Skip to content
Serverless SaaS

Scripts

All scripts use your current AWS credentials and region, and look up stack outputs themselves.

Deploy and tear down

Section titled “Deploy and tear down”
Script What it does
./scripts/deploy.sh <admin-email> cdk bootstrap, deploys every server stack, uploads source.zip, then runs deploy-client.sh
./scripts/deploy-client.sh Builds the admin app, the SaaS app and these docs, and deploys serverless-saas-client. Set DOMAIN_NAME=<zone> for the custom domain.
./scripts/upload-source.sh Zips server/ and uploads it to the versioned source bucket. This triggers the tenant pipeline and is what new Platinum stacks deploy from.
./scripts/cleanup.sh Deletes every Platinum tenant stack, the client stack and all server stacks. CDKToolkit stays.

Tenants

Section titled “Tenants”
Script What it does
ADMIN_PASSWORD=… ./scripts/onboard-tenant.sh <name> <admin-email> <BASIC|STANDARD|PREMIUM|PLATINUM> Registers a tenant through the control plane API and waits until provisioning finishes
ADMIN_PASSWORD=… ./scripts/offboard-tenant.sh <name> Offboards a tenant by name and waits until deprovisioning finishes

Tokens

Section titled “Tokens”
Script What it does
./scripts/admin-token.sh <password> [--set-password] Prints an ID token for the system admin. With --set-password, first sets that password permanently. ADMIN_USERNAME defaults to admin.
./scripts/tenant-token.sh <username> <password> [stackTenantId] Prints an ID token for a tenant user. stackTenantId defaults to pooled. TOKEN_TYPE=AccessToken prints the access token.

Use them with curl:

Terminal window
API=$(aws cloudformation describe-stacks --stack-name serverless-saas-tenant-template-pooled \
  --query "Stacks[0].Outputs[?OutputKey=='ApiGatewayUrl'].OutputValue" --output text)
curl -s -H "Authorization: Bearer $(./scripts/tenant-token.sh alice 'Passw0rd!Saas')" ${API}whoami

Development helpers

Section titled “Development helpers”
Script What it does
./scripts/dev-create-tenant-user.sh <tenantId> <tier> <role> <username> <password> [stackTenantId] Creates a tenant user straight in Cognito with a permanent password, as provisioning would
./scripts/dev-isolation-check.sh <username> <password> <table> <shardId> <sortKeyName> <sortKeyValue> Invokes the authorizer for a user, then calls DynamoDB GetItem with the scoped credentials it vends. Proves IAM-level isolation.

Job scripts (run in CodeBuild)

Section titled “Job scripts (run in CodeBuild)”
Script Run by What it does
server/scripts/provision-tenant.sh Provisioning job, on onboardingRequest Platinum: deploys a silo stack. All tiers: creates the tenant admin and group, exports tenantConfig.
server/scripts/deprovision-tenant.sh Deprovisioning job, on offboardingRequest Deletes the tenant’s users, group and data, or its silo stack
server/scripts/update-tenant.sh Tenant pipeline, per stack Deploys one tenant stack from a given source.zip version