AWS sap medium security documentation change
Summary
Restructured deployment steps with updated storage configuration guidance, simplified console workflow, and added explicit security group configuration details
Security assessment
Added explicit guidance for security group configuration including port restrictions and source IP filtering. Introduced mandatory IMDSv2 usage (HttpTokens=required) in AWS CLI example. These changes directly improve security posture by enforcing metadata service protection and network access controls.
Diff
diff --git a/sap/latest/sap-hana/deployment-steps-using-the-aws-management-console.md b/sap/latest/sap-hana/deployment-steps-using-the-aws-management-console.md index e58ac45a3..52deab354 100644 --- a//sap/latest/sap-hana/deployment-steps-using-the-aws-management-console.md +++ b//sap/latest/sap-hana/deployment-steps-using-the-aws-management-console.md @@ -5 +5 @@ -# Deploy scale-up and scale-out workloads with Amazon EBS +# Deploy SAP HANA Workloads with Amazon EBS Volumes @@ -7,3 +7 @@ -This topic explains how to deploy scale-up and scale-out workloads with Amazon EBS. - -Choose one of the following methods. +This topic explains how to assign EBS Volumes when launching an Amazon EC2 Instance. Choose one of the following methods. @@ -20,21 +18 @@ Console - 4. Search for the image that you want to use: - - * Choose **AWS Marketplace** to search for RHEL for SAP and SLES for SAP images. - - * Choose **My AMIs** to search for your BYOS or custom AMI ID. - -When you find the image, choose **Select** , and then confirm to continue. - - 5. On the **Choose an Instance Type** page, select the instance type that you identified when [planning the deployment](./planning-the-deployment.html#compute), and choose **Configure Instance Details** to proceed with instance configuration. - - 6. On the **Configure Instance Details** page, do the following: - - 1. Enter the number of instances (typically 1). For scale-out workloads, specify the number of nodes. - - 2. Select the VPC ID and subnet for the network. - - 3. Turn off the **Auto-assign Public IP** option. - - 4. Select **Add instance to placement group** if needed (recommended for scale-out workloads; for details, see the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html)). - - 5. Select any IAM role that you want to assign to the instance to access AWS services from the instance. + 4. In Section **Application and OS Images (Amazon Machine Images)** : @@ -42 +20 @@ When you find the image, choose **Select** , and then confirm to continue. - 6. Select **Stop** for **Shutdown behavior**. + * Choose a recently used AMI or **My AMIs** to search for your BYOS or custom AMI ID. @@ -44 +22 @@ When you find the image, choose **Select** , and then confirm to continue. - 7. Enable termination protection if needed (strongly recommended). + * Choose **Browse more AMIs** to search for more AMIs from AWS, Marketplace and the Community. @@ -46 +24 @@ When you find the image, choose **Select** , and then confirm to continue. - 8. Enable Amazon CloudWatch detailed monitoring (strongly recommended; for details, see the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html)). + 5. In Section **Choose an Instance Type** page, select the instance type that you identified when [planning the deployment](./planning-the-deployment.html#compute) @@ -48 +26 @@ When you find the image, choose **Select** , and then confirm to continue. - 9. Select the **Tenancy** or proceed with the default (**Shared**). For dedicated hosts, select the **Dedicated host** option. + 6. In Section **Key Pair (login)** . Select an existing key pair if you have one. Otherwise, create a new key pair. @@ -50 +28 @@ When you find the image, choose **Select** , and then confirm to continue. - 10. Choose **Add Storage** to proceed with storage configuration. + 7. In Section **Network Settings** @@ -52 +30 @@ When you find the image, choose **Select** , and then confirm to continue. - 7. On the **Add Storage** page, choose **Add New Volume** to add volumes required for SAP HANA with the appropriate device, size, volume type, IOPS (for io1 only), and the **Delete on Termination** flag. Ensure that you follow the [storage guidance](./planning-the-deployment.html#storage) discussed earlier in this document. Add volumes for SAP HANA data, log, shared, backup, and binaries. + * Select the VPC ID and subnet for the network. @@ -54 +32 @@ When you find the image, choose **Select** , and then confirm to continue. -Figure 3 shows the storage configuration for x1.32xlarge instance type with io1 volume type for SAP HANA data and log. + * Turn off the **Auto-assign Public IP** option. @@ -56 +34 @@ Figure 3 shows the storage configuration for x1.32xlarge instance type with io1 - + * Select **Security Groups** @@ -58 +36 @@ Figure 3 shows the storage configuration for x1.32xlarge instance type with io1 -**Figure 3: SAP HANA Storage Configuration with the console** + * Choose **Select an existing security group** and select a security group, if you have one, to attach to your instance. Otherwise, choose **Create a new security group** and configure the **Type** , **Protocol** , **Port Range** , and the **Source IP address** from where you want to allow traffic to your SAP HANA instance. Refer to [Security groups in AWS Launch Wizard for SAP](https://docs.aws.amazon.com/launchwizard/latest/userguide/launch-wizard-sap-security-groups.html) for a list of ports that we recommend. You can change the port as needed to meet your security requirements. @@ -60 +38 @@ Figure 3 shows the storage configuration for x1.32xlarge instance type with io1 -###### Note + 8. In Section **Configure Storage** @@ -62 +40 @@ Figure 3 shows the storage configuration for x1.32xlarge instance type with io1 -If you are planning to deploy scale-out workloads, you don’t have to include Amazon EBS volumes for SAP HANA shared and backup volumes. You can use Amazon EFS with NFS to mount the HANA shared and backup volumes to your master and worker nodes. + * Choose **Advanced** to see extended details, and **Add new volume** to provision volumes for SAP binaries, and SAP HANA data, log, shared and optionally backup. Ensure that you follow the guidance for size, IOPS and Throughput in [Calculate Requirements](./hana-storage-config-ebs.html) or [Storage Reference](./hana-storage-config-reference-layout.html). @@ -64 +42 @@ If you are planning to deploy scale-out workloads, you don’t have to include A -Choose **Add Tags** to proceed with configuring tags. + * If you are planning to deploy scale-out workloads, you can optionally include EFS or FSX **filesystems** for SAP HANA shared and backup volumes. @@ -66 +44 @@ Choose **Add Tags** to proceed with configuring tags. - 8. Choose **Add Tag** and add the key-value pair to track and manage your resources. We recommend adding `Name` as a minimum key to easily identify your resources. + @@ -68 +46 @@ Choose **Add Tags** to proceed with configuring tags. -Next, choose **Configure Security Group**. +**Figure 1: SAP HANA Storage Configuration with the console** @@ -70 +48 @@ Next, choose **Configure Security Group**. - 9. Choose **Select an existing security group** and select a security group, if you have one, to attach to your instance. Otherwise, choose **Create a new security group** and configure the **Type** , **Protocol** , **Port Range** , and the **Source IP address** from where you want to allow traffic to your SAP HANA instance. Refer to [Security groups in AWS Launch Wizard for SAP](https://docs.aws.amazon.com/launchwizard/latest/userguide/launch-wizard-sap-security-groups.html) for a list of ports that we recommend. You can change the port as needed to meet your security requirements. + 9. In Section **Advanced Details** , review and modify the options to suit your workload. @@ -72 +50 @@ Next, choose **Configure Security Group**. - 10. Choose **Review and Launch** to review your selections, and then choose **Launch**. + 10. Select **Launch Instance** @@ -74,7 +52 @@ Next, choose **Configure Security Group**. - 11. Select an existing key pair if you have one. Otherwise, create a new key pair, acknowledge it, and choose **Launch Instances**. - - 12. Your instance should be launching now with the selected configuration. After the instance is launched, you can proceed with the operating system and storage configuration steps. - -###### Note - -Amazon EBS volumes are presented as [NVME block devices](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/nvme-ebs-volumes.html) on [Nitro-based instances](https://docs.aws.amazon.com-AWSEC2/latest/UserGuide/instance-types.html#ec2-nitro-instances). You need to perform additional mapping at the operating system level when you configure these volumes. + 11. Your instance should be launching now with the selected configuration. After the instance is launched, you can proceed with the operating system and storage configuration steps. @@ -88,3 +60 @@ AWS CLI -**Step 1. Prepare Storage Configuration for SAP HANA** - -Use the editor of your choice to create a .json file that contains block device mapping details similar to the following example, and save your file in a temporary directory. The example shows the block device mapping details for the x1.32xlarge instance type with io1 volumes for HANA data and log. Change the details depending on instance and storage type that you intend to use for your deployment. For more information, see [SAP HANA on AWS Operations Guide](https://docs.aws.amazon.com/sap/latest/sap-hana/sap-hana-on-aws-operations.html). + 1. **Prepare Storage Configuration for SAP HANA** @@ -91,0 +62 @@ Use the editor of your choice to create a .json file that contains block device +Use the editor of your choice to create a .json file that contains block device mapping details similar to the following example, and save your file in a temporary directory. The example shows the block device mapping details for the x2iedn.24xlarge instance with gp3 volumes for HANA data and log. Change the details depending on instance and storage type that you intend to use for your deployment. @@ -94,7 +65,6 @@ Use the editor of your choice to create a .json file that contains block device - {"DeviceName":"/dev/sdb","Ebs":{"VolumeSize":800,"VolumeType":"io1","Iops":3000,"Encrypted":true,"DeleteOnTermination":false}}, - {"DeviceName":"/dev/sdc","Ebs":{"VolumeSize":800,"VolumeType":"io1","Iops":3000,"Encrypted":true,"DeleteOnTermination":false}}, - {"DeviceName":"/dev/sdd","Ebs":{"VolumeSize":800,"VolumeType":"io1","Iops":3000,"Encrypted":true,"DeleteOnTermination":false}}, - {"DeviceName":"/dev/sde","Ebs":{"VolumeSize":1024,"VolumeType":"gp2","Encrypted":true,"DeleteOnTermination":false}}, - {"DeviceName":"/dev/sdf","Ebs":{"VolumeSize":4096,"VolumeType":"st1","Encrypted":true,"DeleteOnTermination":false}}, - {"DeviceName":"/dev/sdh","Ebs":{"VolumeSize":525,"VolumeType":"io1","Iops":2000,"Encrypted":true,"DeleteOnTermination":false}}, - {"DeviceName":"/dev/sdr","Ebs":{"VolumeSize":50,"VolumeType":"gp2","Encrypted":true,"DeleteOnTermination":false}} + {"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":50,"VolumeType":"gp3","Iops":3000,"Throughput":125,"Encrypted":true,"DeleteOnTermination":true}}, + {"DeviceName":"/dev/sdb","Ebs":{"VolumeSize":50,"VolumeType":"gp3","Iops":3000,"Throughput":125,"Encrypted":true,"DeleteOnTermination":true}}, + {"DeviceName":"/dev/sdc","Ebs":{"VolumeSize":2300,"VolumeType":"gp3","Iops":3600,"Throughput":625,"Encrypted":true,"DeleteOnTermination":true}}, + {"DeviceName":"/dev/sdd","Ebs":{"VolumeSize":2300,"VolumeType":"gp3","Iops":3600,"Throughput":625,"Encrypted":true,"DeleteOnTermination":true}}, + {"DeviceName":"/dev/sde","Ebs":{"VolumeSize":500,"VolumeType":"gp3","Iops":3000,"Throughput":300,"Encrypted":true,"DeleteOnTermination":true}}, + {"DeviceName":"/dev/sdf","Ebs":{"VolumeSize":1024,"VolumeType":"gp3","Iops":3000,"Throughput":125,"Encrypted":true,"DeleteOnTermination":true}} @@ -103,5 +73 @@ Use the editor of your choice to create a .json file that contains block device -###### Important - -If the `DeleteOnTermination` flag is set to false, Amazon EBS volumes are not deleted when you terminate your Amazon EC2 instance. This helps preserve your data from accidental termination of your Amazon EC2 instance. When you terminate the instance, you need to manually delete the Amazon EBS volumes that are associated with the terminated instance to stop incurring storage cost. - -###### Note +**Notes** @@ -109 +75 @@ If the `DeleteOnTermination` flag is set to false, Amazon EBS volumes are not de -If you plan to deploy scale-out workloads, you don’t have to include Amazon EBS volumes for SAP HANA shared and backup volumes. You can use Amazon EFS and Network File System (NFS) to mount the SAP HANA shared and backup volumes to your coordinator and subordinate nodes. + * The initial Device name for root should match the AMI you are trying to assign it to. Query this with @@ -111 +77 @@ If you plan to deploy scale-out workloads, you don’t have to include Amazon EB -**Step 2. Launch the Amazon EC2 instance** + $ aws ec2 describe-images --image-ids ami-0123456789abcdef0 --query 'Images[].RootDeviceName' --output text @@ -113 +79 @@ If you plan to deploy scale-out workloads, you don’t have to include Amazon EB -Use AWS CLI to launch the Amazon EC2 instance for SAP HANA, including Amazon EBS storage, in the VPC in your target AWS Region by using the information you gathered during the preparation steps; for example: + * You may choose to set `DeleteOnTermination` flag to false so that Amazon EBS volumes are not deleted when you terminate your Amazon EC2 instance. This helps preserve your data from accidental termination of your Amazon EC2 instance. When you terminate the instance, you need to manually delete the Amazon EBS volumes that are associated with the terminated instance to stop incurring storage cost. @@ -115 +81 @@ Use AWS CLI to launch the Amazon EC2 instance for SAP HANA, including Amazon EBS -###### Important + * If you plan to deploy scale-out workloads, you can use Amazon EFS and Network File System (NFS) to mount the SAP HANA shared and backup volumes to your coordinator and subordinate nodes after deployment. @@ -117 +83 @@ Use AWS CLI to launch the Amazon EC2 instance for SAP HANA, including Amazon EBS -Be sure to enter the command on a single line. + 2. **Launch the Amazon EC2 instance** @@ -118,0 +85 @@ Be sure to enter the command on a single line. +Use AWS CLI to launch the Amazon EC2 instance for SAP HANA, including Amazon EBS storage, in the VPC in your target AWS Region by using the information you gathered during the preparation steps; for example: @@ -120,11 +87,14 @@ Be sure to enter the command on a single line. - $ aws ec2 run-instances - --image-id ami-xxxxxxxx - --count 1 - --instance-type x1.32xlarge - --region us-west-2 - --key-name=my_key - --security-group-ids sg-xxxxxxxx - --subnet-id subnet-xxxxxxxx - --placement GroupName=My-PlacementGroup,Tenancy=default,HostId=My-DedicatedHostId - --block-device-mappings file:///tmp/ebs_hana.json - --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=MyHANA}]' 'ResourceType=volume,Tags=[{Key=Name,Value=MyHANAVolumes}]' + aws ec2 run-instances \ + --image-id ami-0123456789abcdef0 \ + --instance-type x2iedn.24xlarge \ + --count 1 \ + --region us-west-2 \ + --key-name my_key \ + --security-group-ids sg-0123456789abcdef0 \ + --subnet-id subnet-0123456789abcdef0 \ + --block-device-mappings file:///tmp/ebs_hana.json \ + --tag-specifications \ + 'ResourceType=instance,Tags=[{Key=Name,Value=PRD-HANA01},{Key=Environment,Value=Production},{Key=SID,Value=PRD},{Key=ApplicationComponent,Value=HANA}]' \ + 'ResourceType=volume,Tags=[{Key=Environment,Value=Production},{Key=SID,Value=PRD}]' \ + --ebs-optimized \ + --metadata-options "HttpTokens=required,HttpEndpoint=enabled" @@ -134,5 +104 @@ Be sure to enter the command on a single line. - * The `--placement` parameter is optional and needed only when you use a dedicated host with host tenancy or you want to place all your Amazon EC2 instances in close proximity. You may also pass additional parameters like `private-ip-address`, `disable-api-termination`, etc., as needed for your environment. For additional details, see [run-instances](https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html) in the AWS CLI Command Reference. - - * After the instance and volumes are created, you can adjust the values of Amazon EBS volume tags to be more specific for ease of management. You can also add any additional tags that you need. - - * For scale-out workloads, you can use the `--count` parameter to specify the total number of required nodes. + * This is a sample command only, with a focus on block-device-mappings. Review instance requirements seperately. It can be helpful to explore the options in the Console and then generate and adjust the code to replicate the setup for future deployments. @@ -140 +106 @@ Be sure to enter the command on a single line. - * Amazon EC2 [High Memory Metal Instances (u-*tb1.metal)](https://aws.amazon.com/ec2/instance-types/high-memory/) can be launched only through AWS CLI or APIs. After launch, however, you can manage them by using the console, AWS CLI, or APIs. You can use the AWS Management Console, AWS CLI, or APIs to launch virtualized high memory instances (u*tb1.*xlarge). + * `iam-instance-profile` and `user-data` flags can be used to ensure connectivity via Systems Manager. @@ -151 +117 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Configure storage (EBS) +Storage Reference @@ -153 +119 @@ Configure storage (EBS) -Configure Storage for SAP HANA +Configure Fileystems