Plan a Tenant Data Migration
Move one tenant between data stores without changing who can access it.
A tenant migration can create two live copies of data. During cutover, reads may go to the new store while background jobs still write to the old one. The security decision is not only whether the data moved; it is whether ownership and permissions stayed the same throughout. AWS tenant isolation strategies describe pooled and siloed models that often motivate such moves.
Migration checkpoint plan
| Checkpoint | Boundary decision | Evidence |
|---|---|---|
| Before copy | Tenant and resource inventory frozen | Source manifest |
| Copy | Only selected tenant data moves | Row and object counts |
| Dual-read | Both stores apply same owner rule | Synthetic access tests |
| Cutover | Routes and workers use one intended store | Config and job trace |
| Rollback | Old copy remains protected | Rollback test |
| Cleanup | Stale copy and links are retired | Deletion evidence |
Use a synthetic tenant first. Include one private record, file, export, search entry, and queued job. Verify that an unrelated synthetic tenant remains inaccessible before, during, and after cutover. Do not rely only on counts: compare owner metadata and access outcomes.
Decide on writes during cutover
Choose whether writes pause, go to both stores, or use a single active writer. Record the conflict rule. A dual-write period needs a way to detect missed writes and avoid cross-tenant routing. A rollback must not reactivate a stale permission or removed member. Test the exact route and worker versions that will run during the migration.
The OWASP Multi Tenant Security Cheat Sheet supports verifying every shared path. This checkpoint artifact ties those paths to a cutover sequence. Do not claim a migration is safe because the final database has RLS; temporary copies, queues, and signed links need their own checks. Keep customer moves under a separately approved runbook and scope.
Illustrative cutover checkpoint: A's revoked member is denied in the source store but allowed in the target store. Stop new A writes and do not switch reads to the target. Keep the last reviewed source route active, reconcile the target grant, and rerun A-denied/B-allowed tests before resuming. Record the stop owner, both permission results, rollback route, and the point at which queued jobs resume. This is a test plan, not a report of a completed migration.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.