AWS cognito: Retitle B2B multi-tenant page and add tenant isolation overview
Summary
Heading changed to 'Building B2B multi-tenant applications' and a new introductory paragraph was added describing tenant separation within a Region/account and across accounts/Regions, emphasizing the highest level of isolation; also fixed the quotas link target.
Security assessment
The added text documents tenant-isolation architecture (separating tenants across pools/accounts/Regions) which is a security best practice for limiting cross-tenant access, but it is guidance rather than a fix for a specific vulnerability.
Evidence
+This section describes methods that you can implement to separate tenants between Amazon Cognito resources within the same Region and AWS account. You can also split your tenants across more than one AWS account or Region, and give each of them their own quota. Other advantages of multi-Region multi-tenancy include the highest possible level of isolation, shortest network-transit time for globally distributed users, and adherence to existing distribution models in your organization.
Diff
diff --git a/cognito/latest/developerguide/multi-tenant-application-best-practices.md b/cognito/latest/developerguide/multi-tenant-application-best-practices.md index acb4c37..28762c7 100644 --- a//cognito/latest/developerguide/multi-tenant-application-best-practices.md +++ b//cognito/latest/developerguide/multi-tenant-application-best-practices.md @@ -7 +7,3 @@ -# Multi-tenant application best practices +# Building B2B multi-tenant applications + +This section describes methods that you can implement to separate tenants between Amazon Cognito resources within the same Region and AWS account. You can also split your tenants across more than one AWS account or Region, and give each of them their own quota. Other advantages of multi-Region multi-tenancy include the highest possible level of isolation, shortest network-transit time for globally distributed users, and adherence to existing distribution models in your organization. @@ -13,3 +15 @@ Amazon Cognito user pools operate with multi-tenant applications that generate a -Amazon Cognito [quotas](https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html) are applied per AWS account and AWS Region. These quotas are shared across all tenants in your application. Review the Amazon Cognito service quotas, and make sure that the quota meets the expected volume and the expected number of tenants in your application. - -This section describes methods that you can implement to separate tenants between Amazon Cognito resources within the same Region and AWS account. You can also split your tenants across more than one AWS account or Region, and give each of them their own quota. Other advantages of multi-Region multi-tenancy include the highest possible level of isolation, shortest network-transit time for globally distributed users, and adherence to existing distribution models in your organization. +Amazon Cognito [quotas](https://docs.aws.amazon.com/cognito/latest/developerguide/quotas.html) are applied per AWS account and AWS Region. These quotas are shared across all tenants in your application. Review the Amazon Cognito service quotas, and make sure that the quota meets the expected volume and the expected number of tenants in your application. @@ -81 +81 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -ListIdentityPoolUsage +Managing user disclosure