saas
Tenant Incident Triage
Search one tenant's incidents by meaning, filtered on what you declared.
A vector index makes you decide more than a GSI does. You nominate the attribute it partitions by and the attributes it may filter on, at creation, and a search that references anything else is refused outright rather than degrading into a scan. Same argument as every index on this site, arriving somewhere new.
The model
Incident
One incident for one tenant. severity and assignee are deliberately not filterable.
- pk
- TENANT#<tenantId>
- sk
- INCIDENT#<incidentId>
Attributes: tenantId (S), status (S), service (S), severity (N), assignee (S), summary (S), embedding (L)
Access patterns
- SearchVectors · by-tenantSimilar open incidents for a tenant
Incidents like this one, in this tenant, still open, on this service.
Design notes
You can only filter on what you declaredmodelling
severity and assignee are on every item and absent from the SearchSchema, so a search cannot mention them. Filtering on assignee is refused with 'must not contain any attributes that is not in SearchSchema', and severity > 2 is refused for a second reason: equality is the only comparator a search condition accepts.
The HASH partitions data, it does not secure itsecurity
AWS fine-grained access control does not apply to SearchVectors. Any principal holding dynamodb:SearchVectors on this index can search any tenant by changing one string in the request. Genuine isolation needs separate tables or indexes with separate IAM grants.
A missing HASH attribute is invisibleoperations
An item written without tenantId lands in the base table successfully and is silently left out of the index. No error, no warning, and it never appears in any search. A missing INLINE_FILTER attribute is fine and the item is still indexed.
These rows are real and already here. Running an operation against them downloads a DynamoDB-compatible engine, about 850 KB, and executes it in this tab.
Incidents like this one, in this tenant, still open, on this service.
Run an operation to see the raw engine response.
Transactions, streams, tags and TTL are among the operations the in-browser engine doesn't implement yet.