SaaS tenant isolation with ABAC using AWS STS support for tags in JWT
Security Blog
The article discusses how to implement tenant isolation in a multi-tenant SaaS application using the AWS STS AssumeRoleWithWebIdentity API operation and the https://aws.amazon.com/tags claim in JSON Web Tokens (JWTs).
Specifically, the article covers:
- An architecture overview of a multi-tenant SaaS application using a shared infrastructure model
- Configuration steps, including configuring an OIDC provider with the tags claim, setting up an IAM OIDC identity provider, and creating an IAM role with a trust policy
- How AssumeRoleWithWebIdentity differs from AssumeRole in terms of simplifying the application architecture and enforcing the tenant ID session tag format
- Conclusion emphasizing the benefits of offloading JWT verification and mapping the tenant ID to session tags
The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.
Related articles
Jun 25
2024
2024
Tenant routing strategies for SaaS applications on AWS
Nov 20
2025
2025
Building multi-tenant SaaS applications with AWS Lambda’s new tenant isolation mode
Aug 28
2024
2024
Implementing tenant isolation using Agents for Amazon Bedrock in a multi-tenant environment
May 10
2024
2024
Navigating SaaS security and compliance with AWS AppFabric
The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.