AWS Certified Solutions Architect – Professional — Question 653

A company has a serverless multi-tenant content management system on AWS. The architecture contains a web-based front end that interacts with an Amazon
API Gateway API that uses a custom AWS Lambda authorizer. The authorizer authenticates a user to its tenant ID and encodes the information in a JSON Web
Token (JWT) token. After authentication, each API call through API Gateway targets a Lambda function that interacts with a single Amazon DynamoDB table to fulfill requests.
To comply with security standards, the company needs a stronger isolation between tenants. The company will have hundreds of customers within the first year.
Which solution will meet these requirements with the LEAST operational overhead?

Answer options

• A. Create a DynamoDB table for each tenant by using the tenant ID in the table name. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach IAM policies to the execution role to allow access only to the DynamoDB table for the tenant.
• B. Add tenant ID information to the partition key of the DynamoDB table. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach IAM policies to the execution role to allow access to items in the table only when the key matches the tenant ID.
• C. Create a separate AWS account for each tenant of the application. Use dedicated infrastructure for each tenant. Ensure that no cross-account network connectivity exists.
• D. Add tenant ID as a sort key in every DynamoDB table. Add logic to each Lambda function to use the tenant ID that comes from the JWT token as the sort key in every operation on the DynamoDB table.

Correct answer: B

Explanation

Option B is correct because combining the tenant ID in the DynamoDB partition key with IAM fine-grained access control (using leading keys) provides strong, secure tenant isolation at the data layer with minimal operational overhead. Options A and C require managing hundreds of tables or AWS accounts, which introduces massive operational complexity and overhead. Option D relies on application-level logic inside the Lambda function to enforce isolation, which does not provide robust security isolation at the IAM/database layer and is prone to developer error.