Observability

Every Lambda in the tenant stacks uses a shared Lambda layer that tags logs, metrics and traces with the tenant, so service code doesn’t do it by hand.

Signal	How	Tenant field
Logs	Powertools logger, log_with_tenant_context	tenant_id on every line
Metrics	CloudWatch embedded metric format in namespace ServerlessSaaS	tenant_id dimension
Traces	X-Ray, enabled on every function	TenantId annotation

Logs for one tenant

In CloudWatch Logs Insights, pick the service’s log groups and run:

fields @timestamp, service, message, tenant_id
| filter tenant_id = "6e02dc17-5c4c-4af6-8715-06ebf3d9dbc8"
| sort @timestamp desc

A log line looks like this:

{"level":"INFO","message":"Request received to create an order","service":"OrderService","tenant_id":"6e02dc17-…","xray_trace_id":"1-6ad7805d-…"}

Metrics

Services emit metrics such as ProductCreated, ProductsRetrieved, OrdersRetrieved and WhoAmICalled, with the dimensions tenant_id and service. Graph them per tenant in CloudWatch under All metrics → ServerlessSaaS.

Each function also has a CloudWatch alarm on errors.

Where to look

What	Where
Events between the planes	Log group /aws/events/serverless-saas-event-bus-watcher
Provisioning and deprovisioning	Step Functions and CodeBuild projects in the serverless-saas-bootstrap stack
Pipeline runs	CodePipeline serverless-saas-tenant-pipeline and its state machine
Authorizer decisions	The …AuthorizerFunc… log group of each tenant stack
Code version of a tenant stack	GET /whoami → codeVersion, or codeCommitId in the tenant mapping table