SAP-C03 practice question: Stateless and multi-tenant SaaS architectures
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A news publisher runs a white-label publishing platform for regional newspapers. Most tenants are small and share one platform stack, but two large regional groups are regulated and need their article data in their own AWS account, encrypted with a customer managed KMS key that only they control.
The platform team wants small tenants to share one DynamoDB table, and no tenant may read another tenant's items, even if an application bug builds the wrong query. Onboarding a small tenant should not need new infrastructure.
Which TWO changes meet these requirements? (Choose two.)
Choose two answers.
AA. Use one shared DynamoDB table keyed by tenant ID, and give each tenant's Lambda functions an IAM policy with a dynamodb:LeadingKeys condition that limits access to that tenant's items.
BB. Use one shared DynamoDB table and one IAM role for all tenants' functions, and have the application code add the tenant ID as a filter to every query it builds.
CC. Encrypt all tenants' data with one shared customer managed KMS key that the platform account controls, and rotate that key every year.
DD. Create one DynamoDB table for every tenant, small or large, and attach a separate customer managed KMS key to each table.
EE. Deploy a separate stack for each of the two regulated groups in its own account, with its own DynamoDB table and a customer managed KMS key that the group's own key policy controls.
Show the answer and explanation
Answers: A, E
A. Right: Correct. The LeadingKeys condition makes IAM enforce the tenant boundary on every request, so a query built with the wrong tenant ID is denied. Small tenants keep sharing the table, and onboarding only adds a key value.
B. Wrong: The tenant boundary then depends on application code being correct. A query that omits the tenant filter would return other tenants' items, which breaks the isolation requirement.
C. Wrong: Rotation does not change who holds the key. The two regulated groups need keys they control, and a shared key in the platform account does not meet that requirement.
D. Wrong: This isolates each tenant, but it adds an infrastructure step for every small tenant at onboarding. The requirement is that small tenants share one table, so this option contradicts it.
E. Right: Correct. A separate account and key for each regulated group gives silo isolation and keeps the group's key under its own control. This is the right answer for the two large tenants only, so it is paired with a shared design for the small ones.
Explanation
Sharing one table is acceptable only when IAM enforces the tenant boundary, which the LeadingKeys condition does. The two regulated groups need silo accounts with their own keys. Shared code-based filtering and one shared key each fail a stated requirement.
Want more on Stateless and multi-tenant SaaS architectures? The 5 full-length practice sets have 6 more Stateless and multi-tenant SaaS architectures questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →