title: What are the challenges with a user pool per tenant in a an AWS multi-tenant serverless application
body: <p>I am considering creating a user pool per tenant based on the recommended multi-tenant architecture (for ex: <a href="https://aws.amazon.com/quickstart/saas/identity-with-cognito/" rel="nofollow noreferrer">https://aws.amazon.com/quickstart/saas/identity-with-cognito/</a>)</p>
  <p>The rest of the resources in the application are going to be using pooled resources (for ex: API gateway, dynamoDB tables). Considering the silo model just for the Cognito/auth part of the application.</p>
  <p>Application requirements:</p>
  <ol>
  <li>Subdomain per tenant i.e. tenant1.company.com an tenant2.company.com</li>
  <li>A user can belong to multiple tenants(Forex: User A can be in <code>tenant1</code> and <code>tenant2</code>)</li>
  <li>Need to be able to list all users for a particular tenant</li>
  <li>Data residency restrictions for personally identifiable information</li>
  </ol>
  <p>I believe If I was to use the same Cognito user pool for all tenants, I could force users to use a different email for a new tenant i.e <code>abc@tenant1.com</code> for <code>Tenant1</code> and  <code>abc+tenant2@tenant2.com</code> for <code>Tenant2</code>.</p>
  <p>But to list all users for a particular tenant, I imagine the same user pool for all tenants will not work as tenant_id will be a custom attribute.</p>
  <p>I could also ensure data residency restrictions by creating a user pool per tenant. However, how do I handle regional failover in this case?</p>
  <p>Also, Is subdomain per tenant supported with this approach?</p>
  <p>I hear that the user pool per tenant is constant pain and should be avoided. What are some of the pain points?</p>
  <p>For my use case, Does it look like that I should opt for an AuthZ provider instead like auth0 or authress?</p>