Multi-tenancy with Amazon ElastiCache: Choosing the right isolation model

This article explores multi-tenancy isolation models for Amazon ElastiCache for Valkey, helping SaaS architects choose the right approach based on tenant count, compliance requirements, and failure scope.

• Dedicated serverless caches provide full physical isolation with automatic scaling and lower operational overhead than provisioned clusters
• ACL/RBAC on shared clusters enforce server-side data access boundaries while sharing compute and memory resources
• Valkey 9.1 numbered databases with database-scoped ACLs offer cleaner namespace separation than key prefixes without per-tenant infrastructure
• Client-side encryption using AWS KMS hierarchical keyrings enables per-tenant encryption keys on shared clusters as a compensating control
• Most SaaS applications use tiered strategies, assigning tenants to different isolation models based on compliance posture and risk tolerance
• A tenant-aware data-access layer resolves each tenant to an endpoint and database index transparently across all tiers

The right isolation model balances scope of failure, trust boundaries, and compliance requirements rather than being determined solely by tenant count.