AWS sap medium security documentation change
Summary
Corrected instance metadata IP address in proxy configuration; removed sections on installation via AWS Systems Manager and interactive mode; removed update instructions; fixed table of contents duplication.
Security assessment
The correction of the instance metadata IP address from 196.254.169.254 to 169.254.169.254 ensures proxy configurations properly exclude metadata service calls. Using an incorrect address could allow metadata requests to traverse through proxies, potentially exposing sensitive instance metadata. This fixes a security-relevant configuration error.
Diff
diff --git a/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.md b/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.md index b2169a4e1..2d05f13d8 100644 --- a//sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.md +++ b//sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.md @@ -5 +5 @@ -Install AWS Backint agent using the AWS Systems Manager documentInstall AWS Backint agent using the AWS Systems Manager documentInstall AWS Backint agent using AWS Backint installer — interactive modeInstall AWS Backint agent using AWS Backint installer — interactive modeInstall AWS Backint agent using AWS Backint installer — silent modeUse a proxy address with AWS Backint agentBackint-related SAP HANA parametersModify AWS Backint agent configuration parametersConfigure SAP HANA to use a different Amazon S3 bucket and folder for data and log backupConfigure SAP HANA to use a different Amazon S3 bucket and folder for catalog backupConfigure AWS Backint agent to use shorter Amazon S3 pathsView AWS Backint agent logsGet the currently installed AWS Backint agent versionUpdate to the newest version or install a previous version of AWS Backint agentUpdate to the newest version or install a previous version of AWS Backint agentPerformance tuningSubscribe to AWS Backint agent notifications +Install AWS Backint agent using the AWS Systems Manager documentInstall AWS Backint agent using AWS Backint installer — interactive modeInstall AWS Backint agent using AWS Backint installer — silent modeUse a proxy address with AWS Backint agentBackint-related SAP HANA parametersModify AWS Backint agent configuration parametersConfigure SAP HANA to use a different Amazon S3 bucket and folder for data and log backupConfigure SAP HANA to use a different Amazon S3 bucket and folder for catalog backupConfigure AWS Backint agent to use shorter Amazon S3 pathsView AWS Backint agent logsGet the currently installed AWS Backint agent versionUpdate to the newest version or install a previous version of AWS Backint agentPerformance tuningSubscribe to AWS Backint agent notifications @@ -15,4 +14,0 @@ This section provides information to help you install the AWS Backint agent usin - * Install AWS Backint agent using the AWS Systems Manager document - - * Install AWS Backint agent using AWS Backint installer — interactive mode - @@ -41,2 +36,0 @@ This section provides information to help you install the AWS Backint agent usin - * Update to the newest version or install a previous version of AWS Backint agent - @@ -125,75 +118,0 @@ The SSM document creates symbolic links (symlinks) in the SAP HANA global direct -## Install AWS Backint agent using the AWS Systems Manager document - -Use the following steps to install the AWS Backint agent using the AWS SSM document. - -###### Important - -Disable any existing backup processes (including scheduled log backups) before continuing with the installation. If you don’t disable existing backup processes before running the SSM document, you can corrupt an in-progress backup, which can impact your ability to recover your database. - - 1. From the AWS Management Console, choose **Systems Manager** under **Management & Governance**, or enter `Systems Manager` in the **Find Services** search bar. - - 2. From the Systems Manager console, choose **Documents** under **Shared Resources** in the left navigation pane. - - 3. On the Documents page, select the **Owned by Amazon** tab. You should see a document named **AWSSAP-InstallBackint**. - - 4. Select the **AWSSAP-InstallBackint** document and choose **Run command**. - - 5. Under the Command parameters, enter the following - - 1. **Bucket Name**. Enter the name of the Amazon S3 bucket where you want to store your SAP HANA backup files. - - 2. **Bucket Folder**. Optionally, enter the name of the folder within your Amazon S3 bucket where you want to store your SAP HANA backup files. - - 3. **System ID**. Enter your SAP HANA System ID, for example `HDB`. - - 4. **Bucket Region**. Enter the AWS Region of the Amazon S3 bucket where you want to store your **SAP HANA backup files**. AWS Backint agent supports cross-Region and cross-account backups. You must provide the AWS Region and Amazon S3 bucket owner account ID along with the Amazon S3 bucket name for the agent to perform successfully. - - 5. **Bucket Owner Account ID**. Enter the account ID of the Amazon S3 bucket where you want to store your SAP HANA backup files. - - 6. **Kms Key**. Enter the ARN of AWS KMS that AWS Backint agent can use to encrypt the backup files stored in your Amazon S3 bucket. - - 7. **Installation Directory**. Enter the path of the directory location where you want to install the AWS Backint agent. Avoid using `/tmp` as the install path. - - 8. **Agent Version**. Enter the version number of the agent that you want to install. If you do not enter a version number, the latest published version of the agent is installed. - -###### Note - -1.0 versions are unavailable in the China (Beijing and Ningxia) Regions. - - 9. **Modify Global ini file**. Choose how you want to modify the `global.ini` file. The `global.ini` file of the SAP HANA SYSTEM DB must be updated to complete the setup. - - 1. "modify" — SSM will update the `global.ini` file directly. - - 2. "sql" — SSM will create a file called `modify_global_ini.sql` with SQL statements that you can run in your target SAP HANA system to set the required parameters. You can find the `modify_global_ini.sql` file in the `<installation directory>/aws-backint-agent/` folder. - - 3. "none" — No action will be taken by SSM to modify the `global.ini` file. You must manually update it to complete the setup. - - 10. **Ignore Bucket Checks**. Select **yes** to ignore sanity checks of the S3 bucket. S3 Bucket sanity checks verify the following: - - * the bucket exists in your account - - * the bucket Region is correct - - * the bucket is public - - 11. **Debug Mode**. Select **yes** to activate debug mode. - - 12. **Important! Ensure No Backup In Process**. Choose **Yes** to confirm that you have disabled existing backups and are ready to proceed with the installation. **The SSM document will fail if you choose "No"**. - - 6. Under **Targets** , select the method for your target instance to use to install the AWS Backint agent, and then choose the instance on which to install it. If you are not able to find your instance in the list, verify that you have followed all of the steps in the [prerequisites](./aws-backint-agent-amazon-s3.html#aws-backint-agent-s3-prerequisites). - - 7. Under **Other parameters** , leave the field empty and choose **Run**. - -###### Important - -If you do not have the latest version of the SSM Agent installed (2.3.274.0 or later), **Run Command** will fail to execute. - - 8. When the agent is successfully installed, you will see the **Success** status under the **Command ID**. - - 9. To verify the installation, log in to your instance and view the `/<install directory>/aws-backint-agent` directory. You should see the following files in the directory: the AWS Backint agent binary, `THIRD_PARTY_LICENSES.txt` file, which contains licenses of libraries used by the agent, the launcher script, the YAML configuration file, and the optional `modify_global_ini.sql` file. In addition, a source file (`aws-backint-agent.tar.gz`) of AWS Backint agent is stored in the package directory. You can verify the signature of this file to ensure that the downloaded source file is original and unmodified. See the [Verifying the signature of AWS Backint agent and installer for SAP HANA](./aws-backint-agent-signature.html) section in this document for details. - -The SSM document creates symbolic links (symlinks) in the SAP HANA global directory for the Backint configuration. Verify that the symlink for `hdbbackint` exists in the `/usr/sap/<SID>/SYS/global/hdb/opt` directory and the symlink for `aws-backint-agent-config.yaml` exists in the `/usr/sap/<SID>/SYS/global/hdb/opt/hdbconfig` directory. - - - - @@ -325,111 +243,0 @@ If your installation fails due to validation errors and you want to ignore the v -## Install AWS Backint agent using AWS Backint installer — interactive mode - -Another way to install the AWS Backint agent is with the AWS Backint installer. You can download the AWS Backint installer from an Amazon S3 bucket. - -For China (Beijing), the bucket name is `s3://awssap-backint-agent-cn-north-1`. - -For China (Ningxia), the bucket name is `s3://awssap-backint-agent-cn-northwest-1`. - -For China (Beijing), the latest installer can always be found at: `s3://awssap-backint-agent-cn-north-1/binary/latest/install-aws-backint-agent`. - -For China (Ningxia), the latest installer can always be found at: `s3://awssap-backint-agent-cn-northwest-1/binary/latest/install-aws-backint-agent`. - -Follow these steps to install AWS Backint agent using the AWS Backint installer from an SSH session on your SAP HANA instance. - -###### Important - -Disable any existing backup processes (including scheduled log backups) before continuing with the installation. If you don’t disable existing backup processes before running the AWS Backint agent installer, you can corrupt an in-progress backup, which can impact your ability to recover your database. - - 1. Navigate to `/tmp` (or another temporary directory where you downloaded the installer). - - cd /tmp - - 2. Run one of the following command to download the installer. - -**China (Beijing)** - - sudo aws s3 cp s3://awssap-backint-agent-cn-north-1/binary/latest/install-aws-backint-agent /tmp/ --region cn-north-1 - - sudo wget https://awssap-backint-agent-cn-north-1.s3.cn-north-1.amazonaws.com.cn/binary/latest/install-aws-backint-agent -O /tmp/install-aws-backint-agent - -**China (Ningxia)** - - sudo aws s3 cp s3://awssap-backint-agent-cn-northwest-1/binary/latest/install-aws-backint-agent /tmp/ --region cn-northwest-1 - - sudo wget https://awssap-backint-agent-cn-northwest-1.s3.cn-northwest-1.amazonaws.com.cn/binary/latest/install-aws-backint-agent -O /tmp/install-aws-backint-agent - -###### Note - -If you encounter permission issues while downloading the AWS Backint installer using the AWS CLI, check your IAM policy and ensure that your policies allow for downloading objects from the `awssap-backint-agent` bucket. See the [Identity and Access Management](./aws-backint-agent-amazon-s3.html#aws-backint-agent-iam) section of this documentation for details. - - 3. Run the installer with the `-h` flag to find all of the available options. - - sudo python install-aws-backint-agent -h - - 4. Run the following command to execute the installer. - - sudo python install-aws-backint-agent - -###### Note - - Run the installer with the `-l` flag if you want the installer to get the {aws} Backint agent binary file from your own file system or Amazon S3 bucket. Specify the location of the [path]``aws-backint-agent.tar.gz`` file. - - sudo python install-aws-backint-agent -l /tmp/backint/aws-backint-agent.tar.gz - - sudo python install-aws-backint-agent -l s3://<S3 bucket>/aws-backint-agent.tar.gz - - sudo python install-aws-backint-agent -l https://<S3 bucket>.s3.amazonaws.com/aws-backint-agent.tar.gz - - 5. Enter information for the following parameters. - - 1. **Installation directory** — Enter the path of the directory location where you want to install the AWS Backint agent. The default value for the installation directory is `/hana/shared/`. - - 2. **Amazon S3 bucket owner** — Enter the account ID of the Amazon S3 bucket owner of the bucket where you want to store your SAP HANA backup files. - - 3. **Amazon S3 bucket Region** — Enter the AWS Region of the Amazon S3 bucket where you want to store your SAP HANA backup files. - - 4. **Amazon S3 bucket name** — Enter the name of the Amazon S3 bucket where you want to store your SAP HANA backup files. - - 5. **Folder in the S3 bucket** — Enter the name of the folder in the Amazon S3 bucket where you want to store your SAP HANA backup files. This parameter is optional. - - 6. **Amazon S3 SSE KMS ARN** — Enter the ARN of the AWS KMS that AWS Backint agent can use to encrypt the backup files stored in your Amazon S3 bucket. - -###### Note - -If you leave this field empty, AWS Backint installer will prompt you to confirm that you don’t want to encrypt your backup files with encryption keys stored in AWS KMS. If you do not confirm that you do not want to encrypt with the kms-key, the installer will abort. We strongly recommend that you encrypt your data. - - 7. **SAP HANA system ID** — Enter your SAP HANA System ID, for example `HDB`. - - 8. **HANA opt dir** — Confirm the location of the SAP HANA opt directory. - - 9. **Modify global.ini [modify/sql/[none]]** — Choose how you want to modify the `global.ini` file. The `global.ini` file of the SAP HANA SYSTEM must be updated to complete the setup. - - 1. "modify" — AWS Backint installer will update the `global.ini` file directly. - - 2. "sql" — AWS Backint installer will create a file called `modify_global_ini.sql` with SQL statements that you can run in your target SAP HANA system to set the required parameters. You can find the `modify_global_ini.sql` file in the `<installation directory>/aws-backint-agent/` folder. - - 3. "none" — No action will be taken by AWS Backint installer to modify the `global.ini` file. You must manually update them to complete the setup. - - 10. **HANA SYSTEM db global.ini file** — Confirm the location of `global.ini` file. - - 11. **Verify signature of the agent binary`–0—tar` file** — - - * Choose `y` to verify the signature of the AWS Backint agent source file. If you choose `y`, enter the Amazon S3 bucket location of the signature file of the agent binary `–0—tar` file, for example, ` [https://s3.amazonaws.com/awssap-backint-agent/binary/latest/aws-backint-agent.sig](https://s3.amazonaws.com/awssap-backint-agent/binary/latest/aws-backint-agent.sig) `. Or, provide a local file that is stored on the instance. If you proceed without making a selection, the default location listed within brackets ([]) is used. - - * Choose `n` if you do not want to verify the signature of the AWS Backint agent source file. - - 12. **Save responses for future usage?** — You can save your information for the AWS Backint installer to a file. You can then use it later to run the installer in silent mode, if needed. - - 13. **Do you want to proceed with the installation?** — Confirm that you have disabled the existing backups and are ready to proceed with the installation. - - 6. To verify the installation, log in to your instance and view the `/<install directory>/aws-backint-agent` directory. You should see the following files in the directory: the AWS Backint agent binary, the `THIRD_PARTY_LICENSES.txt` file, which contains licenses of libraries used by the agent, the launcher script, the YAML configuration file, and the optional `modify_global_ini.sql` file. In addition, a source file (`aws-backint-agent.tar.gz`) of AWS Backint agent is stored in the package directory. You can verify the signature of this file to ensure that the downloaded source file is original and unmodified. See the [Verifying the signature of AWS Backint agent and installer for SAP HANA](./aws-backint-agent-signature.html) section in this document for details. - -In addition, the AWS Backint installer creates symbolic links (symlinks) in the SAP HANA global directory for the Backint configuration. Verify that the symlink for `hdbbackint` exists in the `/usr/sap/<SID>/SYS/global/hdb/opt` directory, and that the symlink for `aws-backint-agent-config.yaml` exists in the `/usr/sap/<SID>/SYS/global/hdb/opt/hdbconfig` directory. - -###### Note - -If your installation fails due to validation errors and you want to ignore the validation and proceed with the installation, you can execute the installer with the `-n` flag to ignore the validation steps. You can also use the `-d` flag to run the installer in debug mode to generate detailed installation logs for troubleshooting. -