This blog post contains all the SAP and AWS related technical Snapshots and settings which can be used for configuring HANA Database backup on SUSE Linux Enterprise Server 15 SP2. Operations described in the document are performed when SAP HANA Database is deployed on AWS. SAP has provided several notes which support SAP products on AWS:-
This blog post mostly concentrate on the information about installation and configurations of AWS Backint Agent and related changes that needs to be done on HANA databases for backuping up the database directly on Amazon S3 Bucket.
AWS provides SAP-certified cloud infrastructure for running SAP HANA. AWS and SAP have worked together closely so that companies can fully realize all the benefits of the SAP HANA in-memory computing platform on AWS. SAP HANA can be deployed on either SUSE Linux Enterprise Server (SLES) or Red Hat Enterprise Linux (RHEL).
AWS Backint Agent for SAP HANA (AWS Backint Agent) is an SAP-certified backup and restore application for SAP HANA workloads running on Amazon EC2 instances in the cloud. This Agent runs as a standalone application runs on SAP HANA Server that integrates with the existing workflows to back up SAP HANA databases to Amazon S3 Buckets and to restore it using SAP HANA Cockpit, SAP HANA Studio, and SQL commands. AWS Backint Agent supports full, incremental, and differential backup of SAP HANA databases. Additionally, backup of log files and catalogs can be done directly to Amazon S3. To restore SAP HANA database server, SAP HANA reads the catalog files stored in S3 bucket using the AWS Backint Agent and then initiates a request to restore the required files directly from S3.
SAP has provided support process for AWS Backint Agent 2920965 - Support Process for AWS Backint Agent
AWS Backint Agent can be deployed to SAP HANA instances from the AWS Systems Manager (SSM) console. From the AWS SSM console, an AWS SSM document is executed on the instances to install this agent. Parameterized configuration information can be provided to the SSM document. This agent can also be downloaded and installed manually. AWS Backint Agent increases scalability through parallel processing of backup and restore processes, providing maximum throughput and reducing backup Recovery Time Objective (RTO) during recovery.
AWS Backint Agent is a free service provided by AWS. One only need to pay for the underlying AWS services as per the usage, for example Amazon S3.
With respect to support of AWS Backint Agent we have the following:
AWS Backint Agent is supported on the following operating systems:
AWS Backint Agent supports the following databases:
AWS Backint Agent is available in all commercial Regions, as well as in China (Beijing), China (Ningxia), and GovCloud.
When SAP HANA system is successfully running on an Amazon EC2 instance, Need to verify the following prerequisites:
AWS Systems Manager need access to AWS resources to install AWS Backint Agent, for this managed policy AmazonSSMManagedInstanceCore needs to be attached to the IAM role.
This role is not required in case need to install manually using AWS Backint installer
To allow Amazon EC2 instance on which SAP is HANA installed to access target Amazon S3 bucket, an inline IAM policy needs to be created or updated with the attached permissions using below steps: -
Got IAM in AWS Console and click on Create Role
Specify the AWS resource for which role needs to be created i.e. EC2 and Click on Next: Permission
Click on Create Policy
Click on Json
Paste the below policy and replace the required fields and Click on Review Policy
Make sure if policies are correct in next screen
Specify the Name of the Policy and Description and click Create Policy
Select newly created Policy to Role and Click Next: Tags
Specify the tags (If any) then click on Next: Review
To attach this role to HANA instance, Goto EC2 → Instances and then select the HANA instance. Then click on Actions → Security → Modify IAM role
Select role S3BucketAccess and Click Save
To install the AWS Backint Agent with the Amazon EC2 Systems Manager Agent (SSM) document, Amazon EC2 Systems Manager Agent (SSM Agent) version 2.3.274.0 or later needs to be installed, and instance must be a managed instance that is configured for AWS Systems Manager. This is not required in case of manual installation using AWS Backint Installer from OS level.
Version of SSM can be checked by going to Systems Manager → Managed Instances
AWS Backint Agent supports backing up SAP HANA database to an Amazon S3 bucket with the S3 Standard, S3 Standard-IA, and S3 One Zone-IA storage classes. Others S3 storage classes such as S3 Reduced Redundancy, S3 Intelligent-Tiering, Deep Archive, and Glacier are not supported by AWS Backint Agent. By default, the S3 Standard storage class is used to store your backups.
For Creating the S3 Bucket, Goto S3 and click on Create Bucket
Name of the S3 bucket needs to be specified where SAP HANA backups will be stored.
Make sure that the Amazon S3 bucket where backups are getting stored, doesn’t have public access enabled. If the S3 bucket has public access enabled, backups will fail.
Specify the Bucket Versioning and Tags as per the requirement
Backups must be encrypted, so it is good to specify the encryption settings as per the requirement
Write-once-read-many (WORM) model can be used for storing log/data files with S3 Object Lock, specify the required option and then click on Create Bucket
Please note if S3 Object Lock is enabled, then SAP HANA Cockpit can't delete SAP HANA backups stored in Amazon S3 until the retention period of the particular file expires.
Bucket has been created:
Please note Amazon S3 buckets created after May 2019 are compatible with AWS Backint Agent. Need to create new S3 Bucket if not available.
AWS Backint Agent also supports backing up to Amazon S3 with VPC endpoints.
- 1656250 - SAP on AWS: Support prerequisites
- 1656099 - SAP Applications on AWS: Supported DB/OS and AWS EC2 products
This blog post mostly concentrate on the information about installation and configurations of AWS Backint Agent and related changes that needs to be done on HANA databases for backuping up the database directly on Amazon S3 Bucket.
1. SAP HANA BACKUP ON AWS
AWS provides SAP-certified cloud infrastructure for running SAP HANA. AWS and SAP have worked together closely so that companies can fully realize all the benefits of the SAP HANA in-memory computing platform on AWS. SAP HANA can be deployed on either SUSE Linux Enterprise Server (SLES) or Red Hat Enterprise Linux (RHEL).
1.1 AWS Backint Agent for SAP HANA
AWS Backint Agent for SAP HANA (AWS Backint Agent) is an SAP-certified backup and restore application for SAP HANA workloads running on Amazon EC2 instances in the cloud. This Agent runs as a standalone application runs on SAP HANA Server that integrates with the existing workflows to back up SAP HANA databases to Amazon S3 Buckets and to restore it using SAP HANA Cockpit, SAP HANA Studio, and SQL commands. AWS Backint Agent supports full, incremental, and differential backup of SAP HANA databases. Additionally, backup of log files and catalogs can be done directly to Amazon S3. To restore SAP HANA database server, SAP HANA reads the catalog files stored in S3 bucket using the AWS Backint Agent and then initiates a request to restore the required files directly from S3.
SAP has provided support process for AWS Backint Agent 2920965 - Support Process for AWS Backint Agent
1.2 Mechanism of AWS Backint Agent
AWS Backint Agent can be deployed to SAP HANA instances from the AWS Systems Manager (SSM) console. From the AWS SSM console, an AWS SSM document is executed on the instances to install this agent. Parameterized configuration information can be provided to the SSM document. This agent can also be downloaded and installed manually. AWS Backint Agent increases scalability through parallel processing of backup and restore processes, providing maximum throughput and reducing backup Recovery Time Objective (RTO) during recovery.
1.3 Cost
AWS Backint Agent is a free service provided by AWS. One only need to pay for the underlying AWS services as per the usage, for example Amazon S3.
1.4 Support
With respect to support of AWS Backint Agent we have the following:
1.4.1 Operating System
AWS Backint Agent is supported on the following operating systems:
- SUSE Linux Enterprise Server
- SUSE Linux Enterprise Server for SAP
- Red Hat Enterprise Linux for SAP
1.4.2 Databases
AWS Backint Agent supports the following databases:
- SAP HANA 1.0 SP12 (single node and multi node)
- SAP HANA 2.0 and later (single node and multi node)
1.4.3 Regions
AWS Backint Agent is available in all commercial Regions, as well as in China (Beijing), China (Ningxia), and GovCloud.
2. PREREQUISITES
When SAP HANA system is successfully running on an Amazon EC2 instance, Need to verify the following prerequisites:
2.1 AWS Identity and Access Management
2.1.1 Role for AWS SSM
AWS Systems Manager need access to AWS resources to install AWS Backint Agent, for this managed policy AmazonSSMManagedInstanceCore needs to be attached to the IAM role.
This role is not required in case need to install manually using AWS Backint installer
2.1.2 Role for AWS EC2
To allow Amazon EC2 instance on which SAP is HANA installed to access target Amazon S3 bucket, an inline IAM policy needs to be created or updated with the attached permissions using below steps: -
Got IAM in AWS Console and click on Create Role
AWS IAM Console
Specify the AWS resource for which role needs to be created i.e. EC2 and Click on Next: Permission
AWS IAM Console
Click on Create Policy
AWS IAM Console
Click on Json
AWS IAM Console
Paste the below policy and replace the required fields and Click on Review Policy
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:GetBucketPolicyStatus",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:GetBucketAcl",
"s3:GetBucketPolicy"
],
"Resource": [
"arn:aws:s3:::<Bucket Name>/*",
"arn:aws:s3:::<Bucket Name>"
]
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "<KMS Arn>"
},
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:PutObjectTagging",
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::<bucket name>/<folder name>/*"
}
]
}AWS IAM Console
Make sure if policies are correct in next screen
AWS IAM Console
Specify the Name of the Policy and Description and click Create Policy
AWS IAM Console
Select newly created Policy to Role and Click Next: Tags
AWS IAM Console
Specify the tags (If any) then click on Next: Review
AWS IAM Console
AWS IAM Console
To attach this role to HANA instance, Goto EC2 → Instances and then select the HANA instance. Then click on Actions → Security → Modify IAM role
AWS EC2 Console
Select role S3BucketAccess and Click Save
AWS EC2 Console
2.2 AWS Systems Manager
To install the AWS Backint Agent with the Amazon EC2 Systems Manager Agent (SSM) document, Amazon EC2 Systems Manager Agent (SSM Agent) version 2.3.274.0 or later needs to be installed, and instance must be a managed instance that is configured for AWS Systems Manager. This is not required in case of manual installation using AWS Backint Installer from OS level.
Version of SSM can be checked by going to Systems Manager → Managed Instances
AWS Systems Manager
2.3 AWS S3 Bucket
AWS Backint Agent supports backing up SAP HANA database to an Amazon S3 bucket with the S3 Standard, S3 Standard-IA, and S3 One Zone-IA storage classes. Others S3 storage classes such as S3 Reduced Redundancy, S3 Intelligent-Tiering, Deep Archive, and Glacier are not supported by AWS Backint Agent. By default, the S3 Standard storage class is used to store your backups.
For Creating the S3 Bucket, Goto S3 and click on Create Bucket
AWS S3 Console
Name of the S3 bucket needs to be specified where SAP HANA backups will be stored.
AWS S3 Console
Make sure that the Amazon S3 bucket where backups are getting stored, doesn’t have public access enabled. If the S3 bucket has public access enabled, backups will fail.
AWS S3 Console
Specify the Bucket Versioning and Tags as per the requirement
AWS S3 Console
Backups must be encrypted, so it is good to specify the encryption settings as per the requirement
AWS S3 Console
Write-once-read-many (WORM) model can be used for storing log/data files with S3 Object Lock, specify the required option and then click on Create Bucket
Please note if S3 Object Lock is enabled, then SAP HANA Cockpit can't delete SAP HANA backups stored in Amazon S3 until the retention period of the particular file expires.
AWS S3 Console
Bucket has been created:
AWS S3 Console
Please note Amazon S3 buckets created after May 2019 are compatible with AWS Backint Agent. Need to create new S3 Bucket if not available.
AWS Backint Agent also supports backing up to Amazon S3 with VPC endpoints.
This is end of Part - I, in next part of this blog post Backup and Recovery of SAP HANA Database Directly to AWS S3 Bucket using AWS Backint Agent – Part II you can find more information about Installation, Configuration and Verification of the AWS Backint Agent
- SAP Managed Tags:
1 Comment
