Add support for Lambda Tenants #608
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 tasks
Collaborator
Author
|
API Breakage on |
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for AWS Lambda's tenant isolation mode to the Swift AWS Lambda Runtime, enabling developers to build multi-tenant applications with strict execution environment isolation per tenant. The implementation exposes tenant IDs through the LambdaContext and includes a comprehensive working example.
- Added
tenantIDproperty toLambdaContextto expose tenant identifiers from the Lambda runtime - Extended runtime internals to capture and propagate the
Lambda-Runtime-Aws-Tenant-Idheader through the invocation pipeline - Created a complete MultiTenant example demonstrating tenant isolation with actor-based storage and API Gateway integration
Reviewed Changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| Sources/AWSLambdaRuntime/LambdaContext.swift | Added tenantID property to context storage and public API |
| Sources/AWSLambdaRuntime/ControlPlaneRequest.swift | Extended InvocationMetadata to capture tenant ID from invocation headers |
| Sources/AWSLambdaRuntime/Utils.swift | Added tenantID header constant for Lambda runtime |
| Sources/AWSLambdaRuntime/Lambda.swift | Updated context initialization to pass tenant ID |
| Sources/AWSLambdaRuntime/LambdaRuntimeClient+ChannelHandler.swift | Added trace logging for invocation headers |
| Tests/AWSLambdaRuntimeTests/InvocationTests.swift | Added unit test for tenant ID extraction |
| Examples/MultiTenant/Sources/main.swift | Complete example with actor-based tenant data store and API Gateway handler |
| Examples/MultiTenant/template.yaml | SAM template configured with TenantIsolationMode: PER_TENANT and API Gateway integration |
| Examples/MultiTenant/README.md | Comprehensive documentation covering architecture, deployment, and best practices |
| Examples/MultiTenant/Package.swift | Package manifest for the MultiTenant example |
| Examples/MultiTenant/event.json | Sample API Gateway event for local testing |
| Examples/MultiTenant/.gitignore | Git ignore rules for generated files |
| Examples/HelloWorldNoTraits/.gitignore | Added Dockerfile to ignore list |
| .github/workflows/pull_request.yml | Added MultiTenant example to CI pipeline |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
0xTim
approved these changes
Nov 21, 2025
Collaborator
0xTim
left a comment
0xTim
left a comment
There was a problem hiding this comment.
Couple of nits, nothing blocking
Co-authored-by: Tim Condon <[email protected]>
Co-authored-by: Tim Condon <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Address #605
NEW Lambda Tenant isolation capability:
https://docs.aws.amazon.com/lambda/latest/dg/tenant-isolation.html
Add Support for Lambda Tenant Isolation Mode
Summary
This PR adds support for AWS Lambda's tenant isolation mode to the Swift AWS Lambda Runtime, enabling developers to build multi-tenant applications with strict execution environment isolation per tenant.
Changes
Runtime Support
tenantIDproperty toLambdaContextto expose the tenant identifierInvocationMetadatato capture theLambda-Runtime-Aws-Tenant-IdheaderAmazonHeaders.tenantIDconstant for the tenant ID headerNew Example: MultiTenant
A complete working example demonstrating tenant isolation mode:
TenantDataStore) for thread-safe tenant data managementTenantData) following Swift best practicesTenancyConfig.TenantIsolationMode: PER_TENANTTesting
Documentation
The example includes detailed documentation on:
Files Changed
Sources/AWSLambdaRuntime/LambdaContext.swift- Added tenantID propertySources/AWSLambdaRuntime/ControlPlaneRequest.swift- Capture tenant ID from headersSources/AWSLambdaRuntime/Utils.swift- Added tenantID header constantSources/AWSLambdaRuntime/Lambda.swift- Pass tenant ID to contextSources/AWSLambdaRuntime/LambdaRuntimeClient+ChannelHandler.swift- Added trace loggingTests/AWSLambdaRuntimeTests/InvocationTests.swift- Added tenant ID testExamples/MultiTenant/*- New complete example with SAM template.github/workflows/pull_request.yml- Added MultiTenant to CI pipelineTesting Instructions
Build and deploy the example:
bash
cd Examples/MultiTenant
swift package archive --allow-network-connections docker
sam deploy --guided
Test with different tenants:
bash
curl "https://.execute-api..amazonaws.com/Prod?tenant-id=
alice"
curl "https://.execute-api..amazonaws.com/Prod?tenant-id=
bob"
Verify isolation by checking that each tenant maintains separate request counts
Related Documentation