Multi-tenant file storage needs the same isolation guarantees as the database. Choose whether tenants share a container, receive separate containers, or receive separate storage accounts, then enforce authorization before issuing any file operation.
Last updated: September 26, 2026.
function objectKey(int $tenantId, string $fileId, string $extension): string
{
if (!preg_match('/^[a-f0-9-]{36}$/', $fileId)) {
throw new InvalidArgumentException('Invalid file ID');
}
return "tenants/{$tenantId}/files/{$fileId}.{$extension}";
}
$key = objectKey($sessionTenantId, $fileId, 'pdf');The key uses trusted tenant context and an opaque server-generated file ID. Do not use an untrusted filename as an object path or authorization decision.
Choose an isolation model
A shared container with tenant prefixes is inexpensive and operationally simple, but the application enforces separation. A container per tenant improves policy and usage visibility. An account per tenant provides stronger isolation at greater provisioning and operational cost. Align the choice with the database tenancy model without assuming they must be identical.
Microsoft’s multitenant storage guidance compares these approaches and recommends narrowly scoped access tokens.
Issue limited access
Authenticate the request, verify resource ownership, then issue a short-lived upload or download URL limited to one key and operation. Generate the final key on the server. After upload, verify size, content type, malware policy, and expected checksum before marking the database record active.
Coordinate metadata and lifecycle
- Store object key, tenant ID, owner, size, media type, checksum, and status in the database.
- Use versioning or immutable names to avoid stale caches.
- Apply quotas and lifecycle policies with tenant-level metrics.
- Delete derivatives, search entries, and cached URLs with the source file.
- Keep audit events separate from sensitive file contents.
A soft-deleted database record does not erase the object. Define retention and permanent purge explicitly, and keep tenant context in every cleanup job.
