AWS sap documentation change
Summary
Updated cluster maintenance documentation with placeholder syntax, alert configuration examples, and operational recommendations
Security assessment
Added AWS SNS alert integration example and IAM permission guidance for cluster monitoring. While this improves operational security practices by enabling alerting, there's no evidence of addressing a specific vulnerability. The changes document security-adjacent features rather than patching a security issue.
Diff
diff --git a/sap/latest/sap-netweaver/sles-netweaver-ha-operations-topics.md b/sap/latest/sap-netweaver/sles-netweaver-ha-operations-topics.md index 75e5749d2..558a8ef08 100644 --- a//sap/latest/sap-netweaver/sles-netweaver-ha-operations-topics.md +++ b//sap/latest/sap-netweaver/sles-netweaver-ha-operations-topics.md @@ -103 +103 @@ There are different options to perform planned maintenance on nodes, resources, -###### Options +###### Topics @@ -145 +145 @@ To perform maintenance on the cluster without system outage, the recommended met - crm node standby slxhost01 + crm node standby <slxhost01> @@ -150 +150 @@ The cluster will cleanly relocate resources, and you can perform activities, inc - crm node online slxhost01 + crm node online <slxhost01> @@ -157,3 +157,3 @@ Moving individual resources is not recommended because of the migration or move - slxhost01:~ # crm resource move grp_SLX_ASCS00 slxhost02 - INFO: Move constraint created for grp_SLX_ASCS00 to slxhost02 - INFO: Use `crm resource clear grp_SLX_ASCS00` to remove this constraint + <slxhost01>:~ crm resource move grp_<SLX>_ASCS<00> <slxhost02> + INFO: Move constraint created for grp_<SLX>_ASCS<00> to <slxhost02> + INFO: Use `crm resource clear grp_<SLX>_ASCS<00>` to remove this constraint @@ -164 +164 @@ Use the following command once the resources have relocated to their target loca - slxhost01:~ # crm resource clear grp_SLX_ASCS00 + <slxhost01>:~ crm resource clear grp_SLX_ASCS00 @@ -207 +207 @@ If failed actions are reported using the `crm status` command, and if they have -It is recommended that failed (or fenced) nodes are not automatically restarted. It gives operators a chance to investigate the failure, and ensure that the cluster doesn't make assumptions about the state of resources. +It is recommended that failed (or fenced) nodes are not automatically restarted. It gives operators a chance to investigate the failure, and ensure that the cluster doesn’t make assumptions about the state of resources. @@ -253,4 +253,4 @@ The agents can then be configured to send emails, log to a file, update a monito - # - # alert_sns.sh - # modified from /usr/share/pacemaker/alerts/alert_smtp.sh.sample - # + + alert_sns.sh + modified from /usr/share/pacemaker/alerts/alert_smtp.sh.sample + @@ -259,7 +259,7 @@ The agents can then be configured to send emails, log to a file, update a monito - # * Create an SNS Topic and subscribe email or chatbot - # * Note down the ARN for the SNS topic - # * Give the IAM Role attached to both Instances permission to publish to the SNS Topic - # * Ensure the aws cli is installed - # * Copy this file to /usr/share/pacemaker/alerts/alert_sns.sh or other location on BOTH nodes - # * Ensure the permissions allow for hacluster and root to execute the script - # * Run the following as root (modify file location if necessary and replace SNS ARN): + * Create an SNS Topic and subscribe email or chatbot + * Note down the ARN for the SNS topic + * Give the IAM Role attached to both Instances permission to publish to the SNS Topic + * Ensure the aws cli is installed + * Copy this file to /usr/share/pacemaker/alerts/alert_sns.sh or other location on BOTH nodes + * Ensure the permissions allow for hacluster and root to execute the script + * Run the following as root (modify file location if necessary and replace SNS ARN): @@ -268 +268 @@ The agents can then be configured to send emails, log to a file, update a monito - # crm configure alert aws_sns_alert /usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" to { arn:aws:sns:region:account-id:myPacemakerAlerts } + crm configure alert aws_sns_alert /usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" to <{ arn:aws:sns:region:account-id:myPacemakerAlerts }> @@ -270,2 +270,2 @@ The agents can then be configured to send emails, log to a file, update a monito - # pcs alert create id=aws_sns_alert path=/usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" - # pcs alert recipient add aws_sns_alert value=arn:aws:sns:region:account-id:myPacemakerAlerts + pcs alert create id=aws_sns_alert path=/usr/share/pacemaker/alerts/alert_sns.sh meta timeout=30s timestamp-format="%Y-%m-%d_%H:%M:%S" + pcs alert recipient add aws_sns_alert value=arn:aws:sns:region:account-id:myPacemakerAlerts