AWS sap documentation change
Summary
Added documentation for S3 Object Lock, object tagging details, and Data Perimeter configuration with Service Control Policies (SCPs) and VPC endpoint policies to control access to backup resources.
Security assessment
The changes introduce documentation for S3 Object Lock (WORM model) to prevent accidental deletion, object tagging for version tracking, and SCP/VPC policies to enforce data perimeter controls. These are proactive security enhancements rather than fixes for existing vulnerabilities. No evidence of addressing a specific security incident is provided.
Diff
diff --git a/sap/latest/sap-hana/aws-backint-agent-amazon-s3.md b/sap/latest/sap-hana/aws-backint-agent-amazon-s3.md index b505311d0..bd0a7d8cc 100644 --- a//sap/latest/sap-hana/aws-backint-agent-amazon-s3.md +++ b//sap/latest/sap-hana/aws-backint-agent-amazon-s3.md @@ -33,0 +34,2 @@ After your SAP HANA system is successfully running on an Amazon EC2 instance, ve + * Data perimeter + @@ -113 +115 @@ AWS Backint agent supports backing up to Amazon S3 with VPC endpoints. Amazon S3 -**S3 storage classes** \-- AWS Backint agent supports backing up your SAP HANA database to an Amazon S3 bucket with the S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Intelligent-Tiering storage classes. S3 Reduced Redundancy, Deep Archive, and Glacier storage classes are not supported by AWS Backint agent. By default, the S3 Standard storage class is used to store your backups. You can change the storage class to use for backups by modifying the AWS Backint agent configuration file. Alternatively, you can change your backup files to one of the supported storage classes through [S3 LifeCycle configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) or directly using APIs. To learn more about Amazon S3 storage classes, see [Amazon S3 Storage Classes](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) in the _Amazon S3 Developer Guide_. +**S3 storage classes** — AWS Backint agent supports backing up your SAP HANA database to an Amazon S3 bucket with the S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Intelligent-Tiering storage classes. S3 Reduced Redundancy, Deep Archive, and Glacier storage classes are not supported by AWS Backint agent. By default, the S3 Standard storage class is used to store your backups. You can change the storage class to use for backups by modifying the AWS Backint agent configuration file. Alternatively, you can change your backup files to one of the supported storage classes through [S3 LifeCycle configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) or directly using APIs. To learn more about Amazon S3 storage classes, see [Amazon S3 Storage Classes](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) in the _Amazon S3 Developer Guide_. @@ -119 +121,31 @@ S3 Intelligent-Tiering storage class enables movement of objects between four ac -**Encryption** \-- AWS Backint agent supports encrypting your SAP HANA backup files while storing them in Amazon S3, using server-side encryption with AWS KMS (KMS). You can encrypt your backups with a `aws-managed-key` called `aws/s3` or you can use your own custom symmetrical AWS KMS key stored in KMS. To encrypt your backup files with keys stored in KMS (AWS-managed or custom), you must provide the KMS ARN during the install, or update the AWS Backint agent configuration file at a later time. To learn more about encrypting your S3 objects using AWS KMS, see [How Amazon S3 uses AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html) in the _AWS Key Management Service Developer Guide_. Alternatively, you can enable default encryption for your Amazon S3 bucket using keys managed by Amazon S3. To learn more about enabling default encryption for your bucket, see [How do I enable default encryption for an Amazon S3 bucket?](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html) in the _Amazon S3 Console User Guide_. +**Encryption** — AWS Backint agent supports encrypting your SAP HANA backup files while storing them in Amazon S3, using server-side encryption with AWS KMS (KMS). You can encrypt your backups with a `aws-managed-key` called `aws/s3` or you can use your own custom symmetrical AWS KMS key stored in KMS. To encrypt your backup files with keys stored in KMS (AWS-managed or custom), you must provide the KMS ARN during the install, or update the AWS Backint agent configuration file at a later time. To learn more about encrypting your S3 objects using AWS KMS, see [How Amazon S3 uses AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html) in the _AWS Key Management Service Developer Guide_. Alternatively, you can enable default encryption for your Amazon S3 bucket using keys managed by Amazon S3. To learn more about enabling default encryption for your bucket, see [How do I enable default encryption for an Amazon S3 bucket?](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html) in the _Amazon S3 Console User Guide_. + +**Object locking** — You can store objects using a _write-once-read-many_ (WORM) model with S3 Object Lock. Use S3 Object Lock if you want to prevent your SAP HANA backup files from being accidentally deleted or overwritten for a specific time period or indefinitely. If S3 Object Lock is enabled, you can’t delete your SAP HANA backups stored in Amazon S3 using SAP HANA Cockpit, SAP HANA Studio, or SQL commands until the retention period expires. To learn about S3 Object Lock, see [Locking objects using S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html) in the _Amazon S3 Developer Guide_. + +**Object tagging** — By default, AWS Backint agent adds a tag called ` AWSBackintAgentVersion` when it stores your SAP HANA backup files in your S3 bucket. This tag helps to identify the AWS Backint version and the SAP HANA version used when backing up your SAP HANA database. You can [list the value of the tags from S3 console](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/view-object-properties.html) or [using APIs](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html). To disable default tagging, modify the AWS Backint agent configuration file. + +### Data perimeter + +Service Control Policies (SCPs) may be used to control on an organization level which external S3 buckets may be used. The Backint Agent needs to be installed in your EC2 instance. In order to download it, you may want to access the official AWS S3 bucket where the installer binary is located from your EC2 instance. If you are using SCPs in your organization to prevent unintended access to external S3 buckets, it may be necessary to add a policy that explicitly allows access to the official AWS S3 bucket. The following example shows a Service Control Policy that is maintained in AWS Organizations and attached to a member account. It prevents all access to external S3 buckets and only allows specified S3 buckets. + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "EnforceResourcePerimeterAWSResources", + "Effect": "Deny", + "Action": "*", + "NotResource": [ + "arn:aws:s3:::awssap-backint-agent", + "arn:aws:s3:::awssap-backint-agent/*" + ], + "Condition": { + "StringNotEqualsIfExists": { + "aws:ResourceOrgID": "<organization id>", + "aws:PrincipalTag/dp:exclude:resource": "true" + } + } + } + ] + } @@ -121 +153,23 @@ S3 Intelligent-Tiering storage class enables movement of objects between four ac -**Object locking** \-- You can store objects using a _write-once-read-many_ (WORM) model with S3 Object Lock. Use S3 Object Lock if you want to prevent your SAP HANA backup files from being accidentally deleted or overwritten for a specific time period or indefinitely. If S3 Object Lock is enabled, you can’t delete your SAP HANA backups stored in Amazon S3 using SAP HANA Cockpit, SAP HANA Studio, or SQL commands until the retention period expires. To learn about S3 Object Lock, see [Locking objects using S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html) in the _Amazon S3 Developer Guide_. +This policy denies access to all external S3 buckets that are not explicitly listed. Replace the placeholder with your Organization ID. This ID is in the form "o-<id>" where <id> is a 10 digit number. + +To allow S3 requests to traverse through an S3 VPC endpoint, a corresponding policy is required. Here is an example: + + + { + "Version":"2012-10-17", + "Statement": [ + { + "Sid": "AllowRequestsToAWSOwnedResources", + "Effect": "Allow", + "Principal": "*", + "Action": [ + "s3:GetObject", + "s3:ListBucket" + ], + "Resource": [ + "arn:aws:s3:::awssap-backint-agent", + "arn:aws:s3:::awssap-backint-agent/*" + ] + } + ] + } @@ -123 +177 @@ S3 Intelligent-Tiering storage class enables movement of objects between four ac -**Object tagging** \-- By default, AWS Backint agent adds a tag called ` AWSBackintAgentVersion` when it stores your SAP HANA backup files in your S3 bucket. This tag helps to identify the AWS Backint version and the SAP HANA version used when backing up your SAP HANA database. You can [list the value of the tags from S3 console](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/view-object-properties.html) or [using APIs](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html). To disable default tagging, modify the AWS Backint agent configuration file. +For AWS GovCloud, replace the bucket name with s3://awssap-backint-agent-us-gov-east-1 or s3://awssap-backint-agent-us-gov-west-1.