Tenant data residency requirements enforcement in multitenant collaborative work environments
A multitenant collaboration tool is instantiated over physical infrastructure operated by a hosting platform. The multitenant collaboration tool leverages interfaces of the hosting platform to provision and/or instantiate buckets and/or data lakes in particular physical locations, serving from those data lakes tenant data required to be stored within those specified locations. The multitenant collaboration tool includes a multitenant query gateway configured to route data queries from client devices to appropriate multitenant data lakes associated with multitenant collaboration tool.
1. A multitenant collaboration system comprising:
a host comprising a processor allocation executing:
a multitenant collaboration tool executing as a first instance configured to provide server-side functionality for the multitenant collaboration tool; and
a query gateway service executing as a second instance defining an interface to communicate with a client application configured to provide client-side functionality for the multitenant collaboration tool, the query gateway service configured to:
receive a data request via the interface from a client device executing the client application as a third instance, the data request formatted as a structured object comprising as attributes:
a request for a data object stored by the multitenant collaboration tool;
a tenant identifier;
a user account identifier; and
a region identifier;
determine, based on the data request, that the tenant identifier corresponds to a respective one tenant of the first instance;
determine, based on the data request, that the user account identifier is associated with a respective one cloud platform account of one or more host-level service accounts associated with the first instance;
determine, based on the determined user account identifier, a data lake identifier and a respective one data lake, wherein the determined data lake identifier corresponds to the determined respective one data lake of a set of shared data lakes, wherein each shared data lake of the set of the shared data lakes associated with the respective one cloud platform account, and the region identifier identifying a physical location of the determined respective one data lake;
submit a query from the second instance, based on the determined data lake identifier and the identified physical location, to the determined respective one data lake;
receive, from the determined respective one data lake at the second instance, a response to the query, the response comprising the data object retrieved from the determined respective one data lake; and
transmit the response from the second instance to the third instance to cause the third instance to update a display of the client device based on the response.
2. The multitenant collaboration system of claim 1 , wherein the data request comprises the data lake identifier.
3. The multitenant collaboration system of claim 1 , wherein the respective one data lake is selected from a set of data lakes associated with the respective one cloud platform account.
4. The multitenant collaboration system of claim 3 , wherein the set of data lakes comprises a first data lake located in a first physical location and a second data lake located in a second physical location.
5. The multitenant collaboration system of claim 1 , wherein the respective one data lake stores content for a plurality of tenants of the multitenant collaboration tool.
6. The multitenant collaboration system of claim 1 , wherein the multitenant collaboration tool is one of:
an issue tracking system;
a documentation system; or
a project management system.