If you've ever needed your SAP system - whether running on-premise, in SAP RISE, or in a managed environment - to access resources in a separate AWS production account, but the path requires passing through an intermediate AWS account first (two hops across three accounts), you've likely run into the challenge of multi-hop cross-account IAM role assumption. The AWS SDK for SAP ABAP now supports role chaining, making multi-hop cross-account access straightforward and secure.

What Is Role Chaining?

Role chaining is a pattern where one AWS profile delegates its authentication to another profile, forming a chain of trust. Each profile in the chain says: "To authenticate me, first authenticate using this other profile, then assume my role".

This mirrors the source_profile parameter available in the AWS CLI and other AWS SDKs (such as Boto3), and is now available natively in the AWS SDK for SAP ABAP.

A Concrete Example

Consider a customer running SAP in an SAP RISE environment who needs to query Athena tables hosted in a dedicated AWS data account. Because the SAP system runs in an SAP-managed environment, it uses IAM Roles Anywhere for base authentication - and the Athena data account requires access to be routed through a central cloud integration account that manages cross-account permissions.

Three profiles are configured in /AWS1/IMG:

• SAP_BASE: Authenticates using IAM Roles Anywhere (using the Trust Anchor ARN, Profile ARN, and IAM Role ARN configured on the SAP system), assuming SapBaseRole in the IAM Roles Anywhere account (Account 111111111111).
• CLOUD_INTEGRATION: Uses “SAP_BASE” credentials (SapBaseRole), then assumes CloudIntegrationRole in the central cloud integration account (Account 222222222222) that manages access to downstream data accounts.
• ATHENA_ACCESS: Uses “CLOUD_INTEGRATION” credentials (CloudIntegrationRole), then assumes AthenaReadRole in the AWS data account (Account 333333333333) where the Athena tables reside.

When your ABAP code uses "ATHENA_ACCESS", the SDK automatically resolves the full chain, executing sequential AssumeRole calls at each step:

SAP_BASE (Account 111111111111, SapBaseRole) → CLOUD_INTEGRATION (Account 222222222222, CloudIntegrationRole) → ATHENA_ACCESS (Account 333333333333, AthenaReadRole)

The final credentials for AthenaReadRole in Account 333333333333 are then used for all Athena API calls.

Configuration

Role chaining is configured in the SDK's IMG transaction /AWS1/IMG. A new authentication method Source Profile has been added to the IAM Auth Method dropdown. When Source Profile is selected for a profile, a Source Profile ID field becomes available to specify the upstream profile.

Using Role Chaining in ABAP Code

Once configured in /AWS1/IMG, using a chained profile requires no special syntax - simply create a session with the target profile as usual:

DATA(lo_session) = /aws1/cl_rt_session_aws=>create( 'ATHENA_ACCESS' ).
DATA(lo_athena)  = /aws1/cl_ath_factory=>create( lo_session ).
DATA(lo_result)  = lo_athena->getnamedquery( 'a1b2c3d4-5678-90ab-cdef-example11111' ).
" Retrieves a saved query from the Athena data account using AthenaReadRole permissions

The SDK handles the full chain resolution and all intermediate AssumeRole calls automatically

Important Considerations

• Chain depth limit - A maximum of 5 profiles are supported in a single chain.
• Circular reference detection - A profile cannot appear more than once in the chain (e.g., A → B → C → B).
• Authorization - Users must have necessary authorizations (/AWS1/SESS and /AWS1/LROL) for all profiles in the chain, including intermediate profiles.

Conclusion

Cross-Account IAM Role Chaining in the AWS SDK for SAP ABAP enables ABAP programs to securely traverse multi-account AWS architectures using a familiar, configuration-driven approach. The SDK handles the full chain of AssumeRole calls automatically, with built-in safeguards for circular references, depth limits, and authorization validation.

This feature is particularly useful for customers with centralized SAP systems that need to access resources across multiple AWS accounts, including those deployed in SAP RISE or managed service provider environments.

If you're new to the AWS SDK for SAP ABAP, refer to the Getting Started page for installation and configuration instructions.

References

• AWS SDK for SAP ABAP Developer Guide:
  • System Authentication
  • Source Profile Authentication
  • Best Practices
• IAM roles, role chaining and source_profile parameter:
  • IAM roles
  • Using an IAM role in the AWS CLI
  • Configuration and credential file settings in the AWS CLI