Enterprise Resource Planning (ERP) with SAP ECC 6 EHP 8 on AWS for a Global Aviation Major
The aviation major is a world-leading provider of jet and turboprop engines, as well as integrated systems for commercial, military, business, and general aviation aircraft. It has a global service network to support these offerings.
The organization needed to transform their IT infrastructure solution to address:
- Reduction in total cost of ownership (TCO)
- Need to migrate servers and applications to AWS cloud to increase efficiency, mobility, and improved cost management.
- High availability of SAP systems with disaster recovery (DR) solution and improve recovery point objective (RPO) and recovery time objective (RTO)
- Reactive maintenance, low technician productivity and lack of full control/access
- To enhance security, integrity of data, and access control.
- Visibility, accuracy, and mapping of assets
- The requirement to provide a stable environment and seamless operations support
SAP ECC 6 is an enterprise resource planning (ERP) solution that helps organizations manage their users, track operations, and perform preventive maintenance leveraging predictive analysis and enterprise-ready features.
With cloud computing becoming the norm in the industry, Tech Mahindra designed and built the platform for SAP on Amazon Web Services (AWS), which provides highly flexible and reliable cloud infrastructure services solutions and a broad range of services to deploy any enterprise-grade application on the cloud.
SAP Overall Architecture
SAP solution has been designed and built with scalable and secure architecture using AWS services.
TechM has designed the overall architecture considering the best practices prescribed by AWS and in alignment with the key pillars of AWS Well Architected framework. Overall, the applications will be hosted in AWS US-East-1 region and critical components will be placed in multiple availability zones to provide high availability.
The target landscape for SAP application consists of three environments; development, QA/ UAT, and production. Each environment will have its own dedicated virtual private cloud (VPC) segment, allowing better security controls, and segregation of responsibilities.
VPC Design
To isolate each environment for robust security and ease of management, four VPCs will be created and segregate the network access. The high-level environment classification is as follows:
- Non-production- US -East-1 (DEV/QA/UAT)
- Production - US-East-1
- DR non-production - US-West-1 (QA)
- DR production - US-West-1 (Prod)
Overall, the AWS architecture has been depicted in the below diagram that provides an elated view of various AWS services that are considered for the overall solution.
The organization’s WALES ERP platform consists of four accounts and each account has one VPC with respect to the environment. Production environment provisioned in US-East-1 region with high availability spanned into two zones and their dedicated subnets and DR zone in US-West-1 Region. ERS will be running on both the nodes; however, ASCS services will be failed to the active nodes in case of unresponsiveness. SIOS resides on CI servers and monitors the heartbeat of these servers and transfers the ASCS services to the active node in case of failure. Two database servers (OEL) are placed in availability zone A and availability zone B in each environment. Central instances, ECC application servers, and trusted applications like DSP and BODS (subnets) will have access to these databases. For DB access, primary connection will target primary database server unless it is inactive then the traffic will automatically switch over to secondary. For DSP/BODS only host IPs will be permitted to access DB servers. The security group at database layer will be allowed only required and necessary ports to communicate with ECC applications and central instances. As part of the architecture, there are four application servers equally distributed in two availability zones.
Security Services:
As part of the overall solution, some of the key security services were leveraged to build a highly secure platform for the customer’s SAP Platform on AWS.
AWS Identity and Access Management (IAM) is used to control the access to AWS resources such as Amazon EC2, Amazon S3, and Amazon EFS to connect securely with given roles and privileges.
Network Security:
Provided enhanced security through customer’s network firewall and NACL and Security Groups for each individual virtual machine that is deployed within this AWS Platform.
Data Security:
Tech Mahindra leveraged AWS Certificate Manager to protect the data in transit and at rest.
AWS Certificate Manager (SSL/TLS encryption) plays a key role in managing and provisioning SSL certificates for all the applications that require secure transactions while in transit.
All the storage services (EBS, EFS, S3) have been designed in such a way that the encryption at rest is addressed and it meets the customer requirement to have a dedicated KMS key that provides encryption.
Management Services:
Leveraged AWS CloudFormation stacks for provisioning and scaling the workloads.
AWS Network Load Balancer (NLB) is used for load balancing of the traffic across various ECC Servers.
Amazon CloudWatch is the monitor solution for all AWS resources such as Amazon EC2 instances, AWS NLB, and all the infra components.
AWS CloudTrail is used for governance, compliance, operational auditing, and risk auditing such as rack the activities of the account users, monitoring AWS API activity and setting the alarm to trigger a notification.
Tech Mahindra created patching maintenance windows through AWS Systems Manager for DEV, QAS, and Production servers as per the customer’s standards and achieved maximum systems availability.
High Available Solution for SAP Systems on AWS
SAP system’s high availability is provided through SIOS Protection Suite. Application files and data changes will be replicated from the primary node to the secondary node. HA set up to monitor the heartbeat and auto switchover of the services between the zones by dynamically updating the routing table to point the traffic to the active node. SAP ASCS helps in achieving high availability for the core application stack. ASCS stands for ABAP SAP Central Service and it is made of two parts, the Message server and the Enqueue server. The Message server acts as a communication channel between the application servers and handles load distribution. The Enqueue server controls the lock mechanism.
Whenever patching or any activity is on primary DB Server, we Switchover to Standby DB by utilizing high availability. From SAP standpoint, we committed very minimal downtime in server patching. There will be a glitch to the running connections. We can enable FSFO (Fast Start Failover) for Primary DB and Standby DB, for immediate fail-over if Primary DB is down.
Disaster Recovery Solution for SAP Systems on AWS
TechM implemented a DR plan to achieve RTO (2 hours) and RPO (15 minutes) requirements by using CloudEndure and DataGuard.
Production application instances configured for data replication to DR Region and the data staged in the staging area where Cloud Endure Staging Servers are deployed. Usually, the staging servers are in separate VPCs . Before we initiate the DR exercise through Cloud Endure ensure that the target servers on the console which will be in US-West-P-1 are ready for DR. Here the data replication is happening live, hence we can achieve the RPO of 15 minutes or lower.
Production DB servers are deployed in production and DR regions with live data replication configured to provide HA during availability zone failure and DR during disaster situation. The live data is configured for replication to a server in DR region using Oracle Data Guard. Since all the key transactional data is configured to replicate in DR Site, we could achieve near-zero data loss ensuring to achieve the RPO. During region failure, the DB server in the DR region role will be changed from standby to active to handle load within RTO/RPO.
Amazon DataSync has been configured to sync the Amazon EFS between production and DR regions. And DNS failover will be used during the actual DR scenario for the DNS switch.
Conclusion
A business must continue to improve its customer experience, both in terms of the availability of service and add value to the money spent on the platforms. In the above customer case, the customer would be able to achieve agility by hosting enterprise applications in the cloud and addressing the high availability requirements without having restrictions on the capacity requirements.
In this post, we learned about how different AWS components can help to host SAP suite of applications on AWS. We also explored how high availability is achieved with the combination of SAP and AWS services together. We learned about DR implementation by using CloudEndure.
