Discuss a project

DL-038 · Case study

Security readiness review for a multi-tenant SP-API app

A SaaS for Amazon sellers faced Amazon's data-protection assessment. We reviewed its cloud setup, tested a dev environment and checked tenant isolation first.

Client
Name withheld
Location
Israel
Industry
SaaS for Amazon sellers
Capabilities
01Audit04Secure
01

Challenge

  • Amazon's data-protection assessment was coming for a multi-tenant SP-API app.
  • The team wanted an outside view before the assessor's questions arrived.
  • Many sellers' data shares one platform, so isolation had to be proven.
02

Environment

  • Multi-tenant SaaS holding SP-API data for many seller accounts.
  • Production and development environments on AWS.
  • Fixed, time-boxed review scope agreed up front.
03

Intervention

  • Read-only review of the AWS account: access, network, storage and logging.
  • Penetration test of the development environment, never production.
  • Tenant-isolation tests: can one seller's session reach another's data?
  • Mapped the review against Amazon's Data Protection Policy requirements.
04

Outcome

  • A written report the team can act on before the assessment.
  • Each item tied to the Amazon requirement it affects.
  • Production stayed untouched throughout the review.
Three review tracks surround a multi-tenant SP-API platform: a read-only AWS review, a penetration test of the development environment and tenant-isolation tests, all feeding one written report.CLIENT AWS ACCOUNTread-onlypentestSP-APISeller dataPRODUCTIONRead-only reviewDEV ENVPentest targetTENANTS A / BIsolation testsREVIEWScope + testsREPORTWritten
  1. 01SP-APISeller dataPRODUCTIONRead-only review
  2. 02REVIEWScope + testsPRODUCTIONRead-only reviewread-only
  3. 03REVIEWScope + testsDEV ENVPentest targetpentest
  4. 04REVIEWScope + testsTENANTS A / BIsolation tests
  5. 05REVIEWScope + testsREPORTWritten
Fig. 01Review scope around the platformThree review tracks surround a multi-tenant SP-API platform: a read-only AWS review, a penetration test of the development environment and tenant-isolation tests, all feeding one written report.Scale NTS

Stack and services.

Stack06

  • AWS
  • Amazon SP-API
  • IAM review
  • Penetration testing
  • Tenant-isolation testing
  • Data Protection Policy

Services used03

Tell us what has to work.

A senior engineer reads every brief. Describe the system, what it runs on today and what happens when it fails.

Discuss a project