Multi-Tenancy and Isolation Questions

Clarify goals & constraints

• Strong isolation across network, compute, storage, IAM, and logging for regulated tenants
• Keep automation, operational scale, and cost-efficiency in mind
• Target: AWS/GCP examples

High-level design (patterns)

• Network: Per-tenant VPCs or VPCs with isolated subnets + strict AWS Network Firewall / security groups and VPC Service Controls (GCP).
• Compute: Dedicated projects/accounts for high-risk tenants; otherwise namespaces (K8s) + PodSecurityPolicies, node taints, or separate node pools.
• Storage: Per-tenant buckets/keys with encryption scopes (KMS per-tenant CMKs) and bucket policies.
• IAM: Least-privilege, IAM boundaries (permission boundaries, organization SCPs), per-tenant roles and service accounts.
• Logging/Monitoring: Centralized ingestion pipeline (e.g., CloudWatch/Stackdriver) with tenant-id tagging and encryption; use separate log buckets/indices with RBAC and retention controls.
• Automation: IaC templates and org-level guardrails (AWS Organizations, GCP Resource Hierarchy).

Account-per-tenant vs Shared-VPC/Namespace

1. Account-per-tenant (strong isolation)

• Security: Maximum—blast radius limited, separate KMS, quotas, IAM boundaries.
• Operational overhead: High—provisioning, configs, cross-account roles, CI/CD pipelines per account.
• Cost: Slightly higher (duplicate infra, controls) but easier chargeback and compliance.
• Use when: PCI, HIPAA, or extremely high trust separation required.

2. Shared-VPC / Namespace (logical isolation)

• Security: Lower surface—isolation relies on policy correctness (network ACLs, namespaces). Risks: misconfig, lateral movement.
• Operational overhead: Lower—fewer accounts, easier shared services, simpler networking.
• Cost: Lower—shared resources (NAT, peering), easier resource utilization.
• Mitigations: Strict network policies, mTLS, KMS key policies per tenant, admission controllers, runtime isolation (gVisor), and strong CI/CD gating.

Recommendation

• Default to account-per-tenant for high-risk tenants; use shared model for low-risk with strong automated policies and periodic attestation.
• Invest in automation (Terraform modules, service catalog), central logging with tenant isolation, and org-level guardrails to reduce ops cost while maintaining security.