How to use dynamodb:LeadingKeys when Partition key has more than one kind of values

Question

My Dynamo Tables have tenant_id as the partition key in my multi-tenant application but my partition key also has other types of entities in it in addition to tenant_id.

For example: (This is a small example, we are using this pattern throughout)

PK                                        SK                               Att
Customer-4312a674-54a                  user-abc                            672453782
user-abc                                   user-abc                            672453782

I would like to use dynamodb:LeadingKeys to ensure data of one tenant can never be accessed by another tenant. How can I go about that in this case when PK is overloaded and has other entities in it as well.

Answer 1

In a multi-tenant system my recommendation would be to add the tenant-id as a prefix to the partition key of all items belonging to the tenant. That way you can use the dynamodb:LeadingKeys condition for access control.

The tenant-id should be known at query time for every query anyway, my guess is that it's probably stored in the session information. This means you can add the tenant-id to every Key and still do partition key overloading.