AWS sap documentation change
Summary
Added angle brackets to AWS CLI command placeholders (e.g., instance IDs, CIDR blocks)
Security assessment
Standardization of placeholder syntax improves clarity but doesn't impact security configurations or address vulnerabilities.
Diff
diff --git a/sap/latest/sap-netweaver/rhel-netweaver-ha-settings.md b/sap/latest/sap-netweaver/rhel-netweaver-ha-settings.md index e3e403ac9..6b6af5f7a 100644 --- a//sap/latest/sap-netweaver/rhel-netweaver-ha-settings.md +++ b//sap/latest/sap-netweaver/rhel-netweaver-ha-settings.md @@ -52 +52 @@ AWS Region | `<region_id>` | `us-east-1` - * AWS account – For more details, see [Your AWS account ID and its alias](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html). + * AWS account – For more details, see {https---docs-aws-amazon-com-IAM-latest-UserGuide-console-account-alias-html}[Your AWS account ID and its alias]. @@ -54 +54 @@ AWS Region | `<region_id>` | `us-east-1` - * AWS Region – For more details, see [Describe your Regions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#using-regions-availability-zones-describe). + * AWS Region – For more details, see {https---docs-aws-amazon-com-AWSEC2-latest-UserGuide-using-regions-availability-zones-html-using-regions-availability-zones-describe}[Describe your Regions]. @@ -69 +69 @@ Configured subnet | `<subnet_id>` | `subnet-xxxxxxxxxxsubnet1` | `subnet-xxxxxxx - * Hostname – Hostnames must comply with SAP requirements outlined in [SAP Note 611361 - Hostnames of SAP ABAP Platform servers](https://launchpad.support.sap.com/#/notes/611361) (requires SAP portal access). + * Hostname – Hostnames must comply with SAP requirements outlined in {https---launchpad-support-sap-com---notes-611361}[SAP Note 611361 - Hostnames of SAP ABAP Platform servers] (requires SAP portal access). @@ -101 +101 @@ Sapmnt NFS ID or CNAME | `<sapmnt_nfs_id>` | `fs-xxxxxxxxxxxxxefs1` - * SAP details – SAP parameters, including SID and instance number must follow the guidance and limitations of SAP and Software Provisioning Manager. Refer to [SAP Note 1979280 - Reserved SAP System Identifiers (SAPSID) with Software Provisioning Manager](https://launchpad.support.sap.com/#/notes/1979280) for more details. + * SAP details – SAP parameters, including SID and instance number must follow the guidance and limitations of SAP and Software Provisioning Manager. Refer to {https---launchpad-support-sap-com---notes-1979280}[SAP Note 1979280 - Reserved SAP System Identifiers (SAPSID) with Software Provisioning Manager] for more details. @@ -107 +107 @@ Post-installation, use the following command to find the details of the instance - * Overlay IP – This value is defined by you. For more information, see [Overlay IP](https://docs.aws.amazon.com/sap/latest/sap-netweaver/rhel-netweaver-ha-planning.html#overlay-ip). + * Overlay IP – This value is defined by you. For more information, see {https---docs-aws-amazon-com-sap-latest-sap-netweaver-rhel-netweaver-ha-planning-html-overlay-ip}[Overlay IP]. @@ -150 +150 @@ Create these policies with least-privilege permissions, granting access to only -For more information, see [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#ec2-instance-profile). +For more information, see {https---docs-aws-amazon-com-AWSEC2-latest-UserGuide-iam-roles-for-amazon-ec2-html-ec2-instance-profile}[IAM roles for Amazon EC2]. @@ -241 +239 @@ AWS CLI -Use the [modify-instance-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html) command to disable source/destination check. + * Use the [modify-instance-attribute](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/modify-instance-attribute.html) command to disable source/destination check. @@ -247 +245 @@ Run the following commands on both instances in the cluster. - aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost1 --no-source-dest-check + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost1> --no-source-dest-check @@ -251 +249 @@ Run the following commands on both instances in the cluster. - aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost2 --no-source-dest-check + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost2> --no-source-dest-check @@ -259 +257,4 @@ AWS Management Console -Ensure that the **Stop** option is checked in [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + * Ensure that the **Stop** option is checked in [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + + + @@ -274 +275 @@ Modifying instance maintenance options will require admin privileges not covered - aws ec2 modify-instance-maintenance-options --instance-id i-xxxxinstidforhost1 --auto-recovery disabled + aws ec2 modify-instance-maintenance-options --instance-id <i-xxxxinstidforhost1> --auto-recovery disabled @@ -277 +278 @@ Modifying instance maintenance options will require admin privileges not covered - aws ec2 modify-instance-maintenance-options --instance-id i-xxxxinstidforhost2 --auto-recovery disabled + aws ec2 modify-instance-maintenance-options --instance-id <i-xxxxinstidforhost2> --auto-recovery disabled @@ -286 +287 @@ Modifying instance attributes will require admin privileges not covered by the I - aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost1 --no-disable-api-stop + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost1> --no-disable-api-stop @@ -289 +290 @@ Modifying instance attributes will require admin privileges not covered by the I - aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost2 --no-disable-api-stop + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost2> --no-disable-api-stop @@ -347 +346 @@ See Red Hat documentation [What are all the Performance Co-Pilot (PCP) RPM packa -The preceding list of packages is not a complete list required for running SAP applications. For the complete list, see [SAP and Red Hat references](https://docs.aws.amazon.com/sap/latest/sap-netweaver/rhel-netweaver-ha-planning.html#references). +The preceding list of packages is not a complete list required for running SAP applications. For the complete list, see {https---docs-aws-amazon-com-sap-latest-sap-netweaver-rhel-netweaver-ha-planning-html-references}[SAP and Red Hat references]. @@ -399 +395 @@ This is applicable to both cluster nodes. Time synchronization is important for -You can use Amazon Time Sync Service that is available on any instance running in a VPC. It does not require internet access. To ensure consistency in the handling of leap seconds, don't mix Amazon Time Sync Service with any other `ntp` time sync servers or pools. +You can use Amazon Time Sync Service that is available on any instance running in a VPC. It does not require internet access. To ensure consistency in the handling of leap seconds, don’t mix Amazon Time Sync Service with any other `ntp` time sync servers or pools. @@ -404 +400 @@ Create or check the `/etc/chrony.d/ec2.conf` file to define the server. - # Amazon EC2 time source config + Amazon EC2 time source config @@ -421 +415 @@ This is applicable to both cluster nodes. The cluster resource agents use AWS Co -You can either edit the config file at `/root/.aws` manually or by using [`aws configure`](https://docs.aws.amazon.com/cli/latest/reference/configure/index.html) AWS CLI command. +You can either edit the config file at `/root/.aws` manually or by using [aws configure](https://docs.aws.amazon.com/cli/latest/reference/configure/index.html) AWS CLI command. @@ -426,3 +420,3 @@ You can skip providing the information for the access and secret access keys. Th - # aws configure - AWS Access Key ID [None]: - AWS Secret Access Key [None]: + aws configure + {aws} Access Key ID [None]: + {aws} Secret Access Key [None]: @@ -464 +456 @@ This section covers the following topics. -You need to add initial route table entries for overlay IPs. For more information on overlay IP, see [Overlay IP](https://docs.aws.amazon.com/sap/latest/sap-netweaver/rhel-netweaver-ha-planning.html#overlay-ip). +You need to add initial route table entries for overlay IPs. For more information on overlay IP, see {https---docs-aws-amazon-com-sap-latest-sap-netweaver-rhel-netweaver-ha-planning-html-overlay-ip}[Overlay IP]. @@ -497 +489 @@ You route table now has two entries, each for ASCS and ERS, in addition to the s -The preceding steps can also be performed programmatically. We suggest performing the steps using administrative privileges, instead of instance-based privileges to preserve least privilege. CreateRoute API isn't necessary for ongoing operations. +The preceding steps can also be performed programmatically. We suggest performing the steps using administrative privileges, instead of instance-based privileges to preserve least privilege. CreateRoute API isn’t necessary for ongoing operations. @@ -502 +494 @@ Run the following command as a dry run on both nodes to confirm that the instanc - aws ec2 replace-route --route-table-id rtb-xxxxxroutetable1 --destination-cidr-block 172.16.30.5/32 --instance-id i-xxxxinstidforhost1 --dry-run --profile <aws_cli_cluster_profile> + aws ec2 replace-route --route-table-id <rtb-xxxxxroutetable1> --destination-cidr-block <172.16.30.5/32> --instance-id <i-xxxxinstidforhost1> --dry-run --profile <aws_cli_cluster_profile> @@ -515 +507 @@ On EC2 instance 1, where you are installing ASCS, add the overlay IP allocated f - ip addr add 172.16.30.5/32 dev eth0 + ip addr add <172.16.30.5/32> dev eth0 @@ -520 +512 @@ On EC2 instance 2, where you are installing ERS, add the overlay IP allocated fo - ip addr add 172.16.30.6/32 dev eth0 + ip addr add <172.16.30.6/3> dev eth0 @@ -527,6 +519,5 @@ This is applicable to both cluster nodes. You must ensure that both instances ca - # cat /etc/hosts - 10.1.10.1 rhxhost01.example.com rhxhost01 - 10.1.20.1 rhxhost02.example.com rhxhost02 - 172.16.30.5 rhxascs.example.com rhxascs - 172.16.30.6 rhxers.example.com rhxers - + cat /etc/hosts + <10.1.10.1 rhxhost01.example.com rhxhost01> + <10.1.20.1 rhxhost02.example.com rhxhost02> + <172.16.30.5 rhxascs.example.com rhxascs> + <172.16.30.6 rhxers.example.com rhxers> @@ -561 +552 @@ We recommend sharing a single Amazon EFS or FSx for ONTAP file system across mul -The file system's DNS name is the simplest mounting option. The DNS automatically resolves to the mount target's IP address in the Availability Zone of the connecting Amazon EC2 instance. You can also create an alias to help with identifying the purpose of the shared file system. We have used `<nfs.fqdn>` in this document. The following are some examples. +The file system’s DNS name is the simplest mounting option. The DNS automatically resolves to the mount target’s IP address in the Availability Zone of the connecting Amazon EC2 instance. You can also create an alias to help with identifying the purpose of the shared file system. We have used `<nfs.fqdn>` in this document. The following are some examples. @@ -574 +565 @@ The file system's DNS name is the simplest mounting option. The DNS automaticall -Review the `enableDnsHostnames` and `enableDnsSupport` DNS attributes for your VPC. For more information, see [View and update DNS attributes for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-updating). +Review the `enableDnsHostnames` and `enableDnsSupport` DNS attributes for your VPC. For more information, see {https---docs-aws-amazon-com-vpc-latest-userguide-vpc-dns-html-vpc-dns-updating}[View and update DNS attributes for your VPC]. @@ -586 +577 @@ RHX_ERS10 | /usr/sap/RHX/ERS10 -For more information, see SAP Documentation – [SAP System Directories on UNIX](https://help.sap.com/docs/SAP_NETWEAVER_750/ff18034f08af4d7bb33894c2047c3b71/2744f17a26a74a8abfd202c4f5dc9a0f.html). +For more information, see SAP Documentation – {https---help-sap-com-docs-SAP-NETWEAVER-750-ff18034f08af4d7bb33894c2047c3b71-2744f17a26a74a8abfd202c4f5dc9a0f-html}[SAP System Directories on UNIX]. @@ -605,3 +596,3 @@ Create the directories using the following command. - mkdir -p /mnt/RHX_sapmnt - mkdir -p /mnt/RHX_ASCS00 - mkdir -p /mnt/RHX_ERS10 + mkdir -p /mnt/<RHX_sapmnt> + mkdir -p /mnt/<RHX_ASCS00> + mkdir -p /mnt/<RHX_ERS10> @@ -612 +603 @@ Change the ownership or permissions to ensure that the install as `<sid>adm` can - chmod 777 /mnt/RHX_sapmnt /mnt/RHX_ASCS00 /mnt/RHX_ERS10 + chmod 777 /mnt/<RHX_sapmnt> /mnt/<RHX_ASCS00> /mnt/<RHX_ERS10> @@ -627,2 +618,2 @@ Create the directories for the required mount points (permanent or cluster contr - mkdir /usr/sap/RHX/ASCS00 - mkdir /usr/sap/RHX/ERS10 + mkdir /usr/sap/<RHX/ASCS00> + mkdir /usr/sap/<RHX/ERS10> @@ -635 +626 @@ Prepare and append an entry for the `sapmnt` file system to `/etc/fstab`. - <nfs.fqdn>/RHX_sapmnt /sapmnt nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 + <nfs.fqdn>/<RHX_sapmnt> /sapmnt nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 @@ -658 +649,2 @@ Use the following command on the instance where you to plan to install ASCS. - mount <nfs.fqdn>:/RHX_ASCS00 /usr/sap/RHX/ASCS00 + mount <nfs.fqdn>:/<RHX_ASCS00> /usr/sap/<RHX>/ASCS + @@ -663 +655,2 @@ Use the following command on the instance where you to plan to install ERS. - mount <nfs.fqdn>:/RHX_ERS10 /usr/sap/RHX/ERS10 + mount <nfs.fqdn>:/<RHX_ERS10> /usr/sap/<RHX>/ERS + @@ -705 +698 @@ Using the overlay IP agent with a shared Amazon VPC requires a different set of -In sharing VPC account, create an IAM role to delegate permissions to the EC2 instances that will be part of the cluster. During the IAM Role creation, select “Another AWS account” as the type of trusted entity, and enter the AWS account ID where the EC2 instances will be deployed/running from. +In sharing VPC account, create an IAM role to delegate permissions to the EC2 instances that will be part of the cluster. During the IAM Role creation, select "Another AWS account" as the type of trusted entity, and enter the AWS account ID where the EC2 instances will be deployed/running from. @@ -731,2 +724 @@ After the IAM role has been created, create the following IAM policy on the shar - -Next, edit move to the “Trust relationships” tab in the IAM role, and ensure that the AWS account you entered while creating the role has been correctly added. +Next, edit move to the "Trust relationships" tab in the IAM role, and ensure that the AWS account you entered while creating the role has been correctly added. @@ -795 +785 @@ The following IP Resource for ASCS needs to be created. - pcs resource create rsc_ip_RHX_ASCS00 ocf:heartbeat:aws-vpc-move-ip ip=172.16.30.5 interface=eth0 routing_table=rtb-xxxxxroutetable1 lookup_type=NetworkInterfaceId routing_table_role="arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>" op monitor interval=20s timeout=40s --group grp_RHX_ASCS00 + pcs resource create <rsc_ip_RHX_ASCS00> ocf:heartbeat:aws-vpc-move-ip ip=172.16.30.5 interface=eth0 routing_table=<rtb-xxxxxroutetable1> lookup_type=NetworkInterfaceId routing_table_role="<arn:aws:iam:<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>>" op monitor interval=20s timeout=40s --group <grp_RHX_ASCS00> @@ -800 +790 @@ The following IP Resource for ERS needs to be created. - pcs resource create rsc_ip_RHX_ERS10 ocf:heartbeat:aws-vpc-move-ip params ip=172.16.30.6 interface=eth0 routing_table=rtb-xxxxxroutetable1 lookup_type=NetworkInterfaceId routing_table_role="arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>" op monitor interval=20s timeout=40s --group grp_RHX_ERS10 + pcs resource create <rsc_ip_RHX_ERS10> ocf:heartbeat:aws-vpc-move-ip params ip=172.16.30.6 interface=eth0 routing_table=<rtb-xxxxxroutetable1> lookup_type=NetworkInterfaceId routing_table_role="<arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>>" op monitor interval=20s timeout=40s --group <grp_RHX_ERS10>