Custom VPC Endpoints in the AWS SDK for SAP ABAP

Introduction

AWS services are accessed via endpoints, which are typically URLs which are reachable from the public Internet. These URLs are calculated automatically based on many factors such as service, region and IP address type. Customers often want their SAP ABAP systems to consume AWS services without the data traversing the Internet. In this case, customers must create interface endpoints in their VPC and explicitly direct their SDK to use that endpoint. There are two options for specifying the custom endpoint URL with the AWS SDK for SAP ABAP.

Specifying An Endpoint In Code

The first option mirrors the functionality of AWS's other AWS SDKs, as shown in this re:Post article. In the AWS SDK for SAP ABAP, custom endpoints are specified when creating the SDK client using a module's factory method. In this example, we override the calculated endpoint with a custom endpoint:

DATA(lo_rsh) = /aws1/cl_rsh_factory=>create(
  io_session = lo_session
  iv_custom_endpoint = |https://vpce-123.redshift.us-east-1.vpce.amazonaws.com|
).

It is preferable to avoid hardcoding the custom endpoint in code, since it is likely an SAP landscape will have different endpoints for development, QA, and production. A customer could create their own customizing table, or use the AWS SDK for SAP ABAP's own "logical resource resolver":

DATA(lv_rsh_endpoint) = lo_resolver->resolve_lresource( 'RSH_ENDPOINT' ).
DATA(lo_rsh) = /aws1/cl_rsh_factory=>create(
  io_session = lo_session
  iv_custom_endpoint = lv_rsh_endpoint
).

Advanced Routing To Endpoints In Configuration

One disadvantage of the approach above is that everywhere in your code where you create an SDK client, you must remember to specify the iv_custom_endpoint argument. That's why we introduced an advanced routing feature in the SDK release v1.17.0 which allows the endpoints to be configured centrally. This new feature is part of the SDK Profile configuration in the IMG transaction /AWS1/IMG. For each module's TLA (three-letter abbreviation), you specify the URL of the desired endpoint.

The configuration is organized by SID and client, so that each system can have its own endpoints. As with other SDK Profile configuration, the entire landscape is configured in development and transported through to production, and each execution looks up its own SID and client at runtime to find the correct configuration. This approach means that QA systems do not need adjustment after a system refresh, because all systems have the configuration for the entire landscape.

With this configuration, the factory methods can be called with no endpoint specified, and the endpoint will be determined from the IMG configuration. If no endpoint is specified, the default calculated endpoint will be used.

DATA(lo_rsh) = /aws1/cl_rsh_factory=>create( io_session = lo_session ).

The configuration applies across all the ABAP code in the SAP system, but if different endpoints are required in different applications, customers can define multiple SDK Profiles to flexibly manage different configuration for each business function. Customers who have previously set the endpoint with the iv_custom_endpoint factory argument can remove that argument from all their factory method calls after configuring the central IMG table.

Conclusion

The AWS SDK for SAP ABAP allows customers to access AWS services without traversing the internet, using VPC endpoints, specified programmatically or in configuration. The new configuration option has the advantages of:

• Centralized configuration in an intuitive table • No dependency on specific code to explicitly choose a custom endpoint • Scales well as your use of AWS services grows

This feature will be of particular interest to customers deployed in SAP RISE, customers hosted by managed service providers, and customers with specific security or compliance requirements.

References

• Amazon VPC - Access an AWS service using an interface VPC endpoint
• AWS SDK for SAP ABAP - Custom interface endpoints
• AWS SDK for SAP ABAP - Advanced routing