AWS Overview

AWS offers a broad set of global, cloud-based services, including compute, storage, networking, Internet of Things (IoT), and many others. These services help organizations move faster, lower IT costs, and support scalability. AWS is trusted by the largest enterprises and popular start-ups to power a wide variety of workloads, such as web and mobile applications, game development, data processing and warehousing, storage, and archiving.

AWS Services

AWS provides over 200 cloud services that you can use in combinations tailored to your business or organizational needs. For information about all AWS services, see the Amazon Web Services Cloud Platform documentation.

This section introduces the AWS services that are most relevant for the deployment and operation of SAP solutions. The following list provides a high-level description of each service and its use for SAP systems. To view features, pricing, and documentation for an individual service, follow the detailslink after the description.

Area	Service	Description	SAP uses
Compute	Amazon Elastic Compute Cloud (Amazon EC2)	Secure, resizable compute capacity in the cloud. (details)	Virtual and bare metal servers for the installation and operation of SAP systems.
Storage	Amazon Elastic Block Store (Amazon EBS)	Persistent block storage volumes for use with EC2 instances. (details)	File systems for SAP software (e.g., /usr/sap), SAP database log and data files, and SAP local backups.
	Amazon Simple Storage Service (Amazon S3)	Object storage service that offers an extremely durable, highly available, and infinitely scalable data storage infrastructure. (details)	Highly durable storage for file backups, database backups, archiving data, data lakes, and more.
	Amazon Elastic File System (Amazon EFS)	Simple, scalable, elastic file system for Linux-based workloads for use with AWS Cloud services and on-premises resources. (details)	Shared file system for SAP application servers (e.g., /sapmnt).
	Amazon FSx for Windows File Server	Fully managed, highly durable, and available native Microsoft Windows file system. (details)	Shared file system for SAP application servers (e.g., /sapmnt).
	Amazon FSx for NetApp ONTAP	Fully managed, highly reliable, scalable, high-performing file storage built on NetApp ONTAP file system(details)	Shared file system for SAP application servers (e.g., /sapmnt).
Networking	Amazon Virtual Private Cloud (Amazon VPC)	Logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. (details)	Network for SAP resources. You can control the level of isolation of your EC2 instance from other networks, instances, and on-premises network resources, such as those in production and non-production environments.
	AWS Site-to-Site VPN	Enables you to securely connect your on-premises network or branch office site to your VPC. (details)	Network connectivity between on-premises systems/users and SAP systems on AWS.
	AWS Direct Connect	Lets you establish private network connectivity between AWS and your data center, office, or co-location environment. (details)	Private network connectivity between on-premises systems/users and the SAP system or environment on AWS.
	Amazon Route 53	Highly available and scalable cloud Domain Name System (DNS) web service. (details)	Name and address resolution for SAP systems running on AWS.
	Amazon Time Sync	Highly accurate and reliable time reference that is natively accessible from EC2 instances. (Linux | Windows)	Time synchronization for your SAP systems on EC2 instances.
Management and operation tools	AWS Management Console	Simple web interface to provision and manage AWS resources. (details)	Provisioning and management of AWS resources for your SAP environment on AWS.
	AWS Command Line Interface (AWS CLI)	Command-line tool set to provision and manage AWS resources. (details)	Creation of scripts to automate the provisioning and management of AWS resources for your SAP environment on AWS.
	AWS CloudFormation	An easy way to create a collection of related AWS resources and provision them in an orderly and predictable fashion. (details)	Automated provisioning of AWS resources for new SAP landscapes, disaster recovery environments, and other use cases.
	Amazon CloudWatch	Monitoring for AWS Cloud resources and the applications you run on AWS: collect and track metrics, collect and monitor log files, and set alarms. (details)	Monitoring SAP systems running on AWS using Amazon CloudWatch Application Insights.
	AWS CloudTrail	Records activity made on your account and delivers log files to your S3 bucket. (details)	Audit capabilities within your AWS account, such as use of the Amazon EC2 API.
	AWS Launch Wizard for SAP	AWS Launch Wizard for SAP is a service that guides you through the sizing, configuration, and deployment of SAP applications on AWS. (details)	Setup and configuration of resources required for your SAP deployment.
	AWS Backint Agent for SAP HANA	SAP certified solution to backup and restore SAP HANA database to and from Amazon S3. (details)	Backup solution to store SAP HANA database backups to Amazon S3.
Security, identity, and compliance	AWS Identity and Access Management (IAM)	Manages access to AWS services and resources securely. Using IAM, you can create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources. (details)	Fine-grained access control using a least privileged security model to access specific AWS services and actions; e.g., to allow SAP BASIS resources to launch, to stop and start EC2 instances without terminating them.

AWS Global Infrastructure

The AWS Cloud infrastructure is built around Regions and Availability Zones. An AWS Region is a physical location that provides multiple, physically separated and isolated Availability Zones. Each Availability Zone consists of one or more data centers that are connected with low-latency, high-throughput, and highly redundant networking. These Availability Zones offer an easier and more effective way to design and operate your applications and databases, making them more highly available, fault tolerant, and scalable than traditional single or multiple data center infrastructures.

For a list of the available AWS Regions and to learn more about the AWS global infrastructure, see Global Infrastructure on the AWS website.

AWS Security and Compliance

Security

At AWS, security is our top priority. As an AWS customer, you will benefit from a data center and network architecture built to meet the requirements of the most security-sensitive organizations. Security in the cloud is much like security in your on-premises data centers—only without the costs of maintaining facilities and hardware. In the cloud, you don’t have to manage physical servers or storage devices. Instead, you use software-based security tools to monitor and protect the flow of information into and out of your cloud resources.

As an AWS customer you inherit all the best practices of AWS policies, architecture, and operational processes built to satisfy the requirements of our most security-sensitive customers, and get the flexibility and agility you need in security controls.

The AWS Cloud enables a shared responsibility model. While AWS manages security of the cloud, you are responsible for security in the cloud. This means that you retain control of the security you choose to implement to protect your own data, platform, applications, systems, and networks no differently than you would in an on-site data center.

To learn more about AWS security, see AWS Cloud Security on the AWS website.

Compliance

AWS provides robust controls to help maintain security and data protection in the cloud. As systems are built on top of AWS Cloud infrastructure, compliance responsibilities will be shared. By tying together governance-focused, audit-friendly service features with applicable compliance or audit standards, AWS compliance enablers build on traditional programs and help you operate in an AWS security control environment.

The IT infrastructure that AWS provides to its customers is designed and managed in alignment with best security practices and a variety of IT security standards. The following is a partial list of assurance programs with which AWS complies:

• SOC 1/ISAE 3402, SOC 2, SOC 3

• FISMA, FIPS, DIACAP, and FedRAMP

• PCI DSS Level 1

• ISO 9001, ISO 27001, ISO 27017, ISO 27701, ISO 27018

For more information, see AWS Compliance Programs.

AWS Provisioning and Management

The provisioning and management of AWS services and resources use a self-service model managed by the customer or a partner. For an overview of the tools available for provisioning and management, see the management tools in the AWS Services section.

Figure 1 shows the services managed by AWS and the services managed by the customer or partner for SAP.

Figure 1: Managed services for SAP on AWS