Secure connectivity to tenant specific data centers in pooled SaaS setting

Google Cloud Compute Infrastructure
1

Hi

We have an application which we plan to offer as SaaS in pooled mode. In this case a backend service instance will handle requests from multiple tenants. As part of handling requests these back end service instances will have to call API’s which are exposed by services that are located in tenant specific data centers. The API’s are exposed through private IP’s. These data centers can be located on-prem, GCP, AWS, Azure etc.

Assuming we connect SaaS VPC with each of the customer DC using CloudVPN, we can get the connectivity sorted, so that API’s can be accessed through private IP’s. Now I have two issues:

  1. How do we handle private IP overlaps. Since connected data centers are owned by different tenants, there could be overlaps.

  2. How do we restrict our SaaS backend service from accessing wrong tenant API while processing a request. Say for example, backend service is processing a request from tenant T1 and assume it has an access token associated to T1 while processing this request. With this access token, the service should be able to reach API’s exposed by services running on DC of T1, but not T2. We need this access control to be provided at infrastructure level rather than as part of business logic. How can we achieve this in GCP?

Thank you

2

Normally, there will be private IP overlapping if the VPC is in auto mode, there will be a range of IP that will be used to assign CIDR to the automatically created subnets in the VPC. This is how subnet creation mode works.

I suggest you add a diagram or topology to your question with IP address ranges to better address your concern.