AWS sap medium security documentation change
Summary
Expanded connectivity options documentation with bandwidth details, VPN over Direct Connect encryption, Cloud WAN support, and Landing Zone recommendations
Security assessment
Added explicit mention of VPN over Direct Connect providing 'in-built traffic encryption' and emphasized 'dedicated private connectivity (security, performance)'. This documents security features for protecting data in transit.
Diff
diff --git a/sap/latest/general/rise-decision-tree.md b/sap/latest/general/rise-decision-tree.md index 9aadcef65..8d6c3e796 100644 --- a//sap/latest/general/rise-decision-tree.md +++ b//sap/latest/general/rise-decision-tree.md @@ -11 +11,5 @@ You must establish required connectivity to proceed with RISE with SAP on AWS. T - * direct to RISE VPC, supported with Site-to-Site VPN + * direct to RISE VPC, supported with Site-to-Site VPN (up to 1.25 Gbps per tunnel) + + * connectivity through Customer’s own account or Landing Zone, supported with Site-to-Site VPN large bandwidth option (up to 5 Gbps) + + * connectivity through Customer’s own account or Landing Zone, supported with Site-to-Site VPN large bandwidth option and ECMP (above 5 Gbps) @@ -14,0 +19,2 @@ You must establish required connectivity to proceed with RISE with SAP on AWS. T + * direct to RISE VPC, supported with VPN over Direct Connect (for in-built traffic encryption) + @@ -17 +23 @@ You must establish required connectivity to proceed with RISE with SAP on AWS. T - * connectivity through Transit Gateway, supporting multi-account deployments + * connectivity through Transit Gateway from your owned AWS account in the same Region @@ -19 +25,3 @@ You must establish required connectivity to proceed with RISE with SAP on AWS. T - * connectivity through SAP-managed Transit Gateway supporting multi-account deployments + * connectivity through SAP-managed Transit Gateway in RISE to connect to your TGW in another Region + + * connectivity through AWS Cloud WAN from your owned AWS account for global multi-region deployments @@ -33 +41 @@ You must also consider if you want to connect: -The decision tree displayed in the following diagram helps you decide which connectivity is suitable based on your requirements, such as future plan of additional AWS or RISE accounts, dedicated line (security, performance), and bandwidth needs. +The decision tree displayed in the following diagram helps you decide which connectivity is suitable based on your requirements, such as future plan of additional AWS or RISE accounts, dedicated private connectivity (security, performance), bandwidth needs, and global multi-region deployments. @@ -35 +43 @@ The decision tree displayed in the following diagram helps you decide which conn - + @@ -37 +45 @@ The decision tree displayed in the following diagram helps you decide which conn -Note: +NOTE: @@ -42,0 +51,4 @@ Note: + 3. AWS Cloud WAN is recommended for customers planning global multi-region deployments from their owned AWS account to connect to RISE VPC. + + 4. Landing Zone implementation is recommended when connecting through your owned AWS account with multiple VPCs. +