Connectivity patterns for multi-cloud
In complex multi-cloud scenarios, your RISE with SAP environment might need to connect with on-premises systems, Amazon-hosted workloads, SaaS solutions, and other cloud service providers.
Managing connectivity directly from Amazon removes dependencies on on-premises networking infrastructure, improving the availability and resiliency of your overall landscape.
You can connect multi-cloud environments to RISE using either public or private connectivity.
Public connectivity
Connectivity is routed over the internet. This pattern is typically used for connectivity from RISE with SAP to SaaS solutions that runs across multiple clouds. When building connectivity routed over the internet, consider the following:
-
ensure that all communication is encrypted
-
protect end-points by using Amazon services, such as Elastic Load Balancers and Amazon Shield
-
monitor endpoints using Amazon CloudWatch
-
ensure that traffic between two public IP addresses hosted on Amazon is routed over the Amazon network
Private connectivity
The following options are available to establish private connectivity between cloud service providers:
-
Site-to-site VPN encrypted tunnel routed over public internet
-
Private interconnect using Amazon Direct Connect in a managed infrastructure (use Azure ExpressRoute for Azure and Google Dedicated Interconnect for Google Cloud Platform)
-
Private interconnect using an Amazon Direct Connect in a facility with a multi-cloud connectivity provider
-
Using Amazon Interconnect Service to connect privately to other Cloud Providers (currently only Google Cloud)
With Amazon Interconnect, you can establish direct private connectivity between Amazon and other clouds (currently Google Cloud). You don’t need physical routers or on-premises routing, and Amazon Interconnect includes built-in Media Access Control Security (MACsec) encryption.
For more information about supported regions, see Region availability.
Example use case 1: RISE on Amazon to GCP BigQuery
If you run SAP S/4HANA on RISE with Amazon and use Google Cloud BigQuery for analytics and machine learning, you can benefit from real-time data replication over a private, high-speed connection. This connection continuously streams data from the SAP application layer to the Google Cloud data warehouse without exposing it to the public internet.
After you establish Amazon Interconnect and deliver traffic from Amazon RISE into GCP, complete the remaining connectivity configuration on the Google Cloud side. This ensures that data stays within the Google Cloud network.
Example use case 2: RISE on GCP to Amazon services
If you run SAP S/4HANA on RISE on Google Cloud, you can use the Amazon SDK for SAP ABAP to natively consume Amazon services, such as Amazon Bedrock, Amazon Textract, and Amazon S3, directly from your ABAP application layer. With this integration, you can extend your core business processes with intelligent cloud services that drive automation, document processing, and scalable data management.
Amazon Interconnect connects the Google Cloud RISE environment to an Amazon VPC. VPC endpoints (Amazon PrivateLink) expose the required Amazon services. All traffic between the SAP system on Google Cloud and Amazon remains on private network infrastructure and does not traverse the public internet. This delivers low-latency, secure cross-cloud service consumption.
Complete the necessary routing configuration on the Google Cloud side to direct traffic from the RISE environment toward Amazon Interconnect.
For more information, see Custom VPC Endpoints in the Amazon SDK for SAP ABAP.
Amazon Interconnect is a fully managed service that provides private, high-speed connectivity between Amazon and other cloud providers. Unlike Site-to-Site VPN or self-managed Amazon Direct Connect, it requires no colocation facilities, physical routers, cross-connects, or BGP peering configuration.
Amazon Interconnect provides the following benefits:
-
Media Access Control Security (MACsec) Layer 2 encryption by default.
-
Low latency and dedicated bandwidth.
-
Built-in redundancy through pre-provisioned capacity pools between cloud provider points of presence (PoPs).
-
Reduced operational complexity.
-
Performance and reliability that exceed internet-based VPN connections or self-managed Amazon Direct Connect implementations.
The following table compares Amazon Interconnect with traditional connectivity approaches.
| Criteria | Amazon Interconnect | Traditional (VPN / Self-managed Direct Connect) |
|---|---|---|
|
Setup |
Fully managed, turnkey. No physical routers, cross-connects, or BGP peering to configure. |
Requires ordering cross-connects, configuring routers, managing BGP sessions, and often contracting with colocation facilities. |
|
Encryption |
MACsec (Layer 2) enabled by default, no manual tunnel or encryption setup needed. |
VPN requires IPSec tunnel configuration; Direct Connect requires optional MACsec setup by the customer. |
|
Infrastructure |
Amazon and the partner cloud pre-build large pools of capacity between PoPs, eliminating the need to maintain physical connections. |
Customer must provision and maintain dedicated physical links or rely on colocation providers. |
|
Performance |
Private, dedicated bandwidth with consistent low latency (no internet routing variability). |
VPN traverses the public internet (variable latency). Self-managed Direct Connect offers similar performance but with operational overhead. |
|
Colocation requirement |
None required. Connections are established directly between cloud providers. |
Typically requires presence in a colocation facility where both providers have a PoP. |
|
Complexity |
Minimal. A simplified provisioning process handles routing and physical connectivity. |
Significant. Teams must manage equipment, contracts, and networking configurations across providers. |
|
Resilience |
Built-in redundancy across pre-provisioned capacity pools. |
Customer is responsible for designing redundancy (multiple connections, failover). |
For more information, see What is Amazon Interconnect.
The following diagram describes the factors to choose a multi-cloud connectivity method.
For more information, see Designing private network connectivity between Amazon and Microsoft Azure