What are the challenges with a user pool per tenant in a an AWS multi-tenant serverless application

问题

I am considering creating a user pool per tenant based on the recommended multi-tenant architecture (for ex: https://aws.amazon.com/quickstart/saas/identity-with-cognito/)

The rest of the resources in the application are going to be using pooled resources (for ex: API gateway, dynamoDB tables). Considering the silo model just for the Cognito/auth part of the application.

Application requirements:

1. Subdomain per tenant i.e. tenant1.company.com an tenant2.company.com
2. A user can belong to multiple tenants(Forex: User A can be in tenant1 and tenant2)
3. Need to be able to list all users for a particular tenant
4. Data residency restrictions for personally identifiable information

I believe If I was to use the same Cognito user pool for all tenants, I could force users to use a different email for a new tenant i.e abc@tenant1.com for Tenant1 and abc+tenant2@tenant2.com for Tenant2.

But to list all users for a particular tenant, I imagine the same user pool for all tenants will not work as tenant_id will be a custom attribute.

I could also ensure data residency restrictions by creating a user pool per tenant. However, how do I handle regional failover in this case?

Also, Is subdomain per tenant supported with this approach?

I hear that the user pool per tenant is constant pain and should be avoided. What are some of the pain points?

For my use case, Does it look like that I should opt for an AuthZ provider instead like auth0 or authress?

来源：https://stackoverflow.com/questions/65515499/what-are-the-challenges-with-a-user-pool-per-tenant-in-a-an-aws-multi-tenant-ser