Create a reference architecture for relaying messages between accounts for multi-tenant SaaS platforms

[timmattison]

Multi-tenant SaaS platforms may want to use multiple AWS accounts to isolate their customers from "noisy neighbors". This architecture shows how to send messages from IoT Core in one account to another.

In the producer account it utilizes the IoT Core rules engine and drops messages into an SQS queue.

In the consumer account it utilizes a Lambda function and the recently released feature to allow a Lambda function to be triggered from an SQS queue in another account.

This design can be launched a second time with the accounts reversed to allow for bidirectional communication.

Using SQS as a buffer prevents account limits in one account from impacting the other. If a producer causes the consumer's account to receive a "Rate Exceeded" error the consumer can temporarily disable the event source mapping until the issue is resolved.