Several customers share an API, and each must only reach their own data.

When this becomes useful

A new customer or teammate needs access, but your application must keep their work separate from everyone else’s. The useful starting point is one that shows where identity enters the request and where access is checked.

What the template offers

API tenant isolation is a AWS example pattern from AWS Serverless Patterns. It offers a concrete implementation to inspect and adapt. A starting point for thinking through tenant context at an API boundary. Verify every downstream data access uses the same tenant identity.

Technical shape

Trace the tenant identifier from API request to Lambda authorization and downstream data access. Look for every place it could be replaced by client input.

Questions worth answering

• Where does customer or tenant identity come from?
• Which actions need a server-side permission check?
• How are sessions and access revoked?

Inspect the source

Read the maintainer's README, license, setup instructions and current repository state before adapting the code.