# Security
<a name="hana-ops-security"></a>

Here are additional Amazon security resources to help you achieve the level of security you require for your SAP HANA environment on Amazon.
+  [Amazon Cloud Security Center](https://www.amazonaws.cn/security/) 
+  [CIS Amazon Foundations Benchmark](https://docs.amazonaws.cn/securityhub/latest/userguide/cis-aws-foundations-benchmark.html) 
+  [Introduction to Amazon Security](https://docs.amazonaws.cn/whitepapers/latest/introduction-aws-security/welcome.html) 
+  [Amazon Well-Architected Framework – Security Pillar](https://docs.amazonaws.cn/wellarchitected/latest/security-pillar/welcome.html) 

## OS Hardening
<a name="hana-ops-os-hardening"></a>

You may want to lock down the OS configuration further, for example, to avoid providing a DB administrator with root credentials when logging into an instance.

You can also refer to the following SAP notes:
+  [1730999](https://me.sap.com/notes/1730999): *Configuration changes in HANA appliance* 
+  [1731000](https://me.sap.com/notes/1731000): *Unrecommended configuration changes* 

## Disabling HANA Services
<a name="hana-ops-disabling-services"></a>

HANA services such as HANA XS are optional and should be deactivated if they are not needed. For instructions, see [SAP Note 1697613](https://me.sap.com/notes/1697613): *Remove XS Engine out of SAP HANA database*. In case of service deactivation, you should also remove the TCP ports from the SAP HANA Amazon security groups for complete security.

## API Call Logging
<a name="hana-ops-api-logging"></a>

 [Amazon CloudTrail](https://www.amazonaws.cn/cloudtrail/) is a web service that records Amazon API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the Amazon service.

With CloudTrail, you can get a history of Amazon API calls for your account, including API calls made via the Amazon Management Console, Amazon SDKs, command line tools, and higher-level Amazon services (such as Amazon CloudFormation). The Amazon API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing.

## Notifications on Access
<a name="hana-ops-notifications"></a>

You can use [Amazon Simple Notification Service (Amazon SNS)](https://www.amazonaws.cn/sns/) or third-party applications to set up notifications on SSH login to your email address or mobile phone.