AWS Certified SAP on AWS Specialty - Hands On Guide

Learn to create an AWS account, secure the root user with MFA, and configure an IAM admin user with access keys and budgeting for hands-on cloud work.

Enable multi-factor authentication for the AWS root user using a virtual MFA device like Google Authenticator, including QR code setup and two consecutive codes for activation.

Create a cost budget in AWS to monitor spending and receive email alerts, while exploring the free tier and using the billing dashboard, cost explorer, and budget templates.

Explore the AWS global infrastructure—regions, availability zones with data centers, edge locations, and low-latency links—plus global versus region-scoped services and SAP on AWS tooling.

Explore the six pillars of the AWS Well-Architected Framework—operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability—and learn how the AWS Well-Architected Tool and SAP Lens guide workload reviews.

Explore YAML, a human-friendly data serialization format used for templates and configuration files, and learn its syntax with key-value pairs, indentation rules using spaces, and list and block notations.

Explore how AWS VPC enables isolated networks for SAP workloads, covering default VPC, CIDR blocks, public and private subnets, internet gateway, NAT gateway, and security controls.

Explore how to create and configure a custom VPC, attach an internet gateway, and update route tables to enable external access for a 10.0.0.0/16 VPC.

Create four subnets in the SAP HANA custom VPC with /20 CIDR blocks, two public and two private in US East 1A and 1B.

Launch your first EC2 instance in the AWS console using a Linux AMI and t2.micro, with an SSH key, IAM role for SSM, a public subnet, and CloudWatch monitoring.

Connect to your EC2 instance via SSM session manager, EC2 instance connect, SSH, or CloudShell, and adjust security group rules to allow SSH from AWS IP ranges.

Explore how Amazon CloudWatch monitors resources and applications across AWS and on premises, captures default and custom metrics with an agent, and supports alarms and event-driven workflows.

Set up a CloudWatch alarm for an EC2 instance CPU utilization with a 70% threshold on a one-minute period, and use the stress utility to generate load.

Discover how AWS CloudFormation enables infrastructure as code by provisioning AWS and third-party resources from JSON or YAML templates, managing stacks, updates, rollbacks, and change sets, and using CloudFormation Designer.

Master hands on cloud formation by launching an EC2 instance with a YAML template in VS Code, defining parameters, resources, and outputs, and embedding a base64 user data script.

Deploy EC2 instances with CloudFormation, parameterize subnets across availability zones, and verify stacks via the console and session manager. The hands-on lab demonstrates automated AWS deployments.

Explore AWS EC2 storage options, including device storage with EBS and instance store volumes, and shared storage with EFS, FSx, and S3 for SAP workloads.

Reboot the EC2 instance, connect via terminal, auto mount the EBS volume by UUID in /etc/fstab for /data with xfs, then detach and attach to another instance or via snapshot.

Copy an EBS volume across availability zones or regions by creating and copying a snapshot, then creating a new volume from that snapshot in the target location.

Clean up all resources created so far by terminating EC2 instances, deleting CloudFormation stacks with AWS CLI, and removing EBS volumes and snapshots to avoid extra charges.

Create and configure an EFS file system in a custom VPC, enable DNS host names, set security groups, and mount it on two EC2 instances to verify shared access.

Hands-on guide to creating an AWS managed Microsoft AD, joining a Windows EC2 instance to the domain, configuring DNS, installing AD tools, and preparing FSx for Windows File Server.

Create an Amazon FSx for Windows file server in a custom VPC, attach it to Windows EC2 instances, configure Active Directory integration, and test cross-AZ network drive access.

Explore EC2 instance types—general purpose, compute-optimized, memory-optimized, storage-optimized; compare on-demand, reserved instances, savings plans, and SAPS rating for SAP workloads.

Learn how EC2 user data bootstraps post-launch scripts at first boot to update the OS, install software, and auto mount EFS or EBS volumes; reuse across instances for automated deployments.

Learn that the EC2 instance profile is a container for the IAM role attached to EC2 instances, enabling access to S3 and SSM session manager, and offering bastion host alternatives.

Explore EC2 features that protect SAP workloads, including system and instance status checks, auto-recovery, and termination and stop protections; use hibernate for suspend-to-disk with max 60 days.

Understand EC2 AMIs, region-scoped operating system images for launching instances, including AWS marketplace and partner AMIs. Use Golden AMIs and EC2 image builder to copy, share, and automate SAP-ready deployments.

Explore CloudWatch agent for EC2, which collects disk I/O, memory, and processes from EC2 and on-premises servers, configured via JSON or wizard, installed via CLI, and managed with SSM.

enable the AWS data provider for SAP on EC2 to collect metrics and instance metadata from EC2, CloudWatch, and S3, with read-only access to EC2, CloudWatch, and S3.

Explore AWS compute services, from AWS Lambda with SAP ABAP support to containerized options like ECS, EKS, and Fargate, plus VMware Cloud on AWS for hybrid cloud migrations.

Explore EBS as block-level, network-attached storage for EC2 and SAP workloads, with SSD and HDD types, multi-attach, snapshots, RAID, and CloudWatch-monitored performance from GP2/GP3 to IO2 Block Express.

Manage incremental EBS snapshots as point‑in‑time backups in S3, accessible via EBS APIs, with cross‑AZ/region copies and restore by creating volumes, plus fast snapshot restore.

Explore EBS-optimized instances delivering dedicated EBS I/O, reducing contention and boosting EBS performance. Enable at launch or stop to enable, and ensure sufficient throughput to avoid bottlenecks for SAP workloads.

Amazon EFS provides shared, POSIX-compliant NFS storage for Linux workloads across VPCs, accounts, and regions. Use cases include HANA shared storage, SAP scale-out, and cross-VPC SAP transport file systems.

Create and manage s3 buckets, learn naming and scope, enable security like block public access and versioning, and upload files via cli and console with signed urls for temporary access.

Compare S3 storage classes, from standard for frequent access to infrequent access and one zone infrequent access. Glacier offers instant, flexible, and deep archive retrieval, while intelligent-tiering auto-saves costs.

Explore S3 storage class analysis to optimize cost by recommending transitions from standard to standard infrequent access, and implement lifecycle rules with tags or prefixes to transition and expire objects.

Enable S3 bucket versioning to preserve, retrieve, and restore object versions. Understand that suspending versioning preserves existing versions, and that a delete marker hides the deleted object.

Explore S3 replication options: same-region and cross-region replication with versioning-enabled buckets and cross-account support. Understand that replication is asynchronous; only new source objects replicate, while batch replication handles existing data.

Connect on-premises applications to AWS cloud storage with AWS Storage Gateway, supporting iSCSI, SMB, and NFS through file, volume, and tape gateways or a hardware appliance.

Centralize and automate backups across AWS services with on demand and scheduled options. Create backup plans and life cycles, enable cross region and cross account backups, and point-in-time recovery.

Discover AWS transfer family to access S3 and EFS with SFTP, FTPS, FTP, and AS2 for B2B transfers, featuring an always-on endpoint and flexible authentication options.

Learn how AWS DataSync enables one-way data replication and migration for SAP on AWS, with on-premises agents, nfs/smb/hdfs support, and both heterogeneous and homogeneous lift-and-shift migrations.

Explore AWS VPC and networking components to understand how a default VPC, custom VPCs, and subnets with CIDR blocks create isolated networks across availability zones, gateways, security groups, and NACLs.

Navigate route tables, subnets, and NACLs in a VPC, covering public/private subnets, IGW, NAT gateway, IPv6 egress only internet gateway, and stateless NACL rules.

Apply security groups to control traffic at the ENI level on AWS resources, using stateful allow rules for inbound and outbound traffic.

Learn how VPC endpoints privately connect your VPC to AWS services, avoiding internet gateways and public IP addresses, with gateway endpoints for S3 and DynamoDB and interface endpoints for others.

Learn how VPC peering enables one-to-one, non-transitive connectivity, and how site-to-site VPN with VGW, Direct Connect, Global Accelerator, and Transit Gateway simplify secure multi-VPC networks—especially for SAP workloads.

Discover VPC flow logs enable monitoring and troubleshooting of network traffic, with options to log accepted, rejected, or all traffic and export to S3, CloudWatch, or Kinesis Firehose for Athena.

Explore the three current elastic load balancers—ALB, NLB, and Gateway Load Balancer—and how they integrate with SAP Web Dispatcher for layer 7 routing, layer 4 traffic, and inline appliances.

Resize EC2 instances to vertically scale by changing the instance type within or across families, ensuring compatibility, stopping the instance with hibernation disabled, and managing auto-scaling groups.

Discover how AWS IAM Identity Center enables single sign-on across AWS accounts and cloud applications, integrating with AD, Azure, and Okta, for workforce authentication and authorization at no extra charge.

Discover how IAM roles and policies grant temporary credentials and define access, and how service control policies govern permissions across AWS organizations with a denial list and an allow list.

Learn how to pass an IAM role to a service within the same account, enabling EC2 to access S3 or SSM via an instance profile, and grant PassRole permissions.

Learn security best practices for AWS IAM, including federation with single sign-on, temporary credentials for workloads, MFA, least privilege, key rotation, and Access Analyzer policy refinement.

Learn AWS KMS for encryption with symmetric and asymmetric keys and automatic rotation, and manage secrets using SSM parameter store and Secrets Manager with IAM controls.