Bootstrap stack: tenant mapping table and tier API keys

Goal

Create the shared application plane resources that must exist before any tenant is onboarded:

1. A tenant mapping table: which CloudFormation stack serves each tenant.
2. One API Gateway API key per tier (Basic, Standard, Premium, Platinum), with the key id and value stored in SSM Parameter Store.

Background: tiers and deployment models

The reference solution sells four tiers and serves them two ways:

Tier	Deployment model	Where the tenant’s API, Lambdas and tables live
Basic, Standard, Premium	Pooled	One shared stack serverless-saas-tenant-template-pooled, shared by all these tenants
Platinum	Silo	A dedicated stack serverless-saas-tenant-template-<tenantId> per tenant (step 09)

Tiers also differ in how much traffic a tenant may send. API Gateway enforces that with usage plans (throttle + daily quota), and a usage plan applies to the requests that carry one of its API keys. Tenants never see these keys. In step 04 the Lambda authorizer looks at the caller’s tier and tells API Gateway which key to count the request against.

Why SSM parameters

The tenant template stack (steps 03–07) needs each key’s id (to attach it to a usage plan) and value (so the authorizer can return it). But:

• CloudFormation can’t read an API key’s value back after creation.
• Tenant stacks are deployed separately, later, and in step 08 by a CodeBuild job, so they can’t use a direct cross-stack reference to this stack.

So the bootstrap stack writes four pairs of parameters (apiKeyBasicTierKeyId / apiKeyBasicTierValue, and so on), and each tenant stack reads them at deploy time.

Files

• server/cdk/lib/bootstrap-template/bootstrap-template-stack.ts: the table and the four keys.
• server/cdk/lib/bootstrap-template/tenant-api-key.ts: construct for one API key plus its two SSM parameters.
• server/cdk/lib/interfaces/api-key-ssm-parameter-names.ts: the parameter names, shared by both stacks.
• server/cdk/bin/serverless-saas.ts: default key values, which you can override with CDK_PARAM_API_KEY_<TIER>_TIER.

In step 08 this stack also gets the provisioning/deprovisioning jobs (the “core application plane”).

Deploy

./scripts/deploy.sh you@example.com
# or just this stack:
cd server/cdk && CDK_PARAM_SYSTEM_ADMIN_EMAIL=you@example.com npx cdk deploy serverless-saas-bootstrap

Verify

aws ssm get-parameters --names apiKeyBasicTierKeyId apiKeyBasicTierValue apiKeyPlatinumTierKeyId \
  --query 'Parameters[].[Name,Value]' --output text

Result from the test deployment:

apiKeyBasicTierKeyId     6bo0lteh78
apiKeyBasicTierValue     daae9784-6d96-11eb-a28b-38f9d33cfd0f-basic
apiKeyPlatinumTierKeyId  nd2li421x1

aws apigateway get-api-key --api-key 6bo0lteh78   # enabled: true, not attached to any usage plan yet

Next

Step 03 creates the pooled tenant template stack, starting with the tenant Cognito user pool.