AWS sap documentation change
Summary
Updated AWS CLI command syntax with placeholder values (e.g., <i-xxxxinstidforhost1>), fixed markdown formatting, and adjusted directory path examples with angle brackets for variables.
Security assessment
The changes primarily involve syntax formatting and placeholder standardization. No explicit security vulnerabilities, patches, or new security features are introduced. While some commands (e.g., `chmod 777`) have security implications, the change only adds placeholder syntax and does not alter the security guidance itself.
Diff
diff --git a/sap/latest/sap-netweaver/sles-netweaver-ha-settings.md b/sap/latest/sap-netweaver/sles-netweaver-ha-settings.md index dcb67e0ae..ae325d72c 100644 --- a//sap/latest/sap-netweaver/sles-netweaver-ha-settings.md +++ b//sap/latest/sap-netweaver/sles-netweaver-ha-settings.md @@ -248,3 +246,0 @@ Run the following commands for both instances in the cluster. - * aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost1 --no-source-dest-check - - * aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost2 --no-source-dest-check @@ -251,0 +248 @@ Run the following commands for both instances in the cluster. + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost1> --no-source-dest-check @@ -253,0 +251 @@ Run the following commands for both instances in the cluster. + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost2> --no-source-dest-check @@ -275 +273 @@ Modifying instance maintenance options will require admin privileges not covered - aws ec2 modify-instance-maintenance-options --instance-id i-xxxxinstidforhost1 --auto-recovery disabled + aws ec2 modify-instance-maintenance-options --instance-id <i-xxxxinstidforhost1> --auto-recovery disabled @@ -278 +276 @@ Modifying instance maintenance options will require admin privileges not covered - aws ec2 modify-instance-maintenance-options --instance-id i-xxxxinstidforhost2 --auto-recovery disabled + aws ec2 modify-instance-maintenance-options --instance-id <i-xxxxinstidforhost2> --auto-recovery disabled @@ -287 +285 @@ Modifying instance attributes will require admin privileges not covered by the I - aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost1 --no-disable-api-stop + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost1> --no-disable-api-stop @@ -290 +288 @@ Modifying instance attributes will require admin privileges not covered by the I - aws ec2 modify-instance-attribute --instance-id i-xxxxinstidforhost2 --no-disable-api-stop + aws ec2 modify-instance-attribute --instance-id <i-xxxxinstidforhost2> --no-disable-api-stop @@ -423 +416 @@ This is applicable to both cluster nodes. Time synchronization is important for -You can use Amazon Time Sync Service that is available on any instance running in a VPC. It does not require internet access. To ensure consistency in the handling of leap seconds, don't mix Amazon Time Sync Service with any other `ntp` time sync servers or pools. +You can use Amazon Time Sync Service that is available on any instance running in a VPC. It does not require internet access. To ensure consistency in the handling of leap seconds, don’t mix Amazon Time Sync Service with any other `ntp` time sync servers or pools. @@ -445 +436 @@ This is applicable to both cluster nodes. The cluster resource agents use AWS Co -You can either edit the config file at `/root/.aws` manually or by using [`aws configure`](https://docs.aws.amazon.com/cli/latest/reference/configure/index.html) AWS CLI command. +You can either edit the config file at `/root/.aws` manually or by using [aws configure](https://docs.aws.amazon.com/cli/latest/reference/configure/index.html) AWS CLI command. @@ -450,3 +441,3 @@ You can skip providing the information for the access and secret access keys. Th - # aws configure - AWS Access Key ID [None]: - AWS Secret Access Key [None]: + aws configure + {aws} Access Key ID [None]: + {aws} Secret Access Key [None]: @@ -460,3 +450,3 @@ The profile name is configurable. The name chosen in this example is **cluster** - # aws configure –-profile cluster - AWS Access Key ID [None]: - AWS Secret Access Key [None]: + aws configure –-profile <cluster> + {aws} Access Key ID [None]: + {aws} Secret Access Key [None]: @@ -548 +536 @@ You route table now has two entries, each for ASCS and ERS, in addition to the s -The preceding steps can also be performed programmatically. We suggest performing the steps using administrative privileges, instead of instance-based privileges to preserve least privilege. CreateRoute API isn't necessary for ongoing operations. +The preceding steps can also be performed programmatically. We suggest performing the steps using administrative privileges, instead of instance-based privileges to preserve least privilege. CreateRoute API isn’t necessary for ongoing operations. @@ -553 +541 @@ Run the following command as a dry run on both nodes to confirm that the instanc - aws ec2 replace-route --route-table-id rtb-xxxxxroutetable1 --destination-cidr-block 172.16.30.5/32 --instance-id i-xxxxinstidforhost1 --dry-run --profile <aws_cli_cluster_profile> + aws ec2 replace-route --route-table-id <rtb-xxxxxroutetable1> --destination-cidr-block <172.16.30.5/32> --instance-id <i-xxxxinstidforhost1> --dry-run --profile <aws_cli_cluster_profile> @@ -566 +554 @@ On EC2 instance 1, where you are installing ASCS, add the overlay IP allocated f - ip addr add 172.16.30.5/32 dev eth0 + ip addr add <172.16.30.5/32> dev eth0 @@ -571 +559 @@ On EC2 instance 2, where you are installing ERS, add the overlay IP allocated fo - ip addr add 172.16.30.6/32 dev eth0 + ip addr add <172.16.30.6/32> dev eth0 @@ -578,6 +566,5 @@ This is applicable to both cluster nodes. You must ensure that both instances ca - # cat /etc/hosts - 10.1.10.1 slxhost01.example.com slxhost01 - 10.1.20.1 slxhost02.example.com slxhost02 - 172.16.30.5 slxascs.example.com slxascs - 172.16.30.6 slxers.example.com slxers - + cat /etc/hosts + <10.1.10.1 slxhost01.example.com slxhost01> + <10.1.20.1 slxhost02.example.com slxhost02> + <172.16.30.5 slxascs.example.com slxascs> + <172.16.30.6 slxers.example.com slxers> @@ -614 +601 @@ We recommend sharing a single Amazon EFS or FSx for ONTAP file system across mul -The file system's DNS name is the simplest mounting option. The DNS automatically resolves to the mount target's IP address in the Availability Zone of the connecting Amazon EC2 instance. You can also create an alias to help with identifying the purpose of the shared file system. We have used `<nfs.fqdn>` in this document. The following are some examples. +The file system’s DNS name is the simplest mounting option. The DNS automatically resolves to the mount target’s IP address in the Availability Zone of the connecting Amazon EC2 instance. You can also create an alias to help with identifying the purpose of the shared file system. We have used `<nfs.fqdn>` in this document. The following are some examples. @@ -660,3 +647,3 @@ Create the directories using the following command. - mkdir -p /mnt/SLX_sapmnt - mkdir -p /mnt/SLX_ASCS00 - mkdir -p /mnt/SLX_ERS10 + mkdir -p /mnt/<SLX_sapmnt> + mkdir -p /mnt/<SLX_ASCS00> + mkdir -p /mnt/<SLX_ERS10> @@ -667 +654 @@ Change the ownership or permissions to ensure that the install as `<sid>adm` can - chmod 777 /mnt/SLX_sapmnt /mnt/SLX_ASCS00 /mnt/SLX_ERS10 + chmod 777 /mnt/<SLX_sapmnt> /mnt/<SLX_ASCS00> /mnt/<SLX_ERS10> @@ -682,2 +669,3 @@ Create the directories for the required mount points (permanent or cluster contr - mkdir /usr/sap/SLX/ASCS00 - mkdir /usr/sap/SLX/ERS10 + mkdir /usr/sap/<SLX>/ASCS + mkdir /usr/sap/<SLX>/ERS + @@ -690 +678 @@ For both simple-mount and classic architectures, prepare and append an entry for - <nfs.fqdn>/SLX_sapmnt /sapmnt nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 + <nfs.fqdn>/<SLX_sapmnt> /sapmnt nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 @@ -695,3 +683 @@ For both simple-mount and classic architectures, prepare and append an entry for - <nfs.fqdn>:/SLX_ASCS00 /usr/sap/SLX/ASCS00 nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 - - <nfs.fqdn>:/SLX_ERS10 /usr/sap/SLX/ERS10 nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 + <nfs.fqdn>:/<SLX_ASCS00> /usr/sap/<SLX>/ASCS<00> nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 @@ -698,0 +685 @@ For both simple-mount and classic architectures, prepare and append an entry for + <nfs.fqdn>:/<SLX_ERS10> /usr/sap/<SLX>/ERS<10> nfs nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2,noresvport 0 0 @@ -723 +710,2 @@ Use the following command on the instance where you to plan to install ASCS. - mount <nfs.fqdn>:/SLX_ASCS00 /usr/sap/SLX/ASCS00 + mount <nfs.fqdn>:/<SLX_ASCS00> /usr/sap/<SLX>/ASCS + @@ -728 +716,2 @@ Use the following command on the instance where you to plan to install ERS. - mount <nfs.fqdn>:/SLX_ERS10 /usr/sap/SLX/ERS10 + mount <nfs.fqdn>:/<SLX_ERS10> /usr/sap/<SLX>/ERS + @@ -770 +759 @@ Using the overlay IP agent with a shared Amazon VPC requires a different set of -In sharing VPC account, create an IAM role to delegate permissions to the EC2 instances that will be part of the cluster. During the IAM Role creation, select “Another AWS account” as the type of trusted entity, and enter the AWS account ID where the EC2 instances will be deployed/running from. +In sharing VPC account, create an IAM role to delegate permissions to the EC2 instances that will be part of the cluster. During the IAM Role creation, select "Another AWS account" as the type of trusted entity, and enter the AWS account ID where the EC2 instances will be deployed/running from. @@ -796 +785 @@ After the IAM role has been created, create the following IAM policy on the shar -Next, edit move to the “Trust relationships” tab in the IAM role, and ensure that the AWS account you entered while creating the role has been correctly added. +Next, edit move to the "Trust relationships" tab in the IAM role, and ensure that the AWS account you entered while creating the role has been correctly added. @@ -858 +847 @@ The following IP Resource for ASCS needs to be created. - crm configure primitive rsc_ip_SLX_ASCS00 ocf:heartbeat:aws-vpc-move-ip params ip=172.16.30.5 routing_table=rtb-xxxxxroutetable1 interface=eth0 profile=cluster lookup_type=NetworkInterfaceId routing_table_role="arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>" op start interval=0 timeout=180s op stop interval=0 timeout=180s op monitor interval=20s timeout=40s + crm configure primitive rsc_ip_<SLX>_ASCS<00> ocf:heartbeat:aws-vpc-move-ip params ip=<172.16.30.5> routing_table=<rtb-xxxxxroutetable1> interface=eth0 profile=<cluster> lookup_type=NetworkInterfaceId routing_table_role="arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>" op start interval=0 timeout=180s op stop interval=0 timeout=180s op monitor interval=20s timeout=40s @@ -863 +852 @@ The following IP Resource for ERS needs to be created. - crm configure primitive rsc_ip_SLX_ERS10 ocf:heartbeat:aws-vpc-move-ip params ip=172.16.30.6 routing_table=rtb-xxxxxroutetable1 interface=eth0 profile=cluster lookup_type=NetworkInterfaceId routing_table_role="arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>" op start interval=0 timeout=180s op stop interval=0 timeout=180s op monitor interval=20s timeout=40s + crm configure primitive rsc_ip_<SLX>_ERS<10> ocf:heartbeat:aws-vpc-move-ip params ip=<172.16.30.6> routing_table=<rtb-xxxxxroutetable1> interface=eth0 profile=<cluster> lookup_type=NetworkInterfaceId routing_table_role="arn:aws:iam::<sharing_vpc_account_id>:role/<sharing_vpc_account_cluster_role>" op start interval=0 timeout=180s op stop interval=0 timeout=180s op monitor interval=20s timeout=40s