SAP on AWS provides the foundational infrastructure to run one of the world's most complex business software suites reliably and securely in the cloud. For the PAS-C01 exam, you need to understand how AWS's physical datacentres, certification requirements, and support models fit together to support SAP workloads. This knowledge is the bedrock upon which every migration and operational decision is built.
Jump to a section
A simple way to picture SAP on AWS Foundations and Core Concepts
An allotment garden is a small piece of rented land where people grow their own vegetables. The garden itself is the physical space, the soil is the foundation, and the shed holds your tools. Running SAP on AWS is like taking over a fully prepared allotment plot from a master gardener, rather than having to dig up a wild field yourself.
When you rent an allotment, the land is already measured, fenced, and has water access. AWS does the same with its data centres. SAP, a complex business software suite, needs a reliable, secure, and powerful 'garden' to grow in. AWS provides this as a service: the Global Infrastructure. Just as a gardener doesn't build the fence or lay the water pipes, an SAP on AWS administrator doesn't build the physical servers, networking cables, or cooling systems.
AWS has multiple 'allotment sites' (Regions) around the world. Each Region has multiple 'garden plots' (Availability Zones) that are close enough to share tools but far enough apart that if a storm destroys one plot, another is still fine. SAP certifies that its software will only grow properly in certain AWS gardens. If you try to plant a prize-winning pumpkin in a plot that hasn't been prepared, it might die. SAP's support model is like the allotment association's rules: you agree to use specific tools (certified instance types) and follow a shared responsibility model, where AWS maintains the fence and water supply, but you are responsible for watering your own plants and weeding your own rows.
At its heart, running SAP on AWS is about taking a very large, very important business software application (SAP) and placing it onto computing resources that are rented from Amazon (AWS), rather than buying and managing those computers yourself. To understand this, you first need to grasp the concept of an SAP Application. SAP (Systems, Applications, and Products in Data Processing) is a type of software called an Enterprise Resource Planning (ERP) system. Businesses use it to manage everything from accounting and payroll to supply chain and inventory. It is the central nervous system of a large company. If SAP goes down, the business can grind to a halt. This means the underlying computer systems need to be incredibly reliable.
Now consider AWS Global Infrastructure. This is the physical network of servers, data centres, and cables that AWS owns and operates worldwide. It is not a single room of computers. It is a massive, distributed system designed for fault tolerance and low latency. The key components are:
AWS Regions: These are distinct geographical locations, like 'Europe (Frankfurt)' or 'US East (N. Virginia)'. Each Region is a completely separate, isolated area. SAP workloads should be run in a Region that is close to the company's users and legal jurisdiction (e.g., European data must often stay in Europe).
Availability Zones (AZs): Each Region contains multiple (usually 3) Availability Zones. An AZ is one or more physical data centres with redundant power, networking, and connectivity. They are connected to each other with very fast, private fibre optic cables. Crucially, they are far enough apart that a natural disaster (like a flood or earthquake) is unlikely to affect more than one AZ at a time, but close enough that data can flow between them with very low latency. For SAP, this is vital. You can run your SAP system in a 'highly available' configuration, meaning if one AZ fails, the SAP system automatically continues running in another AZ without downtime.
Edge Locations and Regional Edge Caches: These are smaller sites used by services like Amazon CloudFront to deliver content (like web pages or patches) faster to users. While less critical for the core SAP database, they are important for distributing reports or static content.
Next is the concept of SAP Certifications. SAP is a very particular piece of software. It requires specific hardware configurations to run correctly and be supported by SAP themselves. AWS and SAP have a formal partnership. SAP certifies specific types of AWS virtual machines (called Amazon EC2 instance types) to run SAP. These certified instance types have been tested by SAP to ensure the CPU, memory, and networking characteristics meet SAP's strict performance standards. If you choose an EC2 type that is not on the SAP-certified list, SAP will not provide support for your system if something goes wrong. This is not optional for the exam. The certification covers the operating systems (like SUSE Linux Enterprise Server and Red Hat Enterprise Linux) and the databases (like SAP HANA, Oracle, and Microsoft SQL Server) that can run on those instances.
Finally, there are Support Models. AWS operates on a Shared Responsibility Model. AWS is responsible for the security 'of' the cloud. This means they secure the physical data centres, the host operating system, and the virtualisation layer. You, the customer, are responsible for security 'in' the cloud. This means you manage the guest operating system (patching it), the SAP application itself, network configurations (firewalls), and data encryption. SAP's own support model involves a 'waiver concept'. To get full SAP support for an OS or database version, you must stick to SAP's published product availability matrix (PAM). The exam will test that you understand this shared responsibility: AWS handles the physical metal and network infrastructure up to the hypervisor; you handle everything else in the virtual machine, including SAP and its configuration.
1. Choose an AWS Region
You select a geographic Region (e.g., eu-west-2 for London) based on proximity to users and legal data residency requirements. This step defines where all your SAP resources will be deployed. The exam tests that you understand you cannot run production SAP in a Region that violates data sovereignty laws.
2. Select Certified EC2 Instance Types
You consult the SAP Certified Hardware Directory to pick a specific EC2 instance type (e.g., r5.8xlarge) that is certified for your SAP database (e.g., SAP HANA). This is non-negotiable for SAP support. The exam will give you a list of instance types, and you must pick only the certified one.
3. Design for Multi-AZ High Availability
You plan to deploy your SAP application and database servers across at least two Availability Zones within the chosen Region. This ensures that if one data centre fails, your SAP system continues running on the other AZ. The exam expects you to know this is a requirement for production, not a suggestion.
4. Configure Network Connectivity (Direct Connect vs VPN)
You set up a fast, private connection between your on-premise network and AWS, typically using AWS Direct Connect. This allows your users to access the SAP system securely with low latency. The exam will quiz you on when to use Direct Connect (production, predictable latency) versus a VPN (test/dev, lower cost).
5. Establish the Shared Responsibility Model
You define who does what. You assign your team to manage the SAP application, database, and guest OS patching. AWS is responsible for the physical servers, networking, and the virtualisation platform. The exam will present a list of tasks (e.g., 'patch the SAP kernel') and you must assign them to the correct party.
6. Review SAP PAM and Request Waivers (If Needed)
You check the SAP Product Availability Matrix (PAM) to confirm your chosen OS and database version are officially supported. If you need to use an unsupported version, you submit a waiver request to SAP. The exam tests that waivers are an exception, not the norm, and that they involve risk.
You are an IT administrator at 'GlobalTech Manufacturing', a mid-sized company that currently runs its SAP ERP system on physical servers in a dusty server room under the office stairs. The server is old, the maintenance contract is expiring, and the finance team complains about slow month-end closing. Your boss tells you: 'Migrate SAP to AWS.'
Here is what you actually do:
First, you plan the Region. Your company's main office is in London, and all its employees are in the UK and Europe. You select the AWS Europe (London) Region because it minimises network delay (latency) for your users and helps comply with data residency laws. You do not pick a Region in the US because it would be too far away and data transfer costs would be higher.
Next, you architect for Availability Zones. You decide to use a multi-AZ setup. You will create your SAP primary application server and its database in one Availability Zone (e.g., AZ-a). You then set up a secondary, passive system (a standby) in another Availability Zone (AZ-b). If the power fails in the data centre corresponding to AZ-a, your SAP system automatically fails over to the standby in AZ-b, and employees can keep working. You also use a third AZ for log backup storage.
You then choose the EC2 instance type. You cannot pick any general-purpose server. You consult the SAP Certified and Supported SAP HANA Hardware Directory on the SAP website. You find that a specific 'r5.8xlarge' instance is certified for your SAP HANA database workload. You select this exact type. If you had mistakenly chosen a non-certified instance, SAP would refuse to troubleshoot any database corruption issue, leaving you stranded.
You set up the operating system. You select a pre-approved AMI (Amazon Machine Image) for SUSE Linux Enterprise Server 15 for SAP. This image includes the necessary kernel parameters and SAP libraries pre-configured. You do not build it from a standard Ubuntu image, because that would not be certified.
Finally, you configure the support. You purchase an AWS Support plan (like Business or Enterprise) that includes access to AWS Support for infrastructure issues. Separately, you maintain your SAP support contract with SAP directly. You accept the Shared Responsibility Model: AWS handles a failed physical disk; you handle a misconfigured SAP kernel parameter. You also submit a 'waiver' request to SAP if you need to use a specific OS version that is not yet officially listed, but you avoid this wherever possible because it adds risk to support.
This entire process is about leveraging the AWS Global Infrastructure, sticking to SAP's certifications, and understanding who is responsible for what. The exam expects you to recognise that these three concepts are the non-negotiable starting point for any SAP on AWS project.
The PAS-C01 exam tests 'SAP on AWS Foundations and Core Concepts' relentlessly because it is Domain 1. If you get these basics wrong in a question, you will fail the entire scenario. The exam questions are crafted to see if you know the difference between a general cloud concept and a specific SAP requirement.
What exactly do they test? - AWS Global Infrastructure Fundamentals: Expect at least 2-3 questions on the difference between a Region and an Availability Zone. The trap is that AWS has a term 'Multi-AZ' which in the context of a managed database (like Amazon RDS) means one AZ for primary and one for standby. But for SAP, 'Multi-AZ deployment' always implies deploying application and database servers across physical AZs for high availability. A common wrong answer is to suggest a single AZ deployment for a Production SAP system, which is a disaster waiting to happen. - SAP Certifications and the SAP PAM (Product Availability Matrix): This is a favourite topic. Questions will describe a scenario where an architect chooses a specific EC2 instance type for SAP HANA. The correct answer is the one that mentions checking the 'SAP Certified Hardware Directory' or 'SAP HANA Hardware Directory'. The trap is that other instances might look similar on paper (same vCPU count, same memory) but are not certified. You must memorise that SAP and AWS maintain this list, and ignoring it means SAP will deny support. - Shared Responsibility Model: The exam will give you a list of tasks and ask who is responsible. A common trap is a question like: 'Who is responsible for patching the OS kernel on the SAP application server?' The correct answer is 'the customer' (you). AWS is responsible until the hypervisor level. If you incorrectly select 'AWS', you will lose the mark. - SAP Support Models (Waivers): They will test your understanding of what happens when you use an uncertified OS version. The correct answer is that you must apply for a 'waiver' from SAP. The trap answer would be 'it is not a problem' or 'AWS provides a waiver'. - Foundational Concepts of Scalability and Elasticity for SAP: While not a core part of Domain 1, the exam expects you to know that SAP traditionally runs on fixed hardware (scale up) but AWS allows you to change instance types (scale up/down). A question might ask: 'What is the main benefit of running SAP on AWS compared to on-premise?' A correct answer is the ability to quickly resize compute resources for testing or seasonal peaks without ordering new hardware. - Types of AWS Services for SAP: You must distinguish between services. A question might describe a scenario needing fast, dedicated network connectivity between on-premise and AWS. The correct answer is 'AWS Direct Connect', not 'AWS Site-to-Site VPN', because Direct Connect is a dedicated private connection, not a public internet VPN. The trap is that VPN is cheaper, but for SAP’s latency sensitivity, Direct Connect is usually preferred. - High Availability (HA) and Disaster Recovery (DR): The exam tests the difference. HA means keeping the system running through a single AZ failure in the same Region. DR means recovering in a different Region after a catastrophic failure. A question might ask: 'You need to protect against a regional disaster. What architecture do you use?' The correct answer involves 'Multi-Region deployment', not just 'Multi-AZ'. - Networking for SAP: They test security groups (virtual firewalls) and subnets. A common trap is giving overly permissive rules. The correct pattern is to restrict access to specific IP ranges and SAP ports (e.g., port 3200 for SAP Application Server). - AWS Backup and Storage for SAP: They test the use of Amazon Elastic Block Store (EBS) volumes for database storage and Amazon S3 for backups. A trap question will suggest using instance store volumes (temporary block storage that loses data on instance stop) for the SAP HANA database. The correct answer is to use EBS volumes (persistent, durable). - Cost Optimisation: They test Reserved Instances (RIs) and Savings Plans for running SAP consistently. A trap answer is on-demand instances for production, which is more expensive. The correct pattern is to use RIs for predictable, 24/7 production systems and on-demand or spot instances for dev/test (though spot is not recommended for SAP due to interruption risk).
An AWS Region is a separate geographic area, and you must choose the Region closest to your users and compliant with data residency laws for your SAP system.
Availability Zones (AZs) within a single Region are physically separated but connected with low-latency fibre, enabling high-availability SAP architectures.
SAP only provides support for SAP systems running on AWS EC2 instance types that are listed in the SAP Certified and Supported Hardware Directory.
Under the Shared Responsibility Model, AWS is responsible for the cloud infrastructure security, while the customer is responsible for securing the SAP application, guest OS, and data inside the virtual machine.
Production SAP systems must be deployed across multiple Availability Zones to avoid a single point of failure; a single AZ deployment is not acceptable for production workloads.
AWS Direct Connect provides a dedicated, private, and consistent network connection for SAP, which is preferred over a public VPN for production environments.
The SAP Product Availability Matrix (PAM) is the official document that defines which operating systems and database versions are supported with specific SAP releases on AWS.
If you use an uncertified OS or instance type, you must request a waiver from SAP, which adds support risk and is not recommended for production.
Amazon EC2 instances are virtual servers; for SAP, you must choose memory-optimised families (e.g., R5, X1e) that are certified for SAP HANA.
High Availability (HA) keeps SAP running during an AZ failure within the same Region, while Disaster Recovery (DR) recovers the system in a different Region after a regional disaster.
These come up on the exam all the time. Here's how to tell them apart.
AWS Region
A large geographic area, e.g., London, Frankfurt, Tokyo.
Contains multiple, isolated Availability Zones.
Used for data sovereignty and compliance; all AZs in a Region share the same legal jurisdiction.
Availability Zone (AZ)
One or more physical data centres within a Region.
Isolated from other AZs to prevent single points of failure.
Used for high availability; you deploy resources across multiple AZs for fault tolerance.
AWS Direct Connect
A dedicated, private physical connection from your data centre to AWS.
Provides consistent, low-latency network performance.
Preferred for production SAP workloads requiring stable throughput.
AWS Site-to-Site VPN
An encrypted connection over the public internet.
Subject to variable internet congestion and latency.
Suitable for test/dev environments or as a backup connection.
High Availability (HA)
Keeps the system running immediately after a component or AZ failure.
Operates within the same AWS Region across multiple AZs.
Uses synchronous or near-synchronous data replication for zero data loss.
Disaster Recovery (DR)
Restores the system from a backup after a catastrophic regional disaster.
Involves a secondary Region (e.g., London to Frankfurt).
Has recovery time objective (RTO) and recovery point objective (RPO) measured in minutes or hours.
On-Demand EC2 Instance
Pay per hour with no long-term commitment.
Most expensive option for steady-state workloads.
Ideal for short-term, unpredictable, or test workloads.
Reserved EC2 Instance (RI)
One- or three-year contract offering significant discount (up to 72%).
Most cost-effective for production SAP systems running 24/7.
Requires upfront planning to estimate capacity needs.
Shared Responsibility (Customer)
Secures the data inside the virtual machine (encryption, access control).
Patches and configures the guest operating system and SAP application.
Manages network firewall rules (Security Groups) and IAM user permissions.
Shared Responsibility (AWS)
Secures the physical data centres, power, and cooling.
Maintains the hypervisor and host operating system.
Provides the foundation of the network (VPC, Direct Connect) and global infrastructure.
SAP Certified Instance Type
Explicitly listed in the SAP HANA Hardware Directory.
Has been tested by SAP for performance and stability.
SAP support is guaranteed if an issue occurs.
General-Purpose EC2 Instance
Not listed in the SAP HANA Hardware Directory.
May have similar specifications but is not validated by SAP.
SAP will deny support for any issue on this instance type.
Mistake
AWS handles everything to do with my SAP system once I run it in their cloud.
Correct
AWS is responsible for the physical hardware and network infrastructure up to the virtualisation layer. The customer is responsible for everything inside the virtual machine, including the SAP application, operating system, and database configuration.
This comes from using public cloud services for simpler workloads (like a website), where the service provider does manage more. SAP is a complex enterprise application where the customer must manage the application stack itself.
Mistake
Any fast EC2 instance will work perfectly for SAP HANA.
Correct
Only EC2 instance types that are listed on the SAP Certified and Supported SAP HANA Hardware Directory are guaranteed to work and receive support from SAP. Using an uncertified instance voids SAP support for performance and stability issues.
People assume that because cloud instances are 'virtual', they are all the same. They do not realise that SAP tests specific hardware configurations (CPU, memory allocation, network characteristics) and only certifies those exact types.
Mistake
The 'Shared Responsibility Model' means I am only responsible for what I explicitly configure.
Correct
The model defines clear boundaries. AWS secures the physical data centre, the host OS, and the virtual network. The customer secures the guest OS, the application (SAP), the database, and the customer's data. It is a strict division, not a grey area.
Newcomers think it is a flexible partnership. The exam tests it as a rigid line. The customer often overlooks that they must patch the guest OS themselves.
Mistake
A single Availability Zone is fine for a production SAP system because AWS is reliable.
Correct
A single AZ is a single point of failure. AWS recommends and SAP requires a multi-AZ deployment for production systems to ensure high availability. If an AZ fails, the system will be down.
People confuse the high reliability of AWS's infrastructure with fault tolerance. AWS’s reliability means a single server rarely fails. But an entire AZ can fail (e.g., due to a power outage), and that would take down a single-AZ deployment.
Mistake
AWS Regions and Availability Zones mean the same thing.
Correct
A Region is a large geographic area containing multiple, isolated Availability Zones. An Availability Zone is one or more physical data centres within a Region. They are not interchangeable. You deploy across AZs within a single Region for high availability, and across Regions for disaster recovery.
The terminology is similar and often used interchangeably in AWS marketing. Beginners do not grasp the hierarchical relationship until they see the failure scenarios.
Mistake
I can use an AWS VPN (Site-to-Site) instead of AWS Direct Connect for my SAP production system and it will be fine.
Correct
For production SAP workloads, AWS Direct Connect is generally recommended due to its consistent, low-latency, and private network connection. A VPN traverses the public internet, which can introduce variable latency and jitter that are problematic for SAP's real-time transaction processing.
VPNs are cheaper and easier to set up, so beginners naturally think they are the better choice. They do not appreciate the strict networking demands of SAP, particularly for database replication and user interaction.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An AWS Region is a large geographic area (e.g., London) containing several isolated Availability Zones. An Availability Zone is one or more physical data centres within that Region. You deploy across Availability Zones for high availability, but you stay within one Region for low latency.
No, you do not need a personal certification. The EC2 instance types and operating systems must be certified by SAP. This is about SAP's hardware certification, not a person's certification. You must choose from the SAP Certified Hardware Directory.
SAP will refuse to provide technical support for any issues related to performance, stability, or data corruption on that system. You should only use instance types that are explicitly listed in the SAP HANA Hardware Directory.
No. Under the Shared Responsibility Model, AWS manages the physical infrastructure up to the hypervisor. You are responsible for all software inside the virtual machine, including the SAP application, the database, and the operating system patches.
It is strongly discouraged and considered a single point of failure. For a production system, you must deploy across at least two Availability Zones within the same Region to achieve high availability. AWS recommends this, and it is a common exam requirement.
It is a document published by SAP that lists which operating systems and database versions are officially supported for each SAP release. You must check the PAM before setting up SAP on any cloud platform, including AWS.
You've finished SAP on AWS Foundations and Core Concepts. Continue through the PAS-C01 study guide to build a complete picture of the exam.
Done with this chapter?