Agent based multi tenant SaaS using AWS IoT core

Building an agent-based multi-tenant SaaS solution using AWS IoT Core is indeed a viable approach for your use case. AWS IoT Core provides secure communication channels between your SaaS application and the agents deployed on your clients' infrastructure. However, your concerns about potential bypassing of your SaaS controls are valid and need to be addressed carefully.

To address your specific questions:

1. Is it possible for a client to bypass your SaaS and control the agent directly?

   Yes, it is theoretically possible if the client gains access to the client-specific X.509 certificates and manages to decrypt the live session. However, AWS IoT Core provides several security measures to mitigate this risk.

2. Is there a way to avoid this?

   While it's challenging to completely eliminate the risk, you can implement several strategies to significantly reduce the possibility of unauthorized access:

   a. Use AWS IoT Core's fine-grained permissions: Implement strict IAM policies and AWS IoT policies to control what actions each device (agent) can perform. This limits the potential damage even if a client gains unauthorized access.

   b. Implement mutual authentication: Use both server and client-side certificates for authentication. This ensures that both the agent and your SaaS platform can verify each other's identity.

   c. Rotate credentials regularly: Implement a system to rotate the X.509 certificates periodically. This limits the window of opportunity for potential misuse.

   d. Encrypt sensitive data: Use AWS IoT Core's encryption capabilities to protect sensitive data in transit and at rest.

   e. Implement robust monitoring and alerting: Use AWS IoT Core's monitoring features to detect unusual patterns or unauthorized access attempts.

   f. Split functionality between agent and SaaS: Consider keeping critical business logic on your SaaS platform rather than on the agent. The agent could be designed to request instructions from the SaaS for sensitive operations.

   g. Implement additional authentication layers: Consider adding application-level authentication in addition to the AWS IoT Core's security measures.

By implementing these measures, you can create a robust security model that significantly reduces the risk of unauthorized access or bypassing of your SaaS controls. Remember that security is an ongoing process, and you should regularly review and update your security measures to address new potential threats.

Sources
Tenant Switching and Custom Permissions in a Multi-Tenant Serverless Application | AWS Partner Network (APN) Blog
Amazon Verified Permissions multi-tenant design considerations - AWS Prescriptive Guidance
Multi-tenant SaaS authorization and API access control: Implementation options and best practices - AWS Prescriptive Guidance