How SeatGeek uses AWS Serverless to control authorization, authentication, and rate-limiting in a multi-tenant SaaS application
AWS Architecture BlogHow SeatGeek uses AWS Serverless to control authorization, authentication, and rate-limiting in a multi-tenant SaaS applicationby Umesh Kalaspurkar, Anderson Parra, Anton Aleksandrov, João Mikos, and Samit Kumbhani | on14 AUG 2023| inAmazon API Gateway,Amazon DynamoDB,Architecture,AWS Lambda,Serverless|Permalink|Comments|ShareSeatGeekis a ticketing platform for web and mobile users, offering ticket purchase and reselling for sports games, concerts, and theatrical productions. In 2022, SeatGeek had an average of 47 million daily tickets available, and their mobile app was downloaded 33+ million times.Historically, SeatGeek used multiple identity and access tools internally. Applications were individually managing authorization, leading to increased overhead and a need for more standardization. SeatGeek sought to simplify the API provided to customers and partners by abstracting and standardizing the authorization layer. They were also looking to introduce centralized API rate-limiting to preventnoisy neighborproblems in their multi-tenant SaaS application.In this blog, we will take you through SeatGeek’s journey and explore the solution architecture they’ve implemented. As of the publication of this post, many B2B customers have adopted this solution to query terabytes of business data.Building multi-tenant SaaS environmentsMulti-tenant SaaS environments allow highly performant and cost-efficient applications by sharing underlying resources across tenants. While this is a benefit, it is important to implement cross-tenant isolation practices to adhere to security, compliance, and performance objectives. With that, each tenant should only be able to access their authorized resources. Another consideration is the noisy neighbor problem that occurs when one of the tenants monopolizes excessive shared capacity, causing performance issues for other tenants.Authentication, authorization, and rate-limiting are critical components of a secure and resilient multi-tenant environment. Without these mechanisms in place, there is a risk of unauthorized access, resource-hogging, and denial-of-service attacks, which can compromise the security and stability of the system. Validating access early in the workflow can help eliminate the need for individual applications to implement similar heavy-lifting validation techniques.SeatGeek had several criteria for addressing these concerns:They wanted to use their existingAuth0instance.SeatGeek did not want to introduce any additional infrastructure management overhead; plus, they preferred to use serverless services to “stitch” managed components together (with minimal effort) to implement their business requirements.They wanted this solution to scale as seamlessly as possible with demand and adoption increases; concurrently, SeatGeek did not want to pay for idle or over-provisioned resources.Exploring the solutionThe SeatGeek team used a combination ofAmazon Web Services (AWS) serverlessservices to address the aforementioned criteria and achieve the desired business outcome.Amazon API Gatewaywas used to serve APIs at the entry point to SeatGeek’s cloud environment. API Gateway allowed SeatGeek to use a customAWS Lambdaauthorizer for integration with Auth0 and defining throttling configurations for their tenants. Since all the services used in the solution are fully serverless, they do not require infrastructure management, are scaled up and down automatically on-demand, and provide pay-as-you-go pricing.SeatGeek created a set of tiered usage plans in API Gateway (bronze, silver, and gold) to introduce rate-limiting. Each usage plan had a pre-defined request-per-second rate limit configuration. A unique API key was created by API Gateway for each tenant.Amazon DynamoDBwas used to store the association of existing tenant IDs (managed by Auth0) to API keys (managed by API Gateway). This allowed us to keep API key management transparent to SeatGeek’s tenants.Each new tenant goes through an onboarding workflow. This is an automated process managed withTerraform. During new tenant onboarding, SeatGeek creates a new tenant ID in Auth0, a new API key in API Gateway, and stores association between them in DynamoDB. Each API key is also associated with one of the usage plans.Once onboarding completes, the new tenant can start invoking SeatGeek APIs (Figure 1).Figure 1. SeatGeek’s fully serverless architectureTenant authenticates with Auth0 usingmachine-to-machine authorization. Auth0 returns a JSON web token representing tenant authentication success. The token includes claims required for downstream authorization, such as tenant ID, expiration date, scopes, and signature.Tenant sends a request to the SeatGeak API. The request includes the token obtained in Step 1 and application-specific parameters, for example, retrieving the last 12 months of booking data.API Gateway extracts the token and passes it toLambda authorizer.Lambda authorizer retrieves the token validation keys from Auth0. The keys are cached in the authorizer, so this happens only once for each authorizer launch environment. This allows token validation locally without calling Auth0 each time, reducing latency and preventing an excessive number of requests to Auth0.Lambda authorizer performs token validation, checking tokens’ structure, expiration date, signature, audience, and subject. In case validation succeeds, Lambda authorizer extracts the tenant ID from the token.Lambda authorizer uses tenant ID extracted in Step 5 to retrieve the associated API key from DynamoDB and return it back to API Gateway.The API Gateway uses API key to check if the client making this particular request is above the rate-limit threshold, based on the usage plan associated with API key. If the rate limit is exceeded, HTTP 429 (“Too Many Requests”) is returned to the client. Otherwise, the request will be forwarded to the backend for further processing.Optionally, the backend can perform additional application-specific token validations.Architecture benefitsThe architecture implemented by SeatGeek provides several benefits:Centralized authorization:Using Auth0 with API Gateway and Lambda authorizer allows for standardization the API authentication and removes the burden of individual applications having to implement authorization.Multiple levels of caching:Each Lambda authorizer launch environment caches token validation keys in memory to validate tokens locally. This reduces token validation time and helps to avoid excessive traffic to Auth0. In addition, API Gateway can be configured with up to 5 minutes of caching for Lambda authorizer response, so the same token will not be revalidated in that timespan. This reduces overall cost and load on Lambda authorizer and DynamoDB.Noisy neighbor prevention:Usage plans and rate limits prevent any particular tenant from monopolizing the shared resources and causing a negative performance impact for other tenants.Simple management and reduced total cost of ownership:Using AWS serverless services removed the infrastructure maintenance overhead and allowed SeatGeek to deliver business value faster. It also ensured they didn’t pay for over-provisioned capacity, and their environment could scale up and down automatically and on demand.ConclusionIn this blog, we explored how SeatGeek used AWS serverless services, such as API Gateway, Lambda, and DynamoDB, to integrate with external identity provider Auth0, and implemented per-tenant rate limits with multi-tiered usage plans. Using AWS serverless services allowed SeatGeek to avoid undifferentiated heavy-lifting of infrastructure management and accelerate efforts to build a solution addressing business requirements.Umesh KalaspurkarUmesh is a Sr Solutions Architect at AWS, and brings more than 20 years of experience in design and delivery of Digital Innovation and Transformation projects, across enterprises and startups. He is motivated by helping customers identify and overcome challenges. Outside of work, Umesh enjoys being a father, skiing, and traveling.Anderson ParraAnder Parra is Staff Software Engineer at SeatGeek and has over 10 years of industry experience in software engineering. He has worked with many different types of systems with diverse constraints and challenges, mainly based on JVM (Java and Scala). He is also experienced in high-scale distributed systems and functional programming. Outside work, Ander enjoys being a father, coffee, and traveling.Anton AleksandrovAnton Aleksandrov is a Principal Solutions Architect for AWS Serverless and Event-Driven architectures. Having over 20 years of hands-on software engineering and architecture experience, Anton is working with major ISV and SaaS customers to design highly scalable, innovative, and secure cloud solutions. Throughout his career Anton has held multiple leading roles architecting solutions for enterprise cloud applications, developer experience, mobile services, and the security space.João MikosJoão Mikos has over 20 years of experience working with development and infrastructure in distributed systems for companies sprawling four continents across various business verticals. Previously, he led infrastructure teams for highly regulated fintech companies and a Solutions Architecture team at AWS. Now a Director of Engineering at SeatGeek, he leads the Developer Acceleration team, responsible for enhancing the experience of customer and partner engineers developing with SeatGeek and the teams developing within SeatGeek.Samit KumbhaniSamit Kumbhani is a Sr. Solutions Architect at AWS based out of New York City area. He has 18+ years of experience in building applications and focuses on Analytics, Business Intelligence, and Databases. He enjoys working with customers to understand their challenges and solve them by creating innovative solutions using AWS services. Outside of work, Samit loves playing cricket, traveling, and spending time with his family and friends.CommentsView Comments
SeatGeek is a ticketing platform for web and mobile users, offering ticket purchase and reselling for sports games, concerts, and theatrical productions. In 2022, SeatGeek had an average of 47 million daily tickets available, and their mobile app was downloaded 33+ million times. Historically, SeatGeek used multiple identity and access tools internally. Applications were individually […]
Umesh Kalaspurkar
Amazon API Gateway Amazon DynamoDB Architecture AWS Lambda Serverless