No per-tenant infrastructure — one wildcard cert, one Lambda, one table.
requests either the root domain or a tenant subdomain over HTTPS.
One ALIAS record for the exact root domain, one wildcard ALIAS record for every subdomain — both point at the same API Gateway custom domain endpoint.
A single wildcard certificate covers both the root domain and every subdomain, terminated at API Gateway.
One HTTP API with a single catch-all route to one Lambda. The default execute-api endpoint is disabled, so only the two custom domains above can reach it.
Reads the Host header on every request. Root domain → landing page / signup. Anything else → strip the root domain suffix to get the tenant slug.
Single table, partition key TENANT#<slug>. Every read and write is scoped to that exact key — there's no query that could ever span two tenants, so isolation comes from the data model itself, not from an authorization check.