AWSSaaSLens
title: AWS Well-Architected SaaS Lens type: technique created: 2026-05-21 last_updated: 2026-05-21 related: ["radar/techniques/ServiceLevelObjectives", "radar/techniques/RESTAPIDesign"] sources: ["https://docs.aws.amazon.com/wellarchitected/latest/saas-lens/saas-lens.html"] radar_quadrant: Techniques radar_ring: Assess radar_position: inner
An extension of the AWS Well-Architected Framework specifically addressing multi-tenant SaaS architecture, covering tenant isolation, tiering models, onboarding automation, and per-tenant cost attribution.
The core AWS Well-Architected Framework covers five pillars (operational excellence, security, reliability, performance efficiency, cost optimisation) with generic best practices. The SaaS Lens extends these pillars with SaaS-specific patterns that are absent from the base framework.
Key additions:
Tenant isolation. Three isolation models are defined and compared:
- Silo — dedicated infrastructure per tenant (highest isolation, highest cost).
- Pool — shared infrastructure with logical separation (lowest cost, highest blast radius).
- Bridge — tiered mix: premium tenants get silo resources, standard tenants share pooled resources.
Tiering models. Mapping tenant tiers (free, basic, enterprise) to infrastructure isolation levels, feature flags, and SLA commitments. The lens provides decision criteria for when a tier boundary should trigger a different deployment strategy.
Onboarding automation. SaaS products require tenant provisioning pipelines — creating namespaces, databases, IAM roles, and initial data — without manual intervention. The lens defines this as an architecture requirement, not an operational task.
Per-tenant cost attribution. Allocating AWS costs to individual tenants is a SaaS-specific challenge not addressed by standard cost allocation tags. The lens describes strategies using tenant identifiers propagated through logs and metrics.
The SaaS Lens cross-references standard Well-Architected pillars with SaaS context:
- Security pillar + SaaS: tenant data must be isolated at the storage layer, not just the application layer.
- Cost pillar + SaaS: noisy-neighbour tenants in pooled deployments need throttling, not just billing.
- Reliability pillar + SaaS: a single tenant's outage must not cascade to other tenants.
AWS Well-Architected SaaS Lens sits in the Assess ring of the Techniques quadrant, at inner position. First studied via the AWS documentation (2023-11-29). The lens is an authoritative, structured checklist for anyone building a multi-tenant product on AWS. Inner position reflects direct applicability to any SaaS architecture decision — the isolation model and tiering framework are decisions every multi-tenant product must make explicitly or by default. No tooling required; the value is the structured decision framework. Remaining gate is application to a specific SaaS project's architecture review.
