What is necessary for configuring higher database isolation between tenant databases in a Multiple Database Container system?

To configure higher database isolation between tenant databases in a Multiple Database Container (MDC) system, adding dedicated tenant OS users to the sapsys group is essential. This approach ensures that each tenant database operates under its own unique operating system user account, promoting strong security practices and isolating access to the database layers.

Using dedicated OS users for each tenant means that each database can have specific access controls and permissions, preventing unintended data access or actions across different tenant databases. This level of separation is crucial in environments where multiple tenants share the same infrastructure, minimizing the risk of data leakage and ensuring that each tenant's operations are independently managed.

In contrast, assigning the same OS user for all tenants would compromise isolation, as this setup would allow shared access, allowing one tenant potentially to access or interfere with another tenant's data and operations. Adding shared OS users would result in a similar complication, diluting the security and operational boundaries necessary for effective multi-tenancy. Creating a single dedicated OS user for the system does not provide the required isolation among tenants, as it centralizes access rather than segmenting it.

Therefore, employing dedicated OS users for each tenant is fundamental in achieving the desired level of database isolation in a Multiple Database Container system.