# Tenant provision states

Use with [Automate SaaS tenant provisioning on AWS](/blog/automate-saas-tenant-provisioning-aws/). Checked 19 October 2026. The isolation model is already chosen. This sheet is the pool path: one shared database, one item per tenant.

| State | Write | Compensate on failure |
| --- | --- | --- |
| RECEIVED | Conditional put, `attribute_not_exists(tenantId)` | Stop. A second event for the same id is a no-op when status is READY |
| SECRET_CREATED | Secrets Manager secret named with the tenant id | Delete that secret only if this execution created it |
| CONFIG_READY | Tenant item updated with secret ARN | Do not delete the item if a previous execution already set READY |
| HEALTHY | Status `READY` after the health check | Mark `FAILED`. Do not drop a shared schema |

## Stop

- Creating an AWS account per tenant on this sheet.
- Setting `READY` before the health check.