2. One Application, Multiple Databases: Each tenant has its own database while sharing the same application instance.
19
-
3. Multiple Applications and Databases: This is the most complex architecture where multiple services and databases are deployed for each tenant.
18
+
2. One Application, Multiple Databases: Each tenant has its own database that shares the same application instance.
19
+
3. Multiple Applications and Databases: This is the most complex architecture, where multiple services and databases are deployed for each tenant.
20
20
21
-
In this blog, we will focus on the third architecture, which provides greater flexibility and isolation
21
+
In this blog, we will focus on the third architecture, which provides greater flexibility and isolation.
22
22
23
23
## What is AWS CDK?
24
24
@@ -53,15 +53,15 @@ As we were using AWS as our cloud provider, we started looking into finalizing t
53
53
54
54
Considering we have what we wanted for our networking infrastructure, then for applications we are going to use Fargate ECS services, RDS for databases, SSM for application environment variables, Secret Manager for application secrets, and Route 53 for maintaining the DNS records.
55
55
56
-
And for continuous integration and continuous deployment we are going to use the GitHub Actions. From all this decision, you might realize that we are avoiding anything self-hosted for now.
56
+
And for continuous integration and continuous deployment, we are going to use GitHub Actions. From all this decision, you might realize that we are avoiding anything self-hosted for now.
57
57
58
58
Before we start looking into CDK code, let me tell you I will only be going through the configuration file with you, not the actual code, because CDK only differs from other IaC tools in that it is written in imperative form, which means we make the configuration file public-facing and the actual code an abstraction, which then helps each member of the org to just learn how to manipulate the configuration file and not the actual code, which helps the infrastructure manipulation be very easy, quick, and scalable.
59
59
60
60
## IaC of Networking
61
61
62
62
Let’s first start looking into how we break down the [recommended](https://github.com/aws-samples/aws-vpc-builder-cdk/tree/main) networking architecture to fit our solution.
63
63
64
-
We took the reference from this [config](https://github.com/aws-samples/aws-vpc-builder-cdk/blob/main/config/sample-firewall-blog.vpcBuilder.yaml) file. Let’s see how we can visualize this configuration file and how the actual output will look like, which can be understood by the below diagram.
64
+
We took the reference from this [config](https://github.com/aws-samples/aws-vpc-builder-cdk/blob/main/config/sample-firewall-blog.vpcBuilder.yaml) file. Let’s see how we can visualize this configuration file and how the actual output will look, which can be understood by the below diagram.
Platform VPC has connectivity with tenants VPCs, and tenants are not having cross-connectivity as we can verify this with dynamicRoutes.
151
+
Platform VPC has connectivity with tenants VPCs, and tenants are not having cross-connectivity, as we can verify this with dynamicRoutes.
152
152
153
153
This setup was the first milestone as a part of the infrastructure, as now to onboard any new tenants we just need to add a small block of code and the routes like below.
154
154
@@ -186,9 +186,9 @@ transitGateways:
186
186
187
187
Moving forward from networking to application was going to be a little tricky because considering this networking setup using CDK, we have to be sure that we maintain the consistency across networking and application code for infrastructure.
188
188
189
-
So we had two options: Either edit the same code to add another support for the application, or create a new CDK project that will only care about the application, considering the networking part is already set up.
189
+
So we had two options: either edit the same code to add another support for the application or create a new CDK project that will only care about the application, considering the networking part is already set up.
190
190
191
-
We choose to go with the 2nd approach because
191
+
We chose to go with the 2nd approach because
192
192
193
193
1. Change in application-related configuration will be more aggressive than networking.
194
194
2. To make application configuration manipulated by developers, we have to keep the unusual data, according to developers, as little as possible in the same place.
@@ -197,7 +197,7 @@ We choose to go with the 2nd approach because
197
197
198
198
## IaC of Application
199
199
200
-
The basic idea of writing AWS CDK code is to bundle the unit of deployment into the same stack. CDK Stack represents a single CloudFormation stack, which is a collection of resources that are deployed together. So here,I have created the stack with a collection of resources that are going to be deployed together and are linked.
200
+
The basic idea of writing AWS CDK code is to bundle the unit of deployment into the same stack. CDK Stack represents a single CloudFormation stack, which is a collection of resources that are deployed together. So here,I have created the stack with a collection of resources that are going to be deployed together and are linked.
201
201
202
202
This is the most important thing to identify upfront: how much power you want to give on manipulation from the configuration file, because if you try to write the CDK code very generically, then it will, at the end, be going to become like a CloudFormation template, and if you keep everything very coupled, then it will also be going to be a challenge if you want to decouple that.
203
203
@@ -258,7 +258,7 @@ Keeping the stateful resources separate is one of the best practices that we fol
258
258
259
259
### Public ALB
260
260
261
-
This is one of the common stacks we identified to create a public-facing application load balancer separately by following practices of attaching ACM, proper security group.
261
+
This is one of the common stacks we identified to create a public-facing application load balancer separately by following practices of attaching ACM and proper security groups.
0 commit comments