Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

SAP on Amazon Planning

If you are an experienced SAP Basis or SAP NetWeaver administrator, there are a number of Amazon-specific considerations relating to compute configurations, storage, security, management, and monitoring that will help you get the most out of your SAP environment on Amazon. This section provides guidelines for achieving optimal performance, availability, and reliability, and lower total cost of ownership (TCO) while running SAP solutions on Amazon.

SAP Notes

Before migrating or implementing an SAP environment on Amazon, you should read and follow the relevant SAP notes. Start from SAP Note 1656099 for general information and follow the links to other relevant SAP notes (SAP One Support Launchpad access required).

SAP on Amazon Architectures

This section describes the two primary architectural patterns for SAP on Amazon: all systems on Amazon and hybrid.

All-on-Amazon Architecture

With the SAP All-on-Amazon architecture, all systems and components of your SAP environment are hosted on Amazon. Example scenarios of such an architecture include:

Figure 3 depicts an SAP all-on-Amazon architecture. The SAP environment running on Amazon is integrated with on-premises systems and users via a VPN connection or a dedicated network connection via Amazon Direct Connect. SAProuter is deployed in a public subnet and assigned a public IP address that is reachable from the internet to enable integration with the SAP OSS network via a secure network communications (SNC) connection. A network address translation (NAT) gateway enables instances in the private subnet to connect to the internet or other Amazon services, but prevents instances from receiving inbound traffic that is initiated by someone on the internet. For additional information, see the Configuring Network and Connectivity section.

Figure 3: SAP all-on-Amazon architecture

Hybrid Amazon Architecture

With an SAP hybrid Amazon architecture, some SAP systems and components are hosted on your on-premises infrastructure and others are hosted on the Amazon infrastructure. Example scenarios of such an architecture include:

Figure 4 depicts an SAP hybrid Amazon architecture with SAP DEV and QAS landscapes and SAP test, training, and PoC systems running on Amazon. These systems are integrated with SAP systems and users on the corporate network. Connectivity between the VPC and the corporate network is provided with either a VPN connection or an Amazon Direct Connect connection. The existing SAProuter and SAP Solution Manager running on the corporate network are used to manage the SAP systems running within the VPC.

Figure 4: SAP hybrid Amazon architecture

Choosing an Amazon Region and Availability Zone

See the Amazon Global Infrastructure section of this guide for information about Amazon Regions and Availability Zones.

Choosing a Region

When choosing the Amazon Region to deploy your SAP environment in, consider the following factors:

Choosing an Availability Zone

No special considerations are required when choosing an Availability Zone for your SAP deployment on Amazon. All SAP applications (SAP ERP, CRM, SRM, and so on) and systems (SAP database system, SAP Central Services system, and SAP application servers) should be deployed in the same Availability Zone. If high availability (HA) is a requirement, use multiple Availability Zones. For more information, see Architecture guidance for availability and reliability of SAP on Amazon.

Network and Connectivity

Amazon VPC

Amazon VPC enables you to define a virtual network in your own, logically isolated area within the Amazon Cloud. You can launch your Amazon resources, such as instances, into your VPC. Your VPC closely resembles a traditional network that you might operate in your own data center, with the benefits of using the Amazon scalable infrastructure. You can configure your VPC; you can select its IP address range, create subnets, and configure route tables, network gateways, and security settings. You can connect instances in your VPC to the internet. You can connect your VPC to your own corporate data center, and make the Amazon Cloud an extension of your data center. To protect the resources in each subnet, you can use multiple layers of security, including security groups and network access control lists. For more information, see the Amazon VPC User Guide.

For detailed instructions for setting up and configuring a VPC, and connectivity between your network and VPC, see the Amazon VPC documentation.

Network Connectivity Options

Multiple options are available to provide network connectivity between your on-premises users and systems with your SAP systems running on Amazon, including a direct internet connection, hardware VPN, and private network connection.

Private Network Connection

Amazon Direct Connect makes it easy to establish a dedicated network connection from your premises to Amazon. Using Amazon Direct Connect, you can establish private connectivity between Amazon and your data center, office, or co-location environment. In many cases, this can reduce your network costs, increase bandwidth throughput, and provide a more consistent network experience than internet-based connections. For additional information, see the Amazon Direct Connect User Guide.

Use cases: Recommended for customers who require greater bandwidth and lower latency than possible with a hardware VPN.

For more information, see Amazon Virtual Private Cloud Cloud Connectivity Options.

Direct Internet Connection

The quickest and simplest way to connect to your SAP systems running on Amazon involves using a VPC with a single public subnet and an internet gateway to enable communication over the internet. For additional information, see Scenario 1: VPC with a Public Subnet Only in the Amazon VPC User Guide.

Use cases: Most suitable for SAP demo, training, and test type systems that do not contain sensitive data.

Site-to-Site / Hardware VPN

Amazon Site-to-Site VPN extends your data center or branch office to the cloud via Internet Protocol security (IPsec) tunnels, and supports connecting to both virtual private gateways and Amazon Transit Gateway. You can optionally run Border Gateway Protocol (BGP) over the IPsec tunnel for a highly available solution. For additional information, see Adding a Hardware Virtual Private Gateway to your VPC in the Amazon VPC User Guide.

Use cases: Recommended for any SAP environments on Amazon that require integration with on-premises users and systems.

Client VPN

Amazon Client VPN provides a fully-managed VPN solution that can be accessed from anywhere with an internet connection and an OpenVPN-compatible client. It is elastic, automatically scales to meet your demand, and enables your users to connect to both Amazon and on-premises networks. Amazon Client VPN seamlessly integrates with your existing Amazon infrastructure, including Amazon VPC and Amazon Directory Service, so you don’t have to change your network topology.

Use cases: Provides quick and easy connectivity to your remote workforce and business partners.

Following Security Best Practices

In order to provide end-to-end security and end-to-end privacy, Amazon builds services in accordance with security best practices, provides appropriate security features in those services, and documents how to use those features. In addition, Amazon customers must use those features and best practices to architect an appropriately secure application environment. Enabling customers to ensure the confidentiality, integrity, and availability of their data is of the utmost importance to Amazon, as is maintaining trust and confidence.

Shared Responsibility Environment

There is a shared responsibility model between you as the customer and Amazon. Amazon operates, manages, and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. In turn, you assume responsibility and management of the guest operating system (including updates and security patches), other associated application software, Amazon VPC setup and configuration, as well as the configuration of the Amazon-provided security group firewall. For additional information on Amazon security, visit the Amazon Cloud Security page and review the various Security Resources available there.

Amazon VPC

The foundation for security of an SAP environment on Amazon is the use of Amazon VPC for providing the overall isolation. Amazon VPC includes security details that you must set up to enable proper access and restrictions for your resources. Amazon VPC provides features that you can use to help increase and monitor the security for your VPC:

For detailed documentation about how to set up and manage security within a VPC, see the Security section of the Amazon VPC User Guide.

EC2 Instance Types for SAP

Amazon EC2 provides a wide selection of instance types optimized to fit different use cases. Instance types comprise varying combinations of CPU, memory, storage, and networking capacity and give you the flexibility to choose the appropriate mix of resources for your applications. Each instance type includes one or more instance sizes, allowing you to scale your resources to the requirements of your target workload.

SAP systems deployed on Amazon that will require support from SAP must be run on an EC2 instance type that has been certified with SAP. This section describes where you can find details about the EC2 instance types that have been certified with SAP and additional information for specific SAP solutions.

SAP NetWeaver-based Solutions

SAP solutions based on the SAP NetWeaver platform and that use SAP Application Performance Standard (SAPS) for sizing must be run on a specific subset of EC2 instance types in order to receive support from SAP Support. For details, see:

SAP HANA

The SAP HANA platform and SAP solutions that run on top of an SAP HANA database—for example, SAP Suite on HANA, SAP S/4HANA, SAP Business Warehouse (BW) on HANA, SAP BW/4HANA— require specific EC2 instance types that have been certified for SAP HANA. For more information, see Amazon EC2 instance types for SAP on Amazon.

SAP Business One, version for SAP HANA

For information about the EC2 instance types that are certified for SAP Business One, version for SAP HANA, see:

Operating Systems

Supported Operating Systems

EC2 instances run on 64-bit virtual processors based on the Intel x86 instruction set. The following 64-bit operating systems and versions are available and supported for SAP solutions on Amazon.

For additional information regarding SAP-supported operating systems on Amazon, see SAP Note 1656250.

SLES for SAP and RHEL for SAP

SUSE and Red Hat offer SAP-specific versions of their operating systems that provide the following benefits:

To learn more about SUSE’s and Red Hat’s operating system versions for SAP, see the following information on the SLES and Red Hat websites.

SLES for SAP

RHEL for SAP

Operating System Licenses

These operating system licensing options are available for SAP systems on Amazon:

The following table lists the licensing options available for each operating system and version. To learn more about each option, follow the link in the table.

Databases

Supported Databases

All the database platforms and versions supported by SAP for an on-premises infrastructure are also supported by SAP on Amazon. For details about the databases supported with specific SAP solutions on Amazon, see SAP Note 1656099.

Database Installation and Administration

Customer-Managed Database on Amazon EC2

The majority of SAP solutions use a customer-managed model on Amazon EC2. Installation, configuration, administration, and backup and recovery of the database are done by either the customer or a partner.

The following SAP solutions use a self-managed database model on Amazon EC2:

Amazon RDS

Amazon Relational Database Service (Amazon RDS) is a managed service that makes it easy to set up, operate, and scale a relational database in the cloud. It provides cost-efficient and resizable capacity, while managing time-consuming database administration tasks, freeing you up to focus on your applications and business. Amazon RDS is currently supported for the following SAP solutions:

Amazon Aurora

Amazon Aurora (Aurora) is a MySQL and PostgreSQL-compatible relational database built for the cloud. It combines the performance and availability of traditional enterprise databases with the simplicity and cost-effectiveness of open source databases. Aurora MySQL is currently supported for the following SAP solution:

Database Licenses

These database licensing options are available for SAP systems on Amazon:

The following table lists the licensing options available on Amazon for each database. For additional information, follow the links in the Licensing options column.

* SQL Server runtime licenses purchased from SAP require either Microsoft Software Assurance or Amazon EC2 Dedicated Hosts to bring these licenses to Amazon. For additional information, see:

SAP Installation Media

The majority of SAP solutions on Amazon use a bring-your-own-software model. There are two primary options for copying SAP installation media to Amazon: