Skip to content
Serverless SaaS

Introduction

This project is a from-scratch rebuild of the AWS Serverless SaaS Reference Solution. It is a working multi-tenant SaaS product (a small products-and-orders app) where many customer companies, called tenants, share one deployment, and each tenant can only ever see its own data.

It was built in 12 small steps. Each step was one pull request, deployed to AWS and verified before it was merged, and each has its own walkthrough under Build it step by step.

Who it’s for

Section titled “Who it’s for”
  • Engineers designing a SaaS product on AWS who want to see tenant isolation, tiering and onboarding working end to end, not just on a slide.
  • Teams evaluating the SaaS Builder Toolkit (SBT) for their control plane.
  • Anyone who learns best by reading small, reviewed diffs.

What it teaches

Section titled “What it teaches”
Idea Where
Control plane vs application plane Architecture
Tenant identity as custom Cognito claims Tenant identity
A Lambda authorizer that vends tenant-scoped credentials Tenant isolation
Pooled data isolated with dynamodb:LeadingKeys Tenant isolation
Tiers, API keys and usage plans Tiers
Event-driven onboarding and offboarding Onboarding
Silo stacks for premium tenants Tiers
Rolling code out to every tenant stack Deployments

Differences from the original

Section titled “Differences from the original”
  • React (Vite and TypeScript) instead of Angular for both web apps.
  • Current versions: SBT 0.9.x, Python 3.13 Lambdas on ARM64, Powertools for AWS Lambda v3 and PyJWT.
  • Least-privilege jobs: the original gives provisioning and pipeline CodeBuild jobs "Action": "*". Here they get only what their scripts need, and deploy stacks through the CDK bootstrap roles.
  • Bugs fixed: products’ PUT and DELETE were wired to the create handler, and users created through the API had no tenant id or tier.
  • A /whoami endpoint shows exactly what the authorizer produced, which makes the isolation model easy to inspect.

How these docs are organised

Section titled “How these docs are organised”
  • Start here: deploy it and give it a domain name.
  • Concepts: how the system works and why it’s built that way.
  • Using the apps: the admin console and the SaaS app, with screenshots of the live deployment.
  • Operations: the scripts, logs, metrics and common problems.
  • Reference: stacks and outputs, both APIs and the repository layout.
  • Build it step by step: the original per-PR walkthroughs, with the exact commands and results from the test deployment.