the platform journey

From browser to bedrock, in five panels.

The five primitives that make a multi-tenant SaaS on EKS feel boring in the best way.

01 · isolation

Every query. Every tenant. Zero trust.

Postgres RLS with FORCE. Tenant context bound at JWT verify, then attached to the connection for the lifetime of the request. A forgotten WHERE clause can't leak across tenants.

migrations/003_rls.sql

1ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
2ALTER TABLE orders FORCE  ROW LEVEL SECURITY;
3
4CREATE POLICY tenant_isolation ON orders
5  FOR ALL
6  USING (tenant_id = current_setting('app.tenant_id'));

02 · workflows

Durable by default. State that survives a node crash.

Step Functions drives the checkout saga end-to-end. Kinesis broadcasts order events to downstream consumers. Both are at-least-once with idempotency keys baked into the contract.

Reserve→Charge→Fulfill→Email→Done

03 · visibility

Three signals. Browser → Lambda → Postgres.

OpenTelemetry covers spans, metrics, and logs. Every tenant attribute is auto-propagated. A single trace shows the whole journey, including the WebSocket fanout.

04 · defense

Five layers, no soft middle.

WAF at the edge, HSTS + CSP at the transport, JWT verify in the API gateway, RLS at the database, append-only audit log on the side. Defence-in-depth without surprise dependencies.

1WAFrate · OWASP
2TLS / HSTSedge
3JWT verifyJWKS rotate
4Postgres RLSforce
5Audit logappend-only

05 · shipping

Approval gates. Digest-pinned. Zero-downtime.

Build → cosign → trivy → manual approval → kubectl rollout. /ready verifies, or kubectl rolls back. The same pipeline runs every PR.

PRLintTestBuildSignScanPlanApproveDeployVerifyRollback

the building blocks

Five primitives, five guarantees.

tile 01 · multi-tenancy

ADR-014

A forgotten WHERE can't leak.

Force-RLS on every customer table. Tenant context is bound at JWT verify and propagates via current_setting('app.tenant_id'). No bypass for the application role.

migrations/003_rls.sql

1ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
2ALTER TABLE orders FORCE  ROW LEVEL SECURITY;
3CREATE POLICY tenant_isolation ON orders
4  FOR ALL
5  USING (tenant_id = current_setting('app.tenant_id'));
6GRANT SELECT, INSERT, UPDATE ON orders TO app_role;
7REVOKE BYPASSRLS FROM app_role;

Force-RLS on every customer table — bypass requires the postgres role.

tile 02 · auth

ADR-016

JWT, end-to-end.

Cognito issues; middleware verifies; Express trusts the context. JWKS rotates without an app deploy. Every layer carries the same tenant claim.

tile 03 · search

ADR-017

Warm under 100 ms.

Postgres tsvector + GIN. Lambda gateway with JWT authoriser. Identical relevance for the tenant-scoped catalog.

tile 04 · realtime

ADR-018

Push, not poll.

API Gateway WebSocket, DynamoDB registry, λ fanout. Reconnect with full jitter. Tenant-scoped, sub-aware.

tile 05 · saga

ADR-019

Checkout, durable.

Step Functions orchestrates Reserve → Charge → Fulfill → Email. Compensations on every leg. State survives node loss.

Reserve→Charge→Fulfill→Email→Done