Ravi Sir's Cards › AWS
TENANT# prefix
This revision card explains TENANT# prefix. It starts from the need that keys without tenant prefix leak across customers. Every PK/GSI starts TENANT#tid; bind tid from JWT. The how-to section notes draw two tenants , then Put , then Query only own PK , then never trust body tid. An example on the card is lena Vogt rejects client-supplied tenant ids.
Read card text
What this card says
Why do we need it?
Keys without tenant prefix leak across customers.
What is it?
Every PK/GSI starts TENANT#tid; bind tid from JWT.
TENANT#
How to do it
Draw two tenants → Put → Query only own PK → never trust body tid.
Example
Lena Vogt rejects client-supplied tenant ids.