Server-Side Tenant Isolation with AppSync
A multi-tenant GraphQL support ticket system on AppSync and DynamoDB with server-side tenant membership resolution from Cognito, fine-grained authorization on every operation, optimistic concurrency, tenant-scoped real-time subscriptions, and a documented least-privilege authorization model.
SaaS support data leaks across tenants when authorization lives in client code or is checked inconsistently.
Demonstrates tenant isolation done correctly: membership resolved server-side from identity, enforced on every operation, with the model documented and tested.
Tenant membership comes from verified Cognito identity, never client claims.
Every query, mutation, and subscription checks tenant scope.
Real-time ticket updates stay within the tenant boundary.
Identity-first API: authentication establishes who you are, resolvers establish which tenant you belong to, and every data path re-checks both.
Client ──> Cognito Auth ──> AppSync ──┬──> Tenant Resolver ──> DynamoDB (tenant-partitioned)
└──> Subscriptions (tenant-scoped)graphql-multitenant/
├── schema.graphql # Types + directives
├── resolvers/ # Tenant-aware resolvers
├── auth/
│ └── model.md # Documented authorization model
└── tests/
└── cross-tenant.spec # Negative security testsRun active operations audits utilizing the custom sandbox telemetry receiver widget below.
Client-side checks are bypassable; missing a single resolver creates a leak.
Per-resolver server checks from Cognito identity
Accepted per-resolver implementation cost for a single verifiable enforcement point pattern.
Generate resolver authorization boilerplate from the schema directives.
The critical failure mode is one tenant reading another tenant’s tickets.
Over-broad table access would undermine resolver-level checks.
Keeping real-time subscriptions inside tenant boundaries.
Root Cause:Subscription filters are easy to leave broad while queries are locked down.
Tested subscription payloads across two tenants and confirmed the scoping gap.
Bound subscription filters to the same resolved tenant context as queries.
More resolver plumbing for live features.
Real-time paths need the same authorization rigor as request paths.
Authorization models should be written down before resolvers, not after.
Server-side identity derivation is the only tenant boundary you can trust.
A documented authorization model is itself a deliverable enterprise buyers ask for.
I would drive resolver checks from schema directives to remove boilerplate.
Audit raw repository script configurations directly inside the active terminal workspace.
Keep exploring
An event-driven cloud security analytics pipeline that ingests AWS CloudTrail records, applies normalization and risk scoring heuristics, and fires alert integrations under 45 seconds to secure distributed multi-tenant AWS accounts.
ArchitectureCloudTrail → S3 → Lambda → EventBridge → SNS
A security orchestration pipeline that detects unauthorized EC2 security group modifications via EventBridge, orchestrates response with Step Functions, isolates instances with Lambda, captures EBS forensic evidence, and publishes reports to SNS.
ArchitectureEventBridge → Step Functions → Lambda → EBS Snapshots → SNS
A multi-cloud serverless deployment leveraging AWS Lambda, DynamoDB, and Azure Functions to build scalable pipelines that minimize operational overhead.
ArchitectureAPI Gateway → Lambda / Azure Functions → DynamoDB / CosmosDB