Sap Btp Cloud Platform

SAP BTP Cloud Platform

Related Skills

• sap-btp-best-practices: Use for architectural best practices, account setup guidance, and production deployment patterns
• sap-cap-capire: Use for CAP application development on BTP Cloud Foundry or Kyma environments
• sap-fiori-tools: Use for deploying Fiori applications to BTP or configuring BTP destinations
• sap-ai-core: Use when implementing AI/ML workloads on BTP or setting up AI services
• sap-abap: Use when working with ABAP Environment on BTP or extending S/4HANA Cloud
• sap-btp-connectivity: Use for setting up secure connections to on-premise systems via Cloud Connector
• sap-btp-service-manager: Use for programmatic service instance management on BTP

When to Use This Skill

Use this skill when setting up or operating SAP BTP accounts, directories, subaccounts, Cloud Foundry, Kyma, ABAP Environment, entitlements, quotas, role collections, CLI tooling, MTA deployments, connectivity, CI/CD, extensions, or platform troubleshooting.

Quick Start

1. Identify the target commercial account type, region, and subaccount. 2. Enable the runtime environment: Cloud Foundry, Kyma, ABAP Environment, or trial/free tier. 3. Configure identity, roles, entitlements, and quotas before deploying workloads. 4. Use btp and cf CLI examples in Tools for repeatable setup. 5. Switch to related skills for implementation depth: sap-cap-capire, sap-fiori-tools, sap-btp-connectivity, or sap-btp-service-manager.

Comprehensive reference for SAP Business Technology Platform covering all runtime environments, account management, security, and operations.

Documentation Source: https://github.com/SAP-docs/sap-btp-cloud-platform SAP Help Portal: https://help.sap.com/docs/btp SAP Discovery Center: https://discovery-center.cloud.sap/

Table of Contents

• 1. Platform Overview
• 2. Account Model
• 3. Environments
• 4. Commercial Models
• 5. Entitlements and Quotas
• 6. Regions and Infrastructure
• 7. User Management
• 8. Tools
• 9. Security Essentials
• 10. Connectivity
• 11. Development Patterns
• 12. CI/CD
• 13. Extensions
• 14. High Availability and Resilience
• 15. Operations and Monitoring
• 16. Support
• Bundled Resources
• Source Documentation

1. Platform Overview

SAP BTP integrates five technology portfolios: Application Development, Process Automation, Integration, Data & Analytics, and AI. Provides suite qualities: SAP Fiori UX, Cloud Identity Services, Master Data Integration, embedded analytics, SAP Task Center, and SAP Cloud ALM.

---

2. Account Model

Hierarchy

Global Account → Directory (optional) → Subaccount (region-specific)
                                    ↓ CF: Org → Spaces
                                    ↓ Kyma: Cluster → Namespaces
                                    ↓ ABAP: System instance

Key Entities

• Global Account: Contract with SAP, region-independent, manages entitlements
• Directory: Organizational container, up to 7 levels, optional entitlement management
• Subaccount: Region-specific deployment target hosting apps and services
• Labels: Metadata tags (up to 10 values per label)

Account Types

• Trial: 90-day free exploration (4GB memory, 10 routes, 40 services, daily stops)
• Enterprise: Production use based on commercial contract
• Free Tier: Long-term testing with service-specific limits, no SLA

---

3. Environments

SAP BTP offers four runtime environments at the subaccount level:

Cloud Foundry Environment

Open PaaS with polyglot support. Features: multiple buildpacks (Java, Node.js, Python, Go, PHP), spaces for separation, auto-scaling, SAP HANA integration.

cf login -a https://api.cf.<region>.hana.ondemand.com
cf push my-app
cf bind-service my-app my-service-instance

Structure: Subaccount → Org (1:1) → Spaces

Kyma Environment

Managed Kubernetes runtime based on open-source Kyma.

• Default Modules: istio (service mesh), api-gateway, btp-operator
• Optional Modules: serverless, eventing, application-connector, telemetry, keda

Structure: Subaccount → Cluster (1:1) → Namespaces

ABAP Environment

Cloud ABAP development with RAP, CDS, SAP Fiori integration, ADT, 1:1 SAP HANA database per system. Use Cases: Extend S/4HANA Cloud, build new cloud applications, transform ABAP custom code

Neo Environment

Status: Sunsetting December 31, 2028. Recommendation: Migrate to CF/Kyma.

---

4. Commercial Models

Consumption-Based

Access all eligible services with flexible usage. Flavors: SAP BTPEA, CPEA, Pay-As-You-Go. Benefits: Switch services on/off, access current and future services.

Subscription-Based

Fixed cost for selected services, pay irrespective of consumption. Additional services require contract modification.

Best Practice: Use consumption-based for pilots, subscription for stable workloads.

5. Entitlements and Quotas

Definitions

• Entitlement: Right to provision and consume a service plan
• Quota: Numeric quantity of consumption allowed
• Service Plan: Variant of a service (e.g., t-shirt sizes)

Quota Types

• Fixed: Upper limit (subscription model)
• Unlimited: No limit, billed by usage (consumption model)

Distribution Flow

Global Account → Directory (reserves) → Subaccount (consumes) → CF Space (optional)

---

6. Regions and Infrastructure

Region Providers

Key Considerations

• Each subaccount assigned to exactly one region
• Multi-region requires separate deployments
• EU Access available in specific regions for compliance
• API endpoints vary by region instance

Availability Zones

Multi-AZ deployment for high availability:

• Isolated power, network, cooling
• Automatic failover within region
• Both CF and Kyma support multi-AZ

---

7. User Management

User Types

Identity Providers

Authorization Flow

Identity Provider
    ↓
SAP BTP (Shadow Users)
    ↓
Role Collections
    ↓
Application/Service Access

---

8. Tools

Key Tools Overview

• Administration: SAP BTP Cockpit (web), btp CLI (automation), REST APIs, Terraform, SAP Automation Pilot
• Development: SAP Business Application Studio (VS Code-based), SAP Build (low-code), SAP Cloud SDK (Java/JS), ADT for Eclipse (ABAP)
• Kubernetes/Kyma: kubectl, kubelogin (OIDC), Helm, Pack (buildpacks), Docker Desktop

Essential CLI Commands

# btp CLI
btp login --url https://cpcli.cf.<region>.hana.ondemand.com
btp list accounts/subaccount
btp create accounts/subaccount --display-name "Dev"
btp assign security/role-collection "Subaccount Administrator" --to-user user@example.com

# CF CLI
cf login -a https://api.cf.<region>.hana.ondemand.com
cf target -o my-org -s my-space
cf push my-app
cf bind-service my-app my-service

# kubectl
kubectl get pods -n my-namespace
kubectl apply -f deployment.yaml
kubectl logs -f deployment/my-app

---

9. Security Essentials

Authentication

Recommended: Corporate IdP → SAP Cloud Identity Services → SAP BTP

XSUAA provides OAuth 2.0 authorization, role-based access control, and application security descriptors (xs-security.json).

Trust Configuration

1. Configure Identity Authentication tenant 2. Establish trust in subaccount 3. Map role collections to IdP groups 4. Assign users via role collections

Best Practices

• Use TLS 1.2+ (mandatory)
• Enable MFA for administrators
• Maintain backup administrators in default IdP
• Use provisioning over federation for production
• Implement audit logging

10. Connectivity

Destinations

Connect to remote systems without hardcoding URLs. Key authentication methods:

• NoAuthentication (public APIs)
• OAuth2ClientCredentials (service-to-service)
• OAuth2SAMLBearerAssertion (user propagation)
• PrincipalPropagation (on-premise with Cloud Connector)

Cloud Connector

Secure tunnel for on-premise connectivity with no inbound firewall ports, fine-grained access control, RFC/HTTP support, and principal propagation.

---

11. Development Patterns

Programming Models

• CAP: Java/Node.js/TypeScript for enterprise services, domain-driven development
• ABAP Cloud: Cloud-ready ABAP with RAP

Multi-Target Applications (MTA)

Package multiple modules for deployment. Core structure includes modules (app types: nodejs, html5) and resources (services like hana).

Application Router

Single entry point providing static content serving, user authentication, URL rewriting, and request forwarding to microservices.

12. CI/CD

SAP Continuous Integration and Delivery

Managed service supporting Cloud Foundry apps (Fiori, CAP), SAP Fiori for ABAP Platform, and SAP Integration Suite artifacts.

Pipeline Setup

1. Activate service in BTP cockpit 2. Assign Administrator/Developer roles 3. Configure repository credentials 4. Add code repository (GitHub, GitLab, Bitbucket, Azure Repos) 5. Create and configure CI/CD jobs

Delivery Options

• CI/CD: Java/HTML5/CAP, Kyma apps (Cloud Integration in development)
• Cloud Transport Mgmt: Java/HTML5/CAP, Cloud Integration, SAP Build Work Zone

---

13. Extensions

Extension Architecture

Build loosely coupled extensions: SAP Solution → APIs & Events → SAP BTP Extension → Custom Business Logic

System Registration

1. Register systems in global account 2. Create formations (logical groupings) 3. Enable API/event exchange 4. Deploy extensions

Supported Solutions

• Cloud Foundry: S/4HANA Cloud, Marketing Cloud, SuccessFactors
• Kyma: Above + Commerce Cloud, Field Service Management

14. High Availability and Resilience

Resilience Strategies

• Multi-AZ: Deploy across availability zones
• Multi-Region: Deploy across geographic regions
• In-Metro DR: Synchronous replication within region

Failover Implementation

1. Deploy in two data centers 2. Keep applications synchronized (CI/CD) 3. Define failover detection (5xx errors, timeouts) 4. Plan failback procedure

SLAs

• RPO: Maximum 5 minutes data loss
• RTO: Service restoration within 2 hours

15. Operations and Monitoring

Key Tools

• SAP Cloud ALM: Real user and health monitoring
• SAP Cloud Logging: Observability across CF, Kyma
• SAP Alert Notification: Multi-channel notifications
• Audit Log Viewer: Activity tracking

Best Practices

• Deploy multiple application instances
• Implement Application Autoscaler
• Use blue-green deployment for updates
• Set up automated alerting
• Regular compliance verification

---

16. Support

Getting Support

• SAP for Me: https://me.sap.com/
• SAP Community: https://community.sap.com/
• Support Components: BC-CP-* (component codes)

Operating Model

• SAP manages: Platform software updates, infrastructure monitoring, BTP service monitoring, global account provisioning
• You manage: Account strategy, application development and security, role assignments and integrations, application monitoring

Bundled Resources

Reference Documentation

For detailed guidance, see the 13 reference files:

• references/glossary.md - Complete terminology (40+ terms)
• references/cloud-foundry.md - CF development and administration
• references/kyma.md - Kyma runtime and Kubernetes patterns
• references/abap.md - ABAP environment, RAP, CDS
• references/security.md - Authentication, authorization, identity
• references/connectivity.md - Destinations, Cloud Connector
• references/development.md - Development patterns, MTA, Application Router
• references/administration.md - Account management, btp CLI
• references/operations.md - Monitoring, alerting, logging
• references/extensions.md - SAP solution extensions, formations
• references/tools.md - CLI references, development tools
• references/troubleshooting.md - Common issues and solutions
• references/regions-endpoints.md - Region-specific API endpoints

Source Documentation

• https://github.com/SAP-docs/sap-btp-cloud-platform
• https://help.sap.com/docs/btp
• https://discovery-center.cloud.sap/

Last Verified: 2025-11-27

SAP BTP Cloud Platform Skill

Comprehensive SAP Business Technology Platform reference for cloud development, deployment, and operations.

Capability Index

Overview

This skill provides documentation-audited guidance for SAP BTP, covering the three runtime environments (Cloud Foundry, Kyma, ABAP), account management, security, connectivity, and operations. Its last_verified date is stale until BTP account, entitlement, and primary-source checks are refreshed.

When to Use This Skill

Use this skill when:

• Setting up BTP accounts: Global accounts, directories, subaccounts, entitlements
• Working with Cloud Foundry: Orgs, spaces, buildpacks, service bindings, CF CLI
• Deploying to Kyma: Kubernetes, modules, serverless functions, Helm charts
• Developing in ABAP environment: RAP, CDS, ADT, Fiori integration
• Managing entitlements and quotas: Commercial models, service plans
• Configuring identity providers: SAP Cloud Identity Services, XSUAA, trust
• Implementing authentication/authorization: Role collections, trust configuration
• Using BTP tools: btp CLI, CF CLI, kubectl, Terraform
• Deploying multi-target applications: MTA structure, deployment
• Setting up connectivity: Destinations, Cloud Connector, principal propagation
• Implementing CI/CD: SAP Continuous Integration and Delivery, pipelines
• Extending SAP solutions: S/4HANA Cloud, SuccessFactors, formations
• Troubleshooting BTP services: Common issues, error resolution

Keywords

SAP BTP, SAP Business Technology Platform, Cloud Foundry, CF, Kyma, ABAP environment, subaccount, global account, directory, entitlements, quotas, btp CLI, CF CLI, MTA, multi-target application, XSUAA, SAP Authorization and Trust Management, Cloud Identity Services, Identity Authentication, destinations, Cloud Connector, service binding, buildpack, Kubernetes, serverless, RAP, CDS, CAP, SAP Cloud Application Programming Model, CI/CD, SAP Continuous Integration and Delivery, extensions, formations, trial account, free tier, enterprise account, consumption-based, subscription-based, CPEA, BTPEA, regions, availability zones, high availability, disaster recovery, audit logging, role collections, platform users, business users, Neo environment, service broker, space, org, namespace, Helm, Docker, Istio, API Gateway, Eventing, create subaccount, deploy application, configure trust, bind service, scale application, deploy MTA, create destination, setup Cloud Connector, configure XSUAA, assign role collection

Source Documentation

• Main Repository: https://github.com/SAP-docs/sap-btp-cloud-platform
• SAP Help Portal: https://help.sap.com/docs/btp
• SAP Discovery Center: https://discovery-center.cloud.sap/
• BTP Best Practices: https://github.com/SAP-docs/btp-best-practices-guide

Skill Structure

sap-btp-cloud-platform/
├── SKILL.md              # Main skill content (336 lines, optimized)
├── README.md             # This file
└── references/           # 13 comprehensive reference files
    ├── glossary.md           # Complete terminology (40+ terms)
    ├── cloud-foundry.md      # CF environment, CLI, buildpacks
    ├── kyma.md               # Kyma modules, Kubernetes, serverless
    ├── abap.md               # ABAP environment, RAP, CDS, ADT
    ├── security.md           # Authentication, XSUAA, role collections
    ├── connectivity.md       # Destinations, Cloud Connector
    ├── development.md        # MTA, CAP, Application Router, CI/CD
    ├── tools.md              # btp CLI, CF CLI, kubectl, Terraform
    ├── extensions.md         # S/4HANA, SuccessFactors, formations
    ├── administration.md     # Account management, entitlements
    ├── operations.md         # Monitoring, logging, alerting, health
    ├── regions-endpoints.md  # All regions and API endpoints
    └── troubleshooting.md    # Common issues and solutions

Coverage

This skill extracts and organizes content from 1683 documentation files in the official SAP BTP documentation repository, with 13 reference files totaling 7,000+ lines:

Token Efficiency

Maintenance

• Last Verified: 2025-11-27
• Next Review: 2026-02-27 (Quarterly)

Related Skills

• sap-btp-best-practices - Enterprise architecture and governance
• sap-cap - Cloud Application Programming Model development
• btp-cloud-transport-management - Transport and deployment management
• btp-job-scheduling - Job scheduling service
• btp-service-manager - Service instance management

License

GPL-3.0

ABAP Environment Reference

Complete guidance for SAP BTP ABAP environment development and administration.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/10-concepts

---

Table of Contents

1. ABAP Environment Overview 2. Service Plans and Metering 3. System Creation 4. Development Tools 5. Programming Model 6. Communication Management 7. Lifecycle Management 8. Integration

---

ABAP Environment Overview

The ABAP environment enables cloud ABAP development on SAP BTP.

Key Features

• Latest ABAP platform cloud release
• SAP HANA database (1:1 per system)
• ABAP RESTful Application Programming Model (RAP)
• Core Data Services (CDS)
• SAP Fiori integration
• Released objects approach for APIs

Use Cases

Architecture

ABAP System Instance
├── ABAP Runtime (Memory: ABAP Compute Units)
├── SAP HANA Database (Storage: HANA Compute Units)
├── Fiori Launchpad
└── Web Access (ADT, Launchpad)

---

Service Plans and Metering

Service Plans

Compute Units

ABAP Compute Unit (ACU):

• Configures runtime memory
• Measured in 16 GB blocks
• Volatile memory for application execution
• Billed hourly

HANA Compute Unit (HCU):

• Configures persistent storage
• Measured in 16 GB blocks
• Retains data after restart
• Billed hourly

Entitlement Requirements

For standard plan, assign all three: 1. abap service with standard plan 2. abap_compute_unit with quantity 3. hana_compute_unit with quantity

Minimum Configuration

Free Plan Limitations

• Auto-stops every night
• Manual restart via Landscape Portal
• Community support only
• No SLA
• Limited resources

---

System Creation

Prerequisites

1. Subaccount with Cloud Foundry enabled 2. ABAP environment entitlements assigned 3. Space created

Create via BTP Cockpit

1. Navigate to Subaccount > Cloud Foundry > Spaces 2. Open target space 3. Click SAP HANA Cloud or Service Marketplace 4. Find ABAP environment 5. Create instance with parameters:

{
  "admin_email": "admin@example.com",
  "description": "Development System",
  "is_development_allowed": true,
  "sapsystemname": "DEV",
  "size_of_runtime": 1,
  "size_of_persistence": 4
}

Create via CF CLI

cf create-service abap standard my-abap-system -c '{
  "admin_email": "admin@example.com",
  "description": "Development System",
  "is_development_allowed": true,
  "sapsystemname": "DEV",
  "size_of_runtime": 1,
  "size_of_persistence": 4
}'

System Parameters

---

Development Tools

ABAP Development Tools (ADT)

Eclipse-based IDE for ABAP development:

1. Install Eclipse (latest supported version) 2. Install ADT plugin from SAP update site 3. Connect to ABAP system

ADT Update Site: https://tools.hana.ondemand.com/latest

ADT Features

• ABAP Editor with code completion
• CDS Editor
• Debugger
• Unit Test Runner
• Transport Management
• Git Integration (abapGit)

Connecting ADT

1. File > New > ABAP Cloud Project 2. Select SAP BTP, ABAP Environment 3. Enter service key or use browser login 4. Select system and log in

Service Key for ADT

cf create-service-key my-abap-system my-key
cf service-key my-abap-system my-key

Web Access

---

Programming Model

ABAP RESTful Application Programming Model (RAP)

Modern ABAP development approach:

CDS Data Model → Behavior Definition → Service Definition → Service Binding

CDS Data Model

@AccessControl.authorizationCheck: #CHECK
define root view entity ZI_Product
  as select from zproduct
{
  key product_id as ProductId,
      product_name as ProductName,
      @Semantics.amount.currencyCode: 'Currency'
      price as Price,
      currency as Currency
}

Behavior Definition

managed implementation in class zbp_i_product unique;
strict ( 2 );

define behavior for ZI_Product alias Product
persistent table zproduct
lock master
authorization master ( instance )
{
  create;
  update;
  delete;

  field ( readonly ) ProductId;
  field ( mandatory ) ProductName;

  validation validateProduct on save { create; update; }
  determination setDefaults on modify { create; }
}

Service Definition

@EndUserText.label: 'Product Service'
define service ZUI_PRODUCT {
  expose ZI_Product as Product;
}

Service Binding

Create via ADT: 1. Right-click service definition 2. New > Service Binding 3. Select binding type (OData V2/V4, UI) 4. Activate and publish

---

Communication Management

Communication Scenarios

Predefined integration patterns:

Communication Arrangement

Communication Scenario → Communication System → Communication User

Creating Outbound Communication

1. Create Communication System (target system details) 2. Create Outbound Communication User (credentials) 3. Create Communication Arrangement (link scenario + system)

HTTP Destination

DATA(lo_destination) = cl_http_destination_provider=>create_by_comm_arrangement(
  comm_scenario  = 'Z_MY_SCENARIO'
  service_id     = 'Z_MY_SERVICE'
).

DATA(lo_client) = cl_web_http_client_manager=>create_by_http_destination( lo_destination ).
DATA(lo_response) = lo_client->execute( if_web_http_client=>get ).

---

Lifecycle Management

Software Components

Git-based source code management:

Software Component (Git repo)
├── Package 1
│   ├── Classes
│   ├── CDS Views
│   └── Services
└── Package 2

Transport Management

Release and Import

1. Release transport request in source system 2. Export via gCTS or Cloud Transport Management 3. Import to target system

Landscape Configuration

Development → Test → Production
     ↓           ↓          ↓
   Clone      Import     Import

---

Integration

Integrated SAP BTP Services

Fiori Elements

Automatic UI generation from CDS annotations:

@UI.headerInfo: {
  typeName: 'Product',
  typeNamePlural: 'Products',
  title: { type: #STANDARD, value: 'ProductName' }
}
@UI.lineItem: [{ position: 10, label: 'Product ID' }]
@UI.identification: [{ position: 10 }]
ProductId,

---

Regions

Available Regions

Full list: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/regions-and-api-endpoints-for-the-abap-environment-879f373.md

---

Related Documentation

• ABAP Environment: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/abap-environment-11d6265.md
• Service Plans: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/service-plans-and-metering-for-sap-btp-abap-environment-b7f5a93.md
• Getting Started: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/20-getting-started/getting-started-in-the-abap-environment-2ffdd24.md
• SAP Help Portal: https://help.sap.com/docs/btp/sap-business-technology-platform/abap-environment

Administration Reference

Complete guidance for SAP BTP account administration and operations.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/50-administration-and-ops

---

Table of Contents

1. Account Administration 2. Entitlement Management 3. User and Role Management 4. Default Role Collections 5. Environment Management 6. Service Management 7. Monitoring and Logging 8. Backup and Recovery

---

Account Administration

Global Account Operations

# List subaccounts
btp list accounts/subaccount

# Get global account details
btp get accounts/global-account

# Update global account
btp update accounts/global-account --display-name "New Name"

Subaccount Operations

# Create subaccount
btp create accounts/subaccount \
  --display-name "Development" \
  --subdomain dev-acme \
  --region eu10 \
  --subaccount-admins admin@example.com

# Update subaccount
btp update accounts/subaccount <id> \
  --display-name "New Name" \
  --description "Updated description"

# Delete subaccount
btp delete accounts/subaccount <id>

# Move subaccount to directory
btp move accounts/subaccount <id> --to-directory <dir-id>

Directory Operations

# Create directory
btp create accounts/directory \
  --display-name "Business Unit A" \
  --directory-features ENTITLEMENTS,AUTHORIZATIONS

# List directories
btp list accounts/directory

# Delete directory
btp delete accounts/directory <id>

Labels

# Add label to subaccount
btp add accounts/label --subaccount <id> \
  --name "Environment" --value "Development"

# List labels
btp list accounts/label --subaccount <id>

# Remove label
btp remove accounts/label --subaccount <id> --name "Environment"

---

Entitlement Management

View Entitlements

# Global account entitlements
btp list accounts/entitlement

# Subaccount assignments
btp list accounts/entitlement --subaccount <id>

Assign Entitlements

# Assign to subaccount
btp assign accounts/entitlement \
  --to-subaccount <id> \
  --for-service hana-cloud \
  --plan hana \
  --amount 1

# Assign to directory
btp assign accounts/entitlement \
  --to-directory <id> \
  --for-service xsuaa \
  --plan application \
  --amount 10

Common Services to Assign

Note: Services marked "Selected regions only" require checking regional availability in BTP Cockpit

or SAP Discovery Center before assignment. Kyma/ABAP availability varies by IaaS provider and region.

---

User and Role Management

User Operations

# Assign user to role collection
btp assign security/role-collection "Subaccount Administrator" \
  --to-user user@example.com \
  --of-idp sap.ids

# Remove user from role collection
btp unassign security/role-collection "Subaccount Administrator" \
  --from-user user@example.com \
  --of-idp sap.ids

# List role collection assignments
btp list security/role-collection

Group Mapping

# Map IdP group to role collection
btp assign security/role-collection "Developers" \
  --to-group "BTP_Developers" \
  --of-idp my-corporate-idp

# Remove group mapping
btp unassign security/role-collection "Developers" \
  --from-group "BTP_Developers" \
  --of-idp my-corporate-idp

Trust Configuration

# List trust configurations
btp list security/trust

# Get trust details
btp get security/trust <idp-origin>

---

Default Role Collections

Global Account Level

Directory Level

Subaccount Level

Cloud Foundry Roles

---

Environment Management

Cloud Foundry

# Create CF environment
btp create accounts/environment-instance \
  --subaccount <id> \
  --environment cloudfoundry \
  --plan standard \
  --landscape eu10-004

# List environments
btp list accounts/environment-instance --subaccount <id>

# Delete environment
btp delete accounts/environment-instance <env-id> --subaccount <id>

Kyma

# Create Kyma environment
btp create accounts/environment-instance \
  --subaccount <id> \
  --environment kyma \
  --plan aws \
  --parameters '{"name":"my-kyma"}'

# Get Kyma kubeconfig
# Download from BTP Cockpit or use Kyma Dashboard

---

Service Management

Service Instances

# Discover available services and plans
cf marketplace

# CF CLI - Create service instance
cf create-service <service> <plan> <name> -c '<parameters>'

# CF CLI - List services
cf services

# CF CLI - Update service
cf update-service <name> -p <new-plan> -c '<parameters>'

# CF CLI - Delete service
cf delete-service <name>

Service Bindings

# Bind to app
cf bind-service <app> <service> -c '<parameters>'

# Create service key (for external access)
cf create-service-key <service> <key-name>

# View service key
cf service-key <service> <key-name>

Service Broker Management

# Register service broker
cf create-service-broker <name> <user> <password> <url>

# List brokers
cf service-brokers

# Delete broker
cf delete-service-broker <name>

---

Monitoring and Logging

SAP Cloud ALM

Integration for:

• Real User Monitoring
• Health Monitoring
• Integration Monitoring
• Exception Monitoring
• Job Automation Monitoring

Application Logging

# CF - View logs
cf logs <app> --recent
cf logs <app>  # tail

# Subscribe to Application Logging service
cf create-service application-logs lite my-logs
cf bind-service my-app my-logs

Audit Logging

Access via:

• SAP Audit Log Viewer Service (subscription)
• Audit Log Retrieval API

# API access
curl -X GET "https://auditlog.cf.<region>.hana.ondemand.com/v2/auditlogrecords" \
  -H "Authorization: Bearer <token>"

Alert Notification

Configure alerts for:

• Application events
• Service events
• Platform events

Channels:

• Email
• Slack
• ServiceNow
• SAP Cloud ALM

---

Backup and Recovery

SAP-Managed Backups

Customer Responsibilities

You must backup:

• Service configurations
• Destination settings
• Trust configurations
• Application configurations
• Custom code (Git repositories)

Kyma Backup

• Managed Kubernetes snapshots
• Excludes persistent volumes
• Use Velero for volume backups

Cloud Foundry Apps

• No built-in backup
• Keep code in external Git
• Export service configurations
• Document environment variables

---

Automation

Terraform Provider

provider "btp" {
  globalaccount = "my-global-account"
}

resource "btp_subaccount" "dev" {
  name      = "Development"
  subdomain = "dev-acme"
  region    = "eu10"
}

resource "btp_subaccount_entitlement" "cf" {
  subaccount_id = btp_subaccount.dev.id
  service_name  = "APPLICATION_RUNTIME"
  plan_name     = "MEMORY"
  amount        = 1
}

SAP Automation Pilot

Low-code automation for:

• Scheduled operations
• Event-triggered workflows
• Multi-step procedures

---

Related Documentation

• Administration: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/50-administration-and-ops
• btp CLI: https://help.sap.com/docs/btp/btp-cli-command-reference/btp-cli-command-reference
• Terraform: https://registry.terraform.io/providers/SAP/btp/latest/docs

Cloud Foundry Environment Reference

Detailed guidance for SAP BTP Cloud Foundry environment development and administration.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/10-concepts CF Docs: https://docs.cloudfoundry.org/

---

Table of Contents

1. Architecture 2. Account Structure 3. Buildpacks 4. Service Bindings 5. Application Deployment 6. CF CLI Commands 7. Space Management 8. Availability Zones

---

Architecture

Cloud Foundry in SAP BTP

• Open Platform-as-a-Service (PaaS)
• Polyglot application support
• SAP HANA extended application services integration
• Multiple buildpacks for language support
• Automatic scaling and load balancing

Hierarchy

Subaccount (1:1 with CF Org)
└── Organization (Org)
    ├── Space: Development
    │   ├── Applications
    │   └── Service Instances
    ├── Space: Testing
    └── Space: Production

---

Account Structure

Organizations (Orgs)

• Each CF subaccount contains exactly one org
• Org name derived from subaccount name
• Use for grouping related spaces

Spaces

Spaces provide environment separation within an org:

Space Quota Plans

Optional resource limits per space:

# Create space quota
cf create-space-quota my-quota -m 4G -i 1G -r 10 -s 5

# Assign to space
cf set-space-quota my-space my-quota

---

Buildpacks

SAP-Provided Buildpacks

Specifying Buildpacks

# manifest.yml
applications:
- name: my-app
  buildpacks:
    - nodejs_buildpack
  memory: 256M
  disk_quota: 512M

Custom Buildpacks

applications:
- name: my-app
  buildpack: https://github.com/my-org/my-buildpack.git

---

Service Bindings

Service Marketplace

# List available services
cf marketplace

# Create service instance
cf create-service hana hdi-shared my-hana

# Bind to application
cf bind-service my-app my-hana

Service Keys

For external access without binding:

# Create service key
cf create-service-key my-service my-key

# Get credentials
cf service-key my-service my-key

User-Provided Services

For external services not in marketplace:

cf create-user-provided-service my-external-service -p '{"url":"https://api.example.com","key":"xxx"}'

VCAP_SERVICES

Environment variable containing bound service credentials:

const services = JSON.parse(process.env.VCAP_SERVICES);
const hanaCredentials = services.hana[0].credentials;

---

Application Deployment

manifest.yml

applications:
- name: my-app
  memory: 512M
  disk_quota: 1G
  instances: 2
  path: ./target/my-app.jar
  buildpacks:
    - sap_java_buildpack
  env:
    JBP_CONFIG_SAPJVM: "[default_vm: jdk]"
  routes:
    - route: my-app.cfapps.eu10.hana.ondemand.com
  services:
    - my-hana
    - my-xsuaa

Deployment Commands

# Deploy application
cf push

# Deploy with manifest override
cf push -f manifest-prod.yml

# Deploy specific path
cf push my-app -p ./dist

# Scale instances
cf scale my-app -i 3

# Scale memory
cf scale my-app -m 1G

Blue-Green Deployment

# Deploy new version with different name
cf push my-app-new -f manifest.yml

# Map route to new version
cf map-route my-app-new cfapps.eu10.hana.ondemand.com --hostname my-app

# Unmap route from old version
cf unmap-route my-app cfapps.eu10.hana.ondemand.com --hostname my-app

# Delete old version
cf delete my-app -f

# Rename new version
cf rename my-app-new my-app

---

CF CLI Commands

Authentication

# Login
cf login -a https://api.cf.eu10.hana.ondemand.com

# Login with SSO
cf login -a https://api.cf.eu10.hana.ondemand.com --sso

# Target org/space
cf target -o my-org -s my-space

Application Management

# List applications
cf apps

# View app details
cf app my-app

# Start/stop/restart
cf start my-app
cf stop my-app
cf restart my-app

# View logs
cf logs my-app --recent
cf logs my-app  # tail

# SSH into container
cf ssh my-app

# Set environment variable
cf set-env my-app MY_VAR "value"
cf restage my-app

Service Management

# List services
cf services

# Create service
cf create-service <service> <plan> <name>

# Update service
cf update-service <name> -p <new-plan>

# Delete service
cf delete-service <name>

# Bind/unbind
cf bind-service <app> <service>
cf unbind-service <app> <service>

Routes

# List routes
cf routes

# Create route
cf create-route my-space cfapps.eu10.hana.ondemand.com --hostname my-app

# Map route to app
cf map-route my-app cfapps.eu10.hana.ondemand.com --hostname my-app

# Delete route
cf delete-route cfapps.eu10.hana.ondemand.com --hostname my-app

---

Space Management

Space Roles

Assign Roles

# Set space role
cf set-space-role user@example.com my-org my-space SpaceDeveloper

# Unset space role
cf unset-space-role user@example.com my-org my-space SpaceDeveloper

Org Roles

---

Availability Zones

Multi-AZ Deployment

Cloud Foundry distributes application instances across availability zones automatically when:

1. Multiple instances are running (instances: 2+) 2. Region supports multiple AZs

Benefits

• Independent power, network, cooling
• Automatic failover within region
• Improved application availability

Configuration

No special configuration required. CF Controller distributes instances automatically.

applications:
- name: my-app
  instances: 3  # Distributed across AZs

---

Supported Features

Supported

• Diego runtime
• Application manifests
• Service bindings
• SSH access
• Health monitoring
• Autoscaling (via Application Autoscaler)
• Container-to-container networking

Not Supported

• DEA runtime (deprecated)
• Some community plugins may not work

---

Related Documentation

• CF Environment Concepts: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/cloud-foundry-environment-9c7092c.md
• Regions and Endpoints: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/regions-and-api-endpoints-available-for-the-cloud-foundry-environment-f344a57.md
• Getting Started: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/20-getting-started/getting-started-in-the-cloud-foundry-environment-b328cc8.md
• Official CF Docs: https://docs.cloudfoundry.org/

Connectivity Reference

Complete guidance for SAP BTP connectivity including destinations and Cloud Connector.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/30-development

---

Table of Contents

1. Destinations Overview 2. Authentication Methods 3. Cloud Connector 4. Principal Propagation 5. Destination Service API

---

Destinations Overview

Destinations abstract connection details from application code:

Benefits

• Separation of configuration from code
• Secure credential storage
• Runtime resolution of connection details
• Central management in BTP Cockpit

Destination Types

Proxy Types

---

Authentication Methods

NoAuthentication

Public APIs without authentication:

{
  "Name": "public-api",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "NoAuthentication"
}

BasicAuthentication

Username/password (testing only):

{
  "Name": "basic-auth",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "BasicAuthentication",
  "User": "username",
  "Password": "password"
}

OAuth2ClientCredentials

Service-to-service:

{
  "Name": "oauth2-client",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

OAuth2SAMLBearerAssertion

User propagation to cloud services:

{
  "Name": "saml-bearer",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "audience": "https://audience.example.com",
  "clientKey": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "tokenServiceURLType": "Dedicated",
  "authnContextClassRef": "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession"
}

OAuth2JWTBearer

Token exchange (preferred over OAuth2UserTokenExchange):

{
  "Name": "jwt-bearer",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2JWTBearer",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

PrincipalPropagation

On-premise with Cloud Connector:

{
  "Name": "onprem-pp",
  "Type": "HTTP",
  "URL": "http://virtualhost:port",
  "ProxyType": "OnPremise",
  "Authentication": "PrincipalPropagation",
  "CloudConnectorLocationId": "location1"
}

ClientCertificateAuthentication

mTLS:

{
  "Name": "mtls",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "ClientCertificateAuthentication",
  "KeyStoreLocation": "keystore.p12",
  "KeyStorePassword": "password"
}

Note: The keystore file (.p12 or .jks) must be uploaded to the destination

configuration in BTP Cockpit before referencing it. Upload via: Connectivity →

Destinations → destination properties → Upload and Delete Certificates.

Authentication Method Compatibility

---

Cloud Connector

Overview

Lightweight on-premise agent providing:

• Secure tunnel to SAP BTP
• No inbound firewall ports required
• Fine-grained access control
• Principal propagation support

Installation

1. Download from SAP Software Download Center 2. Install on on-premise network 3. Configure connection to SAP BTP subaccount 4. Define accessible resources

Architecture

SAP BTP Application
    ↓ (HTTPS)
Connectivity Service
    ↓ (TLS tunnel)
Cloud Connector (on-premise)
    ↓ (HTTP/RFC)
On-Premise System

Configuration Scopes

Virtual Host Mapping

Map internal systems to virtual hosts:

Virtual Host: sap-erp-virtual:443
    → Internal System: erp.internal.company.com:443

Access Control

Define which resources are accessible:

High Availability

Architecture:

• Master connector: Active, handles all traffic
• Shadow connector: Standby, monitors master health
• Automatic failover if master becomes unavailable

Setup: 1. Install Cloud Connector on two separate hosts 2. Configure first as master (connects to BTP) 3. Configure second as shadow (points to master) 4. Shadow automatically takes over if master fails

Configuration:

Master: cc-master.internal.company.com:8443
Shadow: cc-shadow.internal.company.com:8443
    → Points to master for health checks
    → Same subaccount/location ID configuration

Best Practices:

• Deploy master and shadow on different physical hosts
• Use different network segments if possible
• Monitor both instances via Cloud Connector admin UI
• Test failover periodically

Monitoring

• Connection status in BTP Cockpit
• Audit logs
• Performance metrics

---

Principal Propagation

On-Premise via Cloud Connector

Forward user identity to on-premise systems:

User authenticates → BTP App → Cloud Connector → On-Premise
                     (SAML)    (X.509 cert)     (user context)

Requirements: 1. Cloud Connector with SNC or X.509 2. Destination with PrincipalPropagation 3. On-premise system configured for SSO

SAP System Configuration

For SAP ERP/S4: 1. Configure trusted certificate in STRUST 2. Enable SSO in SICF 3. Map certificate subject to user

Cloud-to-Cloud

Use OAuth2SAMLBearerAssertion or OAuth2JWTBearer:

// Using SAP Cloud SDK
const destination = await getDestination('my-destination');
const response = await executeHttpRequest(destination, {
  method: 'GET',
  url: '/api/resource'
});

---

Destination Service API

Get Destination

# Get single destination
curl -X GET "https://destination-configuration.cfapps.<region>.hana.ondemand.com/destination-configuration/v1/destinations/<name>" \
  -H "Authorization: Bearer <token>"

Response

{
  "owner": {
    "SubaccountId": "...",
    "InstanceId": "..."
  },
  "destinationConfiguration": {
    "Name": "my-destination",
    "Type": "HTTP",
    "URL": "https://api.example.com",
    "Authentication": "OAuth2ClientCredentials",
    "ProxyType": "Internet"
  },
  "authTokens": [
    {
      "type": "Bearer",
      "value": "...",
      "expires_in": "3600"
    }
  ]
}

Using in Applications

Node.js (CAP/Cloud SDK):

const { getDestination, executeHttpRequest } = require('@sap-cloud-sdk/core');

const destination = await getDestination('my-destination');
const response = await executeHttpRequest(destination, {
  method: 'GET',
  url: '/api/resource'
});

Java (Cloud SDK):

HttpDestination destination = DestinationAccessor
    .getDestination("my-destination")
    .asHttp();

HttpClient client = HttpClientAccessor.getHttpClient(destination);
HttpResponse response = client.execute(new HttpGet("/api/resource"));

---

Related Documentation

• Connectivity Service: https://help.sap.com/docs/connectivity
• Cloud Connector: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector
• Destinations: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/30-development

Development Reference

Development patterns and best practices for SAP BTP applications.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/30-development

---

Table of Contents

1. Multi-Target Applications 2. Application Router 3. CAP Development 4. Service Bindings 5. CI/CD Pipelines 6. Deployment Strategies

---

Multi-Target Applications

MTA Structure

my-app/
├── mta.yaml              # MTA descriptor
├── srv/                  # Backend service
│   ├── package.json
│   └── src/
├── app/                  # Frontend
│   └── webapp/
├── db/                   # Database artifacts
│   └── src/
└── xs-security.json      # Security config

mta.yaml Template

_schema-version: "3.1"
ID: my-app
version: 1.0.0
description: My SAP BTP Application

parameters:
  enable-parallel-deployments: true

build-parameters:
  before-all:
    - builder: custom
      commands:
        - npm install --production

modules:
  # Backend service
  - name: my-app-srv
    type: nodejs
    path: srv
    parameters:
      buildpack: nodejs_buildpack
      memory: 256M
    build-parameters:
      builder: npm
    requires:
      - name: my-app-db
      - name: my-app-auth
    provides:
      - name: srv-api
        properties:
          srv-url: ${default-url}

  # Database deployer
  - name: my-app-db-deployer
    type: hdb
    path: db
    parameters:
      buildpack: nodejs_buildpack
    requires:
      - name: my-app-db

  # UI module
  - name: my-app-ui
    type: html5
    path: app
    build-parameters:
      builder: custom
      commands:
        - npm run build
      supported-platforms: []

  # App Router
  - name: my-app-approuter
    type: approuter.nodejs
    path: approuter
    parameters:
      disk-quota: 256M
      memory: 256M
    requires:
      - name: my-app-auth
      - name: srv-api
        group: destinations
        properties:
          name: srv-api
          url: ~{srv-url}
          forwardAuthToken: true

resources:
  # HDI Container
  - name: my-app-db
    type: com.sap.xs.hdi-container
    parameters:
      service: hana
      service-plan: hdi-shared

  # XSUAA
  - name: my-app-auth
    type: org.cloudfoundry.managed-service
    parameters:
      service: xsuaa
      service-plan: application
      path: ./xs-security.json

Build and Deploy

# Build MTA archive
mbt build

# Deploy
cf deploy mta_archives/my-app_1.0.0.mtar

# Deploy with options
cf deploy my-app.mtar --strategy blue-green

---

Application Router

Purpose

• Single entry point for applications
• User authentication
• Static content serving
• URL routing to microservices
• Session management

xs-app.json

{
  "welcomeFile": "/index.html",
  "authenticationMethod": "route",
  "sessionTimeout": 30,
  "routes": [
    {
      "source": "^/api/(.*)$",
      "target": "$1",
      "destination": "srv-api",
      "authenticationType": "xsuaa",
      "csrfProtection": true
    },
    {
      "source": "^/(.*)$",
      "target": "$1",
      "localDir": "webapp",
      "authenticationType": "xsuaa"
    }
  ]
}

Authentication Types

Route Properties

Environment Variables

{
  "destinations": [
    {
      "name": "srv-api",
      "url": "https://my-srv.cfapps.eu10.hana.ondemand.com",
      "forwardAuthToken": true
    }
  ]
}

---

CAP Development

Project Setup

# Create new project
cds init my-project

# Add features
cds add hana
cds add xsuaa
cds add mta

Service Definition (CDS)

// srv/catalog-service.cds
using { my.bookshop as my } from '../db/schema';

service CatalogService {
  @readonly entity Books as projection on my.Books;
  entity Orders as projection on my.Orders;
}

Data Model

// db/schema.cds
namespace my.bookshop;

entity Books {
  key ID : Integer;
  title  : String;
  author : Association to Authors;
  stock  : Integer;
}

entity Authors {
  key ID : Integer;
  name   : String;
  books  : Association to many Books on books.author = $self;
}

entity Orders {
  key ID : UUID;
  book   : Association to Books;
  amount : Integer;
}

Service Implementation

// srv/catalog-service.js
module.exports = cds.service.impl(async function() {
  const { Books, Orders } = this.entities;

  this.before('CREATE', 'Orders', async (req) => {
    const { book_ID, amount } = req.data;
    const book = await SELECT.one.from(Books).where({ ID: book_ID });
    if (book.stock < amount) {
      req.error(409, 'Not enough stock');
    }
  });

  this.after('CREATE', 'Orders', async (order, req) => {
    await UPDATE(Books)
      .set({ stock: { '-=': order.amount } })
      .where({ ID: order.book_ID });
  });
});

Running Locally

# Start with watch (SQLite in-memory)
cds watch

# With hybrid profile (remote services, local app)
cds watch --profile hybrid

# Deploy to database
cds deploy --to hana

Profile Options:

Hybrid Profile Setup (.cdsrc.json):

{
  "[hybrid]": {
    "requires": {
      "db": {
        "kind": "hana",
        "credentials": { "from": "env:VCAP_SERVICES" }
      },
      "auth": {
        "kind": "xsuaa",
        "credentials": { "from": "env:VCAP_SERVICES" }
      }
    }
  }
}

Run cds bind to fetch service credentials, then cds watch --profile hybrid.

---

Service Bindings

Accessing Bound Services

Environment Variable (VCAP_SERVICES):

const vcap = JSON.parse(process.env.VCAP_SERVICES);
const hanaCredentials = vcap.hana[0].credentials;

Using @sap/xsenv:

const xsenv = require('@sap/xsenv');
xsenv.loadEnv();

const hanaCredentials = xsenv.serviceCredentials({ tag: 'hana' });

Using CAP:

// Automatic binding via cds.requires in package.json
const db = await cds.connect.to('db');

package.json (CAP)

{
  "cds": {
    "requires": {
      "db": {
        "kind": "hana",
        "credentials": {
          "binding": "db"
        }
      },
      "auth": {
        "kind": "xsuaa"
      }
    }
  }
}

---

CI/CD Pipelines

SAP Continuous Integration and Delivery

Pipeline types: 1. Cloud Foundry - Fiori, CAP 2. SAP Fiori for ABAP Platform 3. SAP Integration Suite Artifacts

Pipeline Configuration

# .pipeline/config.yml
general:
  buildTool: mta
  mtaBuildTool: cloudMbt

stages:
  Build:
    npmExecuteBefore:
      dockerImage: 'node:18'

  Integration:
    credentials:
      cfCredentialsId: cf-credentials

  Release:
    cfSpace: prod
    cfCredentialsId: cf-credentials

GitHub Actions Example

name: Deploy to BTP

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Setup Node
        uses: actions/setup-node@v3
        with:
          node-version: '18'

      - name: Install dependencies
        run: npm ci

      - name: Build MTA
        run: npx mbt build

      - name: Deploy to CF
        env:
          CF_API: ${{ secrets.CF_API }}
          CF_USER: ${{ secrets.CF_USER }}
          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
        run: |
          cf login -a $CF_API -u $CF_USER -p $CF_PASSWORD -o $CF_ORG -s $CF_SPACE
          cf deploy mta_archives/*.mtar -f

---

Deployment Strategies

Rolling Deployment (Default)

Replace instances one by one:

cf push my-app

Blue-Green Deployment

Zero-downtime with instant rollback:

# Deploy new version
cf push my-app-new -f manifest.yml

# Map production route
cf map-route my-app-new cfapps.eu10.hana.ondemand.com -n my-app

# Unmap from old
cf unmap-route my-app cfapps.eu10.hana.ondemand.com -n my-app

# Delete old version
cf delete my-app -f

# Rename
cf rename my-app-new my-app

With MTA:

cf deploy my-app.mtar --strategy blue-green

Canary Deployment

Gradual traffic shift:

# Deploy canary with different route
cf push my-app-canary -f manifest-canary.yml

# Gradually shift traffic (manual or with load balancer)

---

Related Documentation

• Development Guide: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/30-development
• CAP Documentation: https://cap.cloud.sap/docs/
• MTA Guide: https://help.sap.com/docs/btp/sap-business-technology-platform/multitarget-applications

Extensions Reference

Complete guidance for extending SAP solutions using SAP BTP.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/40-extensions

---

Table of Contents

1. Extensions Overview 2. Formations 3. System Registration 4. S/4HANA Cloud Extensions 5. SuccessFactors Extensions 6. Event Mesh Integration 7. Configuration Files 8. Troubleshooting

---

Extensions Overview

SAP BTP enables loosely coupled extensions without disrupting core SAP solution processes.

Extension Capabilities

Supported SAP Solutions

Extension Architecture

SAP Solution (S/4HANA, SuccessFactors)
    ↓ APIs & Events
SAP BTP (Unified Customer Landscape)
    ↓ Formations
Extension Application (CF or Kyma)

---

Formations

Formations are logical groupings of SAP systems for common business scenarios.

Formation Types

Formation Status

Creating Formations

1. Navigate to System Landscape > Formations in BTP Cockpit 2. Click Create Formation 3. Enter unique name (max 128 chars) 4. Select formation type 5. Add registered systems 6. Review and confirm

Formation Management

BTP Cockpit → System Landscape → Formations
├── Create Formation
├── Add Systems
├── Finalize Formation
├── Resynchronize (on error)
└── Delete Formation

---

System Registration

Register SAP systems to enable extensions.

Registration Process

1. Generate Token: Create registration token in BTP Cockpit 2. Configure System: Use token in SAP solution admin 3. Verify Connection: Check system status in BTP

System Types

Register S/4HANA Cloud System

BTP Cockpit → System Landscape → Systems
├── Add System
├── System Type: SAP S/4HANA Cloud
├── Generate Token
└── Complete in S/4HANA Cloud Admin

Register SuccessFactors System

BTP Cockpit → System Landscape → Systems
├── Add System
├── System Type: SAP SuccessFactors
├── Generate Token
└── Complete in SuccessFactors Provisioning

---

S/4HANA Cloud Extensions

Extension Setup Steps

1. Register System in global account 2. Configure Entitlements for subaccounts 3. Create Service Instance (api-access or messaging plan) 4. Build Extension in CF or Kyma

Service Plans

API Access Configuration

{
  "systemName": "MY_S4HANA_SYSTEM",
  "communicationArrangement": {
    "communicationArrangementName": "MY_ARRANGEMENT",
    "scenarioId": "SAP_COM_0008",
    "inboundAuthentication": "OAuth2SAMLBearerAssertion",
    "outboundAuthentication": "BasicAuthentication",
    "outboundServices": [
      {
        "name": "Business Partner (A2X)",
        "isServiceActive": true
      }
    ]
  }
}

Supported Authentication

Event Consumption

1. Configure SAP Event Mesh entitlements 2. Create Event Mesh service instance 3. Create S/4HANA extensibility instance (messaging plan) 4. Subscribe to events

---

SuccessFactors Extensions

Extension Setup

1. Register System in global account 2. Configure SSO (optional) 3. Configure Entitlements 4. Create Service Instance

SSO Configuration

SuccessFactors → Identity Authentication → SAP BTP

Steps: 1. Configure SuccessFactors as trusted IdP in BTP 2. Configure subaccount as trusted service provider in SuccessFactors 3. Test SSO flow

API Access

{
  "systemName": "MY_SFSF_SYSTEM",
  "technicalUser": "TECHNICAL_USER",
  "technicalUserSecret": "xxx"
}

---

Event Mesh Integration

Event Mesh Architecture

SAP Solution → Event Mesh → Extension App
              (CloudEvents)

Event Mesh Service Plans

Event Mesh Descriptor

{
  "emname": "my-event-mesh",
  "namespace": "my/namespace",
  "rules": {
    "queueRules": {
      "publishFilter": ["${namespace}/*"],
      "subscribeFilter": ["${namespace}/*"]
    },
    "topicRules": {
      "publishFilter": ["${namespace}/*"],
      "subscribeFilter": ["${namespace}/*"]
    }
  }
}

Create Queues and Subscribe

# Create queue
cf create-service-key my-event-mesh my-key

# Subscribe to topic
# Use Event Mesh UI or REST API

---

Configuration Files

Communication Arrangement JSON

{
  "communicationArrangementName": "MY_ARRANGEMENT",
  "scenarioId": "SAP_COM_0008",
  "inboundAuthentication": "OAuth2SAMLBearerAssertion",
  "outboundAuthentication": "BasicAuthentication",
  "inboundServices": [
    {
      "serviceName": "Business Partner API",
      "isServiceActive": true
    }
  ],
  "outboundServices": [
    {
      "name": "Business Partner (A2X)",
      "isServiceActive": true
    }
  ]
}

Communication Arrangement YAML

communicationArrangementName: MY_ARRANGEMENT
scenarioId: SAP_COM_0008
inboundAuthentication: OAuth2SAMLBearerAssertion
outboundAuthentication: BasicAuthentication
inboundServices:
  - serviceName: Business Partner API
    isServiceActive: true
outboundServices:
  - name: Business Partner (A2X)
    isServiceActive: true

API Access Configuration

{
  "systemName": "MY_SYSTEM",
  "communicationArrangement": {
    "communicationArrangementName": "INBOUND_COMM_ARRANGEMENT",
    "scenarioId": "SAP_COM_0008",
    "inboundAuthentication": "OAuth2SAMLBearerAssertion"
  }
}

---

Troubleshooting

Common Issues

S/4HANA Extensibility Issues

SuccessFactors Issues

---

Region Limitations

Extensions functionality is NOT available in:

• China (Shanghai) region
• Government Cloud (US) region

---

Related Documentation

• Extensions: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/40-extensions/extensions-08b1eff.md
• Formations: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/40-extensions/automating-integrations-using-formations-68b04fa.md
• S/4HANA Extensions: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/40-extensions/extending-sap-s-4hana-cloud-in-the-cloud-foundry-and-kyma-environment-40b9e6c.md
• SuccessFactors Extensions: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/40-extensions/extending-sap-successfactors-in-the-cloud-foundry-and-kyma-environment-9e33934.md

SAP BTP Glossary

Complete terminology reference for SAP Business Technology Platform.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/glossary-e67a143.md

---

A

Application

Software hosted on SAP BTP used by business users to complete tasks. Created by developers utilizing platform services.

Application Router

Single entry point for applications in Cloud Foundry environment. Handles static content serving, user authentication, URL rewriting, and request forwarding to microservices.

Availability

The durability and operational performance without failure of a system or component for an agreed amount of time, as defined in the contract.

Availability Zone (AZ)

A physically isolated location with independent power, network, and cooling infrastructure that acts as an individual failure domain within a region.

---

B

Block-hours

A measurement unit representing one compute block's runtime for one hour. Multiple blocks multiply the count accordingly.

Booster

A set of guided interactive steps that enable you to select, configure, and consume services on SAP BTP to achieve a specific technical goal.

btp CLI

The command line tool for all tasks on global account, directory, and subaccount level, such as creating or updating subaccounts, authorization management, and working with service brokers and platforms.

Buildpack

Provides framework and runtime support for applications in the Cloud Foundry environment.

Business Service

Platform services that enable, facilitate, or accelerate the development of business process components and elements of an application.

---

C

Cloud Connector

Serves as the link between on-demand applications in SAP BTP and existing on-premise systems. Lightweight agent establishing secure tunnel.

Cloud Foundry CLI

Command-line interface tool for deploying and managing applications in the Cloud Foundry environment.

Cloud Management Tools

Technologies designed for managing SAP BTP. Internally known as Foundation.

Cockpit

The central point of entry to key information about your accounts and applications, and for managing all activities associated with your account.

Connectivity

Provides secure, reliable access to business systems or remote services running on-premises or in the cloud.

---

D

Destination

A configuration that contains the connection details for a remote communication partner. Allows separation of application code from configuration.

Disaster

An event declared by SAP when there is a loss of utilities and services, and uncertainty about whether they can be restored within a reasonable period of time.

Disaster Recovery (DR)

A set of policies, tools, and procedures to protect applications by preserving and rapidly resuming their availability in case of a disaster.

Durability

The ability of a system to permanently store data without loss or corruption.

---

E

Enterprise Account

An enterprise account is usually associated with one SAP customer or partner and is typically subject to charges.

Entitlement

Your right to provision and consume a resource (service plan) on SAP BTP.

Environment

Constitutes the SAP BTP actual Platform-as-a-Service offering that allows for the development and administration of applications.

---

F

Failover

The automated or manually triggered process of switching from one system to another redundant system in case of an unexpected or planned downtime.

Formation

A logical grouping of SAP systems that can be extended in a single business scenario. Enables communication between systems.

---

G

Global Account

The realization of a contract you made with SAP. A global account is region- and environment-independent, and it is used to manage subaccounts, members, entitlements and quotas.

---

I

Identity Provider (IdP)

An authorization authority containing all user information and credentials. In SAP BTP, user information is provided by identity providers, not stored in SAP BTP itself.

In-Metro Disaster Recovery

Solution using synchronous data replication across multiple AZs within a single region to protect against localized disasters.

---

K

Kyma Environment

A fully managed cloud-native Kubernetes application runtime based on the open-source project Kyma.

Kyma Module

Modular component that can be selectively installed on a Kyma cluster to provide specific functionality.

---

M

Member

Indicates a user's assignment to an account. As an account member, a user automatically has the permissions required to use the SAP BTP functionality within the scope of the respective account and as permitted by their account member roles.

Multi-Target Application (MTA)

A package consisting of multiple modules that are deployed together on SAP BTP.

---

O

OAuth

Widely adopted security protocol for protecting resources over the Internet, used by social networks and corporate networks.

Org (Organization)

A hierarchical level in the account structure of SAP BTP using a Cloud Foundry subaccount. Each Cloud Foundry subaccount contains exactly one Cloud Foundry org.

---

P

Platform Service

Software that enables, facilitates, or accelerates the development of applications and other platform services on SAP BTP.

Platform User

User who manages and administers SAP BTP (developer, administrator, operator).

Principal Propagation

Forwarding of user identity from one system to another for single sign-on and authorization.

Programming Model

A set of concepts, languages, runtimes, and APIs used to create applications on SAP BTP.

---

Q

Quota

A numeric quantity that defines the maximum allowed consumption of a specific technical asset/resource.

---

R

Region

A geographical location (e.g., Europe, US East) where applications, data, or services are hosted. Usually consists of two or more availability zones.

Resilience

The ability to provide and maintain an acceptable level of service in the face of faults and challenges until normal operation is restored.

Role Collection

A group of roles assigned to users or groups to grant specific authorizations.

Runtime

An engine or context for executing programs, such as Java Web Tomcat or Node.js.

---

S

SAP BTP, Cloud Foundry Environment

An open Platform-as-a-Service, which provides a scalable runtime container and a choice of clouds, runtimes, and services.

SAP BTP, Kyma Runtime

A runtime developers can use to build cloud-native Kubernetes-based extensions to SAP by using microservices and serverless Functions.

SAP BTP, Neo Environment

An enterprise Platform-as-a-Service providing a range of services (sunsetting December 31, 2028).

SAP Cloud Application Programming Model (CAP)

A framework of languages, libraries, and tools for building enterprise-grade services and applications. Supports Java, JavaScript, and TypeScript.

SAP ID Service

The default identity provider for SAP BTP applications. Manages the user base for SAP Community Network and other SAP websites.

SAPUI5

A development toolkit providing UI controls for developing Web applications.

Service Broker

When a developer provisions and binds a service to an application, the service broker for that service is responsible for providing the service instance and for binding services to applications.

Service Plan

A variant of a service; for example, a database may be configured with various "t-shirt sizes", each of which is a different service plan.

Shadow User

A copy of a user from an identity provider stored in SAP BTP for authorization purposes.

Space

In the Cloud Foundry environment, every application and service is scoped to a space. A space provides users with access to a shared location for application development, deployment, and maintenance.

Staging

The process in the Cloud Foundry environment by which the raw bits of an application are transformed into a droplet that is ready to execute.

Subaccount

Lets you structure a global account according to customer requirements with regards to members, authorizations and quotas. Where actual deployments occur.

---

T

Technical Service

Platform services that enable, facilitate, or accelerate the generic development of an application, independent of the application's business process or task.

Tool

A means for users to develop, configure, monitor and administer a service or entities managed by a service.

Trial Account

90-day complimentary platform exploration with restricted resources.

---

U

User-Provided Service Instance

User-provided service instances enable you to use services that are not available in the marketplace with your applications running in the Cloud Foundry environment.

---

X

XSUAA

SAP Authorization and Trust Management Service. OAuth 2.0 authorization server for SAP BTP applications.

xs-security.json

Application security descriptor defining scopes, roles, and attributes for XSUAA.

---

Related Documentation

• Basic Concepts: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/10-concepts
• Full Glossary: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/glossary-e67a143.md

Kyma Environment Reference

Detailed guidance for SAP BTP Kyma environment development and administration.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/10-concepts Kyma Project: https://kyma-project.io/

---

Table of Contents

1. Architecture 2. Modules 3. Namespaces 4. Deployment Patterns 5. Service Consumption 6. Serverless Functions 7. Eventing 8. Security 9. kubectl Commands

---

Architecture

Kyma in SAP BTP

• Fully managed Kubernetes runtime
• Based on open-source Kyma project
• Built on Gardener-managed Kubernetes clusters
• Modular architecture with selectable components
• 1:1 relationship: Subaccount → Kyma Cluster

Supported Technologies

• CAP (Cloud Application Programming Model)
• SAP Cloud SDK
• Application Router
• HTML5 Deployer
• Docker containers
• Helm charts

Structure

Subaccount (1:1 with Kyma Cluster)
└── Kubernetes Cluster
    ├── kyma-system (SAP managed)
    ├── namespace: dev
    │   ├── Deployments
    │   ├── Services
    │   └── Functions
    ├── namespace: test
    └── namespace: prod

---

Modules

Default Modules (Always Installed)

Optional Modules

Module Management

# List available modules
kubectl get kymas -n kyma-system

# Add module via BTP Cockpit or kubectl
kubectl patch kyma default -n kyma-system --type merge -p '
spec:
  modules:
  - name: serverless
'

Community Modules

User-provided modules without:

• Automatic updates
• SLA coverage
• SAP support

---

Namespaces

Best Practices

• Use namespaces for environment separation
• Apply resource quotas per namespace
• Implement network policies for isolation

Create Namespace

# namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: my-app
  labels:
    istio-injection: enabled

kubectl apply -f namespace.yaml

Resource Quotas

apiVersion: v1
kind: ResourceQuota
metadata:
  name: my-quota
  namespace: my-app
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"

---

Deployment Patterns

Standard Deployment

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-namespace
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-app
        image: my-registry/my-app:latest
        ports:
        - containerPort: 8080
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"

Service

apiVersion: v1
kind: Service
metadata:
  name: my-app
  namespace: my-namespace
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080

API Rule (Expose API)

apiVersion: gateway.kyma-project.io/v1beta1
kind: APIRule
metadata:
  name: my-app
  namespace: my-namespace
spec:
  gateway: kyma-gateway.kyma-system.svc.cluster.local
  host: my-app
  service:
    name: my-app
    port: 80
  rules:
  - path: /.*
    methods: ["GET", "POST", "PUT", "DELETE"]
    accessStrategies:
    - handler: jwt
      config:
        jwks_urls:
        - https://<subaccount>.authentication.<region>.hana.ondemand.com/token_keys

Helm Chart

# Install with Helm
helm install my-app ./my-chart -n my-namespace

# Upgrade
helm upgrade my-app ./my-chart -n my-namespace

# Rollback
helm rollback my-app 1 -n my-namespace

---

Service Consumption

SAP BTP Operator

Consume SAP BTP services via Kubernetes resources:

# ServiceInstance
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: my-hana
  namespace: my-namespace
spec:
  serviceOfferingName: hana-cloud
  servicePlanName: hana
  parameters:
    memory: 32

---
# ServiceBinding
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: my-hana-binding
  namespace: my-namespace
spec:
  serviceInstanceName: my-hana
  secretName: my-hana-credentials

Using Credentials

env:
- name: HANA_URL
  valueFrom:
    secretKeyRef:
      name: my-hana-credentials
      key: url

---

Serverless Functions

Function Definition

apiVersion: serverless.kyma-project.io/v1alpha2
kind: Function
metadata:
  name: my-function
  namespace: my-namespace
spec:
  runtime: nodejs20
  source:
    inline:
      source: |
        module.exports = {
          main: async function (event, context) {
            const message = event.data?.message || "Hello World";
            return { statusCode: 200, body: { message } };
          }
        };
  resourceConfiguration:
    function:
      resources:
        requests:
          cpu: "50m"
          memory: "64Mi"
        limits:
          cpu: "100m"
          memory: "128Mi"

Expose Function

apiVersion: gateway.kyma-project.io/v1beta1
kind: APIRule
metadata:
  name: my-function
  namespace: my-namespace
spec:
  gateway: kyma-gateway.kyma-system.svc.cluster.local
  host: my-function
  service:
    name: my-function
    port: 80
  rules:
  - path: /.*
    methods: ["GET", "POST"]
    accessStrategies:
    - handler: noop  # No authentication

---

Eventing

Subscription

apiVersion: eventing.kyma-project.io/v1alpha2
kind: Subscription
metadata:
  name: my-subscription
  namespace: my-namespace
spec:
  sink: http://my-function.my-namespace.svc.cluster.local
  source: myapp
  types:
  - order.created.v1

Publishing Events

// CloudEvent format
const event = {
  specversion: "1.0",
  type: "order.created.v1",
  source: "myapp",
  id: uuid(),
  data: { orderId: "12345" }
};

await fetch(`${EVENTING_ENDPOINT}/publish`, {
  method: "POST",
  headers: { "Content-Type": "application/cloudevents+json" },
  body: JSON.stringify(event)
});

---

Security

API Gateway Authentication

JWT validation with XSUAA:

accessStrategies:
- handler: jwt
  config:
    jwks_urls:
    - https://<subaccount>.authentication.<region>.hana.ondemand.com/token_keys
    trusted_issuers:
    - https://<subaccount>.authentication.<region>.hana.ondemand.com/oauth/token

RBAC

# Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer
  namespace: my-namespace
rules:
- apiGroups: ["", "apps"]
  resources: ["pods", "deployments", "services"]
  verbs: ["get", "list", "create", "update", "delete"]

---
# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: my-namespace
subjects:
- kind: User
  name: developer@example.com
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: my-namespace
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---

kubectl Commands

Authentication

# Download kubeconfig from BTP Cockpit
# Or use kubelogin for OIDC

export KUBECONFIG=~/.kube/kyma-kubeconfig.yaml
kubectl get nodes

Common Operations

# List resources
kubectl get pods -n my-namespace
kubectl get deployments -n my-namespace
kubectl get services -n my-namespace

# Apply configuration
kubectl apply -f deployment.yaml

# View logs
kubectl logs -f deployment/my-app -n my-namespace

# Describe resource
kubectl describe pod my-pod -n my-namespace

# Execute command in pod
kubectl exec -it my-pod -n my-namespace -- /bin/sh

# Port forward
kubectl port-forward svc/my-app 8080:80 -n my-namespace

# Delete resources
kubectl delete -f deployment.yaml

Troubleshooting

# Get events
kubectl get events -n my-namespace --sort-by='.lastTimestamp'

# Check pod status
kubectl get pods -n my-namespace -o wide

# View container logs
kubectl logs my-pod -c my-container -n my-namespace

# Previous container logs
kubectl logs my-pod -c my-container -n my-namespace --previous

---

Related Documentation

• Kyma Environment: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/kyma-environment-468c2f3.md
• Kyma Modules: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/kyma-modules-0dda141.md
• Getting Started: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/20-getting-started/getting-started-in-the-kyma-environment-d1abd18.md
• Kyma Project: https://kyma-project.io/docs/

Operations and Monitoring Reference

Complete guidance for SAP BTP operations, monitoring, logging, and alerting.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/50-administration-and-ops

---

Table of Contents

1. Monitoring Overview 2. SAP Cloud ALM 3. Application Logging 4. Audit Logging 5. Alert Notification 6. Health Monitoring 7. Operating Model 8. Data Protection

---

Monitoring Overview

Monitoring Stack

Application Layer
    ↓ Logs & Metrics
SAP Cloud Logging / Application Logging
    ↓ Analysis
SAP Cloud ALM / External Tools
    ↓ Alerts
SAP Alert Notification
    ↓ Channels
Email / Slack / ServiceNow / Cloud ALM

Available Services

---

SAP Cloud ALM

Enterprise application lifecycle management included with SAP Enterprise Support.

Capabilities

Setup

1. Activate SAP Cloud ALM in BTP Cockpit 2. Configure data collection agents 3. Set up monitoring dashboards 4. Configure alert rules

Integration

SAP BTP Applications → SAP Cloud ALM
                     ← Alert Notification

---

Application Logging

Service Plans

Setup

# Create service instance
cf create-service application-logs lite my-logs

# Bind to application
cf bind-service my-app my-logs

# Restage application
cf restage my-app

Log Levels

Viewing Logs

CF CLI:

# Recent logs
cf logs my-app --recent

# Tail logs
cf logs my-app

# Specific time range
cf logs my-app --recent | grep "ERROR"

Kibana Dashboard:

• Access via Application Logging service
• Create custom visualizations
• Set up log-based alerts

Log Retention

---

Audit Logging

Security-relevant chronological records for compliance and security.

Audit Categories

Service Plans

Audit Log Retrieval

Via Viewer: 1. Subscribe to SAP Audit Log Viewer Service 2. Assign viewer roles 3. Access via BTP Cockpit

Via API:

curl -X GET "https://auditlog.cf.<region>.hana.ondemand.com/v2/auditlogrecords" \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/json"

Writing Audit Logs (Custom Apps)

// Node.js example
const auditLog = require('@sap/audit-logging');

const log = auditLog.v2(credentials);
await log.dataAccess({
  object: { type: 'customer', id: '12345' },
  attributes: ['email', 'phone'],
  accessChannel: 'API'
}).tenant('tenant-id').by('user@example.com').log();

---

Alert Notification

Multi-channel alerting service for BTP events.

Alert Channels

Alert Configuration

{
  "conditions": {
    "type": "CONDITION_TREE",
    "children": [
      {
        "type": "LEAF",
        "parameter": "eventType",
        "operator": "=",
        "value": "audit.security-events"
      }
    ]
  },
  "actions": [
    {
      "type": "EMAIL",
      "properties": {
        "destination": "alerts@example.com"
      }
    }
  ]
}

Event Types

---

Health Monitoring

Application Health Checks

Cloud Foundry:

# manifest.yml
applications:
- name: my-app
  health-check-type: http
  health-check-http-endpoint: /health
  health-check-timeout: 60

Kyma:

# deployment.yaml
livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

Health Endpoints

// Express.js health endpoint
app.get('/health', (req, res) => {
  res.json({
    status: 'UP',
    checks: {
      database: checkDatabase(),
      cache: checkCache()
    }
  });
});

---

Operating Model

Shared Responsibility Model

Cloud Foundry vs Kyma Differences

Go-Live Checklist

1. Deploy to Production

• Production environment configured
• All services bound
• Environment variables set

2. Configure Access

• Business users provisioned
• Role collections assigned
• SSO configured

3. Set Up Monitoring

• Application logging enabled
• Health checks configured
• Alerts set up

4. Document

• Runbooks created
• Support contacts identified
• Escalation paths defined

---

Data Protection

GDPR Compliance

SAP BTP provides technical features for data protection:

Personal Data Guidelines

Avoid Personal Data In:

• Account names
• Database names
• Tenant identifiers
• Technical field names

Proper Handling:

• Classify data sensitivity
• Implement access controls
• Enable audit logging
• Document processing activities

User Data Locations

Data Subject Requests

1. Access Requests: Use audit logs to identify data access 2. Deletion Requests: Use deletion APIs or manual processes 3. Portability: Export via APIs

---

Operational Commands

CF Application Operations

# Restart application
cf restart my-app

# Scale instances
cf scale my-app -i 3

# View app events
cf events my-app

# SSH for debugging
cf ssh my-app

# Check environment
cf env my-app

Kyma Operations

# Restart deployment
kubectl rollout restart deployment/my-app -n my-namespace

# Scale deployment
kubectl scale deployment my-app --replicas=3 -n my-namespace

# View events
kubectl get events -n my-namespace --sort-by='.lastTimestamp'

# Check pod status
kubectl describe pod <pod-name> -n my-namespace

---

Related Documentation

• Operations: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/50-administration-and-ops
• Audit Logging: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/50-administration-and-ops/audit-logging-in-the-cloud-foundry-environment-f92c86a.md
• Operating Model: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/70-getting-support
• Data Protection: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/60-security/data-protection-and-privacy-7e513d3.md

Regions and API Endpoints Reference

Complete reference for SAP BTP regions across all environments.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/10-concepts

---

Table of Contents

1. Cloud Foundry Regions 2. Kyma Regions 3. ABAP Environment Regions 4. Trial Regions 5. EU Access Regions 6. BTP Cockpit URLs

---

Cloud Foundry Regions

Amazon Web Services (AWS)

Microsoft Azure

Google Cloud Platform (GCP)

Other Providers

---

Kyma Regions

AWS Regions

Azure Regions

GCP Regions

---

ABAP Environment Regions

---

Trial Regions

Cloud Foundry Trial

Kyma Trial

Trial limitations:

• 90-day duration
• Limited resources
• Apps stop daily
• No SLA

---

EU Access Regions

For contracts requiring data processing within EEA/Switzerland only:

Note: Not all services support EU Access. Check SAP Discovery Center for service availability.

---

BTP Cockpit URLs

Global Cockpit

• Production: https://cockpit.btp.cloud.sap
• China: https://cockpit.cn40.platform.sapcloud.cn

Region-Specific Cockpits

CLI Endpoints

---

Network Considerations

NAT IPs (Egress)

Each region has NAT IPs for outbound traffic. IPs may change with at least 4 weeks notice.

Load Balancer IPs (Ingress)

Each region has dedicated load balancer IPs for inbound traffic.

Firewall Rules

For on-premise connectivity:

• Allow outbound HTTPS (443) to Cloud Connector
• Allow outbound to region-specific endpoints

---

Region Selection Factors

---

Related Documentation

• CF Regions: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/regions-and-api-endpoints-available-for-the-cloud-foundry-environment-f344a57.md
• Kyma Regions: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/regions-for-the-kyma-environment-557ec3a.md
• ABAP Regions: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/10-concepts/regions-and-api-endpoints-for-the-abap-environment-879f373.md
• SAP Discovery Center: https://discovery-center.cloud.sap/

Security Reference

Complete security guidance for SAP BTP including authentication, authorization, and identity management.

Source: https://github.com/SAP-docs/sap-btp-cloud-platform/tree/main/docs/60-security

---

Table of Contents

1. Security Overview 2. Identity Providers 3. Trust Configuration 4. Authorization 5. XSUAA Configuration 6. Role Collections 7. Principal Propagation 8. Audit Logging 9. Security Best Practices

---

Security Overview

User Types

Security Layers

Identity Provider (Source of Truth)
    ↓
SAP Cloud Identity Services (Proxy/Direct)
    ↓
SAP BTP (Shadow Users)
    ↓
Role Collections → Application Access

Encryption

• TLS 1.2 or higher mandatory
• TLS 1.0/1.1 not supported
• TLS 1.3 available via Custom Domain Manager
• HTTPS required for all communication

---

Identity Providers

SAP ID Service (Default)

• Default identity provider for SAP BTP
• Manages SAP Community users
• Suitable for testing and trial accounts
• Not recommended for production

SAP Cloud Identity Services

Recommended for production:

• Identity Authentication for authentication
• Identity Provisioning for user sync
• Corporate IdP integration via proxy

Identity Provider Architecture

Corporate IdP (SAML/OIDC)
    ↓
SAP Cloud Identity Services - Identity Authentication
    ↓
SAP BTP Platform (Trust Configuration)
    ↓
Applications (XSUAA)

Identity Authentication Onboarding

1. Get Identity Authentication tenant 2. Add multiple administrators (different time zones) 3. Enable MFA for administrators 4. Configure security monitoring 5. Set up corporate IdP proxy (optional) 6. Establish trust with SAP BTP

---

Trust Configuration

Subaccount Trust Setup

For Platform Users:

Global Account → Trust Configuration → Add Identity Provider

For Business Users:

Subaccount → Trust Configuration → New Trust Configuration

OIDC Trust Configuration

{
  "name": "my-corporate-idp",
  "type": "oidc",
  "origin": "my-idp-origin",
  "config": {
    "issuer": "https://idp.example.com",
    "clientId": "my-client-id",
    "clientSecret": "***",
    "authorizationEndpoint": "https://idp.example.com/authorize",
    "tokenEndpoint": "https://idp.example.com/token",
    "userInfoEndpoint": "https://idp.example.com/userinfo"
  }
}

SAML Trust Configuration

Setup Steps: 1. Export SAML metadata XML from your IdP 2. In BTP Cockpit: Subaccount → Trust Configuration → New Trust Configuration 3. Upload IdP metadata (contains signing certificate, endpoints) 4. Configure attribute mapping (email, groups, custom attributes) 5. Download BTP SAML metadata for IdP registration 6. Test authentication flow

Metadata Exchange:

IdP Metadata → BTP              BTP Metadata → IdP
- Entity ID                     - Entity ID
- SSO URL                       - Assertion Consumer URL
- Signing Certificate           - Signing Certificate
- NameID format                 - Supported bindings

Certificate Handling:

• IdP certificates expire—monitor and update before expiry
• BTP auto-generates service provider certificate
• For certificate renewal: upload new IdP metadata with updated certificate
• Grace period allows both old and new certificates during transition

---

Authorization

Authorization Methods

Provisioning (Recommended)

Identity Directory → Identity Provisioning → SAP BTP

Benefits:

• Automated user lifecycle management
• Central role assignment
• Immediate offboarding

Federation

User attributes from IdP mapped to roles at runtime:

• No user sync required
• Real-time attribute updates
• Risk of orphaned shadow users

---

XSUAA Configuration

xs-security.json

Application security descriptor:

{
  "xsappname": "my-app",
  "tenant-mode": "dedicated",
  "scopes": [
    {
      "name": "$XSAPPNAME.Read",
      "description": "Read access"
    },
    {
      "name": "$XSAPPNAME.Write",
      "description": "Write access"
    },
    {
      "name": "$XSAPPNAME.Admin",
      "description": "Admin access"
    }
  ],
  "attributes": [
    {
      "name": "Country",
      "description": "User country",
      "valueType": "string"
    }
  ],
  "role-templates": [
    {
      "name": "Viewer",
      "description": "Read-only user",
      "scope-references": ["$XSAPPNAME.Read"]
    },
    {
      "name": "Editor",
      "description": "Read-write user",
      "scope-references": ["$XSAPPNAME.Read", "$XSAPPNAME.Write"]
    },
    {
      "name": "Administrator",
      "description": "Full access",
      "scope-references": ["$XSAPPNAME.Read", "$XSAPPNAME.Write", "$XSAPPNAME.Admin"]
    }
  ],
  "role-collections": [
    {
      "name": "MyApp_Viewer",
      "description": "View my-app data",
      "role-template-references": ["$XSAPPNAME.Viewer"]
    }
  ]
}

Service Instance Creation

# Cloud Foundry
cf create-service xsuaa application my-xsuaa -c xs-security.json

# Kyma (ServiceInstance)
kubectl apply -f - <<EOF
apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: my-xsuaa
spec:
  serviceOfferingName: xsuaa
  servicePlanName: application
  parameters:
    xsappname: my-app
    tenant-mode: dedicated
    scopes:
    - name: \$XSAPPNAME.Read
      description: Read access
EOF

---

Role Collections

Structure

Role Collection
├── Role 1 (from Role Template)
│   └── Scopes
├── Role 2
└── Users/Groups assigned

Creating Role Collections

Via BTP Cockpit: 1. Navigate to Subaccount → Security → Role Collections 2. Create new role collection 3. Add roles from application role templates 4. Assign users or groups

Via btp CLI:

# Assign user to role collection
btp assign security/role-collection "MyApp_Viewer" \
  --to-user user@example.com \
  --of-idp my-idp-origin

# List role collections
btp list security/role-collection

Group Mapping

Map IdP groups to role collections:

btp assign security/role-collection "MyApp_Viewer" \
  --to-group "AppViewers" \
  --of-idp my-idp-origin

---

Principal Propagation

Forward user identity to backend systems:

On-Premise via Cloud Connector

User → SAP BTP App → Cloud Connector → On-Premise System
        (SAML assertion)      (X.509 certificate)

Destination Configuration:

{
  "Name": "my-onprem-system",
  "Type": "HTTP",
  "URL": "http://virtualhost:port",
  "ProxyType": "OnPremise",
  "Authentication": "PrincipalPropagation"
}

Cloud-to-Cloud

User → SAP BTP App → SAP Cloud Service
        (OAuth2SAMLBearerAssertion)

Destination Configuration:

{
  "Name": "my-cloud-service",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "audience": "https://audience.example.com",
  "tokenServiceURL": "https://token.example.com/oauth/token"
}

---

Audit Logging

Enabling Audit Log

1. Subscribe to SAP Audit Log Viewer Service 2. Configure audit log retention 3. Access via BTP Cockpit or API

Audit Categories

Audit Log Retrieval API

# Get audit logs
curl -X GET "https://auditlog.cf.<region>.hana.ondemand.com/v2/auditlogrecords" \
  -H "Authorization: Bearer <token>"

---

Security Best Practices

Identity Management

1. Use SAP Cloud Identity Services for production 2. Enable MFA for all administrators 3. Maintain backup administrators in default IdP 4. Use provisioning over federation for user lifecycle

Access Control

1. Principle of least privilege - minimal required access 2. Regular access reviews - remove unused permissions 3. Avoid generic admin accounts - individual accountability 4. Document role assignments - audit trail

Platform Access

Application Security

1. Validate all inputs - prevent injection attacks 2. Use XSUAA for authentication 3. Implement authorization checks - scope validation 4. Enable audit logging - track access 5. Encrypt sensitive data - at rest and in transit

Credential Management

1. Use destinations - never hardcode URLs/credentials 2. Rotate secrets regularly - service keys, passwords 3. Use service bindings - credentials via VCAP_SERVICES 4. Secure credential store - for application secrets

---

Troubleshooting

Common Issues

Debug Token

# Decode JWT token
echo "<token>" | cut -d. -f2 | base64 -d | jq

---

Related Documentation

• Security Overview: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/60-security/security-e129aa2.md
• XSUAA: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/60-security/sap-authorization-and-trust-management-service-6373bb7.md
• Troubleshooting: https://github.com/SAP-docs/sap-btp-cloud-platform/blob/main/docs/60-security/troubleshooting-for-sap-authorization-and-trust-management-service-c33d777.md