# Prerequisites
<a name="ase-backint-preprequisites"></a>

**Note**  
End of support notice: On October 29, 2026, Amazon will end support for new customers for Amazon Backint Agent for SAP ASE. After September 29, 2027, support for Amazon Backint Agent for SAP ASE will completely end and you will no longer be able to access any Amazon Backint Agent for SAP ASE resources. For more information, see [Amazon Backint Agent for SAP ASE end of support](ase-backint-end-of-support.md).

This section provides information on mandatory prerequisites for Amazon Backint Agent for SAP ASE.

**Topics**
+ [Amazon Identity and Access Management (IAM)](#ase-backint-iam)
+ [Amazon S3 Bucket](#ase-backint-s3-bucket)

## Amazon Identity and Access Management (IAM)
<a name="ase-backint-iam"></a>

To enable S3 bucket access for your Amazon EC2 instance, create or update an inline IAM policy with the following permissions and attach it to your EC2 service role. Replace the resource names, such as the S3 bucket name, to match your setup. You must provide the Amazon Region and Amazon S3 bucket owner account ID along with the Amazon S3 bucket name and KMS Key for Encryption.

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy"
            ],
            "Resource": [
                "arn:aws:s3:::your-bucket-name/*",
                "arn:aws:s3:::your-bucket-name"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id"
        },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:PutObjectTagging",
                  "s3:PutObject",
                  "s3:GetObject",
                  "s3:DeleteObject"
              ],
              "Resource": "arn:aws:s3:::your-bucket-name/your-folder-name/*"
          }
    ]
}
```

**Note**  
If you want to allow cross-account backup and restore, you must add your account details under a principal element in your policy. For more information about principal policies, see [Amazon JSON Policy Elements: Principal](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_policies_elements_principal.html) in the * Amazon Identity and Access Management User Guide*. In addition, you must ensure that the S3 bucket policies allow your account to perform the actions specified in the IAM policy example above. For more information, see the example for [Bucket owner granting cross-account bucket permissions](https://docs.amazonaws.cn/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html) in the *Amazon S3 Developer Guide*.

For more information about managed and inline policies, see the [IAM User Guide](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies_managed-vs-inline.html).

**Note**  
 Amazon Backint Agent for SAP ASE validates credentials by calling Amazon Security Token Service (Amazon STS) during initialization. If your SAP ASE instance runs in a private subnet without internet access, make sure that your instance can reach the Amazon STS endpoint. Use an interface virtual private cloud (VPC) endpoint (service name: `com.amazonaws.<region>.sts`) or a network address translation (NAT) gateway. For more information, see [Using Amazon STS interface VPC endpoints](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_credentials_sts_vpce.html).

## Amazon S3 Bucket
<a name="ase-backint-s3-bucket"></a>

In preparation for installation of the Amazon Backint agent, identify or create an S3 bucket in the target Region where SAP ASE backups will be stored. The bucket must have been created after May 2019 in order to be compatible with Amazon Backint agent and must have public access blocked, as backups will fail if public access is enabled.

 Amazon Backint agent supports backing up to Amazon S3 with VPC endpoints. Using an Amazon S3 gateway endpoint can improve performance, help prevent timeouts, enhance security, and reduce costs. For more information, see [VPC Endpoints](https://docs.amazonaws.cn/vpc/latest/userguide/vpc-endpoints.html).

### S3 storage classes
<a name="ase-backint-s3-storage-classes"></a>

 Amazon Backint agent supports storing SAP ASE database backups in S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Intelligent-Tiering storage classes. By default, backups use the S3 Standard storage class, but this can be changed through the Amazon Backint agent configuration file, [S3 Lifecycle rules](https://docs.amazonaws.cn/AmazonS3/latest/dev/object-lifecycle-mgmt.html), or directly via APIs.

 Amazon Backint Agent for SAP ASE does not support the following storage classes: . Reduced Redundancy . Deep Archive . Glacier

While S3 Intelligent-Tiering can automatically move objects to archival tiers, Amazon Backint agent requires objects to be in standard access tiers for recovery or deletion operations. For more information, see [Amazon S3 Storage Classes](https://docs.amazonaws.cn/AmazonS3/latest/dev/storage-class-intro.html) in the *Amazon S3 Developer Guide*.

### Encryption
<a name="ase-backint-encryption"></a>

 Amazon Backint agent supports encrypting your SAP ASE backup files while storing them in Amazon S3, using server-side encryption with Amazon Key Management Service (KMS). You can encrypt your backups with an Amazon managed key (aws/s3) or you can use your own customer managed key stored in Amazon KMS. To encrypt your backup files with Amazon KMS keys (Amazon managed or customer managed), you must provide the KMS key ARN during installation or update the Amazon Backint agent configuration file later. To learn more about encrypting your S3 objects using Amazon KMS, see [How Amazon S3 uses Amazon KMS](https://docs.amazonaws.cn/kms/latest/developerguide/services-s3.html) in the * Amazon Key Management Service Developer Guide*. Alternatively, you can enable default encryption for your Amazon S3 bucket using either Amazon KMS keys or keys managed by Amazon S3 (SSE-S3). To learn more about enabling default encryption for your bucket, see [How do I enable default encryption for an Amazon S3 bucket?](https://docs.amazonaws.cn/AmazonS3/latest/user-guide/default-bucket-encryption.html) in the *Amazon S3 Console User Guide*.

### Object locking
<a name="ase-backint-object-locking"></a>

You can store objects using a *write-once-read-many* (WORM) model with S3 Object Lock. Use S3 Object Lock if you want to prevent your SAP ASE backup files from being accidentally deleted or overwritten for a specific time period or indefinitely. If S3 Object Lock is enabled, you can’t delete your SAP ASE backups stored in Amazon S3 using SAP ASE Cockpit, SAP ASE Studio, or SQL commands until the retention period expires. To learn about S3 Object Lock, see [Locking objects using S3 Object Lock](https://docs.amazonaws.cn/AmazonS3/latest/dev/object-lock.html) in the *Amazon S3 Developer Guide*.

### Object tagging
<a name="ase-backint-object-tagging"></a>

By default, Amazon Backint agent adds a tag called ` AmazonBackintAgentVersion` when it stores your SAP ASE backup files in your S3 bucket. This tag helps to identify the Amazon Backint version and the SAP ASE version used when backing up your SAP ASE database. You can [list the value of the tags from S3 console](https://docs.amazonaws.cn/AmazonS3/latest/user-guide/view-object-properties.html) or [using APIs](https://docs.amazonaws.cn/AmazonS3/latest/dev/object-tagging.html). To disable default tagging, modify the Amazon Backint agent configuration file. See [Additional Parameters](ase-backint-install.md#ase-backint-additional-parameters) for more information.

### Data perimeter
<a name="data-perimeter"></a>

 Amazon Backint Agent must be installed on your Amazon EC2 instance. To download the installation binary, your EC2 instance needs access to the Amazon-managed S3 buckets where the installer packages are hosted. If your organization uses data perimeter policies to control access to Amazon S3 in your environment, you might need to explicitly allow these service-owned buckets so that the EC2 instance can retrieve the required installer. The following policy shows an example Service control policy to permit access to service-owned resources through the resource perimeter, relevant service owned buckets are listed in the NotResource element of the policy.

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "EnforceResourcePerimeterAWSResources",
      "Effect": "Deny",
      "Action": "*",
      "NotResource": [
        "arn:aws:s3:::awssap-backint-agent-ase",
        "arn:aws:s3:::awssap-backint-agent-ase/*"
      ],
      "Condition": {
        "StringNotEqualsIfExists": {
          "aws:ResourceOrgID": "<organization id>",
          "aws:PrincipalTag/dp:exclude:resource": "true"
        }
      }
    }
  ]
}
```

The following policy shows an example VPC endpoint policy allowing access to specific service-owned resources through a VPC endpoint. Relevant service owned buckets are listed in the Resource element of the statement.

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "AllowRequestsToAWSOwnedResources",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::awssap-backint-agent-ase",
                "arn:aws:s3:::awssap-backint-agent-ase/*"
            ]
        }
    ]
}
```

### Amazon Command Line Interface (CLI)
<a name="ase-backint-aws-cli"></a>

 Amazon Backint agent installation leverages the Amazon CLI to validate S3 bucket properties. To install or update to the Amazon CLI, see [Install or update to the latest version of the Amazon CLI](https://docs.amazonaws.cn/cli/latest/userguide/getting-started-install.html).