✨ feat(multi-tenant): add dynamic IAM roles per tenant for isolated resource access

[ito-haruto24-fixer]

Summary

• Implements dynamic IAM role creation and assumption for multi-tenant isolation
• Adds tenant context throughout the authentication and data access layers
• Provides strong security boundaries between tenants using AWS IAM

Key Features

1. Tenant Context in Authentication

• Added custom tenantId attribute to Cognito User Pool
• Updated user pool client to read tenant attributes
• Tenant ID flows through JWT tokens to Lambda functions

2. Dynamic IAM Role Management

• Created TenantRole construct for defining tenant-specific IAM policies
• Implemented TenantManager for dynamic role creation/deletion
• Lambda function manages tenant roles via CloudFormation custom resources

3. Tenant-Aware Lambda Utilities

• tenantAuth.ts: Extract tenant ID and assume tenant-specific roles
• bedrockClientTenant.ts: Initialize Bedrock clients with tenant credentials
• tenantDynamoDB.ts: DynamoDB operations with tenant-prefixed partition keys
• tenantS3.ts: S3 operations with tenant-prefixed object keys

4. Resource Isolation Strategies

• DynamoDB: Partition key prefixing (tenantId#recordId)
• S3: Object key prefixing (tenants/{tenantId}/...)
• Bedrock: Role-based access with request tagging
• IAM: Condition-based policies enforcing tenant boundaries

5. Tenant Onboarding

• Automated tenant provisioning via onboardTenant Lambda
• Creates IAM role, Cognito group, and admin user
• Sets up initial tenant resources and permissions

Architecture Benefits

• Strong Isolation: IAM policies prevent cross-tenant access at AWS service level
• Scalability: Dynamic role creation supports unlimited tenants
• Auditability: All actions tagged with tenant ID for CloudTrail
• Flexibility: Per-tenant resource limits and permissions

Migration Path

1. Add tenant attributes to existing Cognito users
2. Create IAM roles for existing tenants
3. Update Lambda functions to use tenant-aware utilities
4. Migrate data to include tenant prefixes
5. Enable dynamic role assumption

Testing

• Unit tests for tenant utility functions
• Integration tests for role assumption flow
• End-to-end tests for tenant isolation

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com