AWS Cognito JWT attribute-based routing

Question

I'm new to AWS and it's services. What I want to achieve is a multi-tenancy SaaS application. What my concept looks like: I use Cognito for user authentication. There all users no matter what tenant they belong to should use one frontend to login. For the tenant-recognition I use a custom attribute "custom:tenant" which I get from the JWT when the login is successful. For the applicantion itself I want to use VPCs and to ensure encapsulation each tenant should have their own VPC.

Example:

• User A of Tenant 1 login and gets back JWT with claim "custom:tenant":"1" should be routed to VPC 1
• User B of Tenant 2 login and gets back JWT with claim "custom:tenant":"2" should be routed to VPC 2

Now my question is: how do I achieve this routing from the success of the login to the appropriate VPC? Do I need further Services for that or where do I find these settings?

Answer 1

There is a standard content based routing technique for routing based on the contents of JWTs. This type of thing is usually managed by a reverse proxy or API gateway placed in front of APIs, which runs some custom logic to read the JWT and route accordingly. This also keeps the plumbing outside of application components.

EXAMPLE

Here is an NGINX example coded in LUA, a high level scripting language, to read the JWT and extract a claim. In this example it is a zone whereas in your case it is a tenant ID:

• NGINX Configuration
• NGINX Plugin Code
• Architecture Article

PREREQUISITES

Not all middleware supports this type of routing though. Eg you won't be able to do it in a simple load balancer. One option might be to use NGINX as a cloud managed service though it will cost money. A good gateway in front of APIs is an important architectural component though, so see if your company feels it is worth investing in.