Domain 3.4 of the PAS-C01 exam requires you to apply security best practices for SAP on AWS, covering identity management, encryption, network security, and compliance frameworks. This matters because SAP systems hold some of a company’s most sensitive data – financial records, employee details, customer information – so a single misconfiguration can lead to a data breach or regulatory fine. As a beginner studying for this exam, you need to understand how AWS security services work together to protect an SAP environment without needing to become a security expert overnight.
Jump to a section
A simple way to picture SAP Security and Compliance on AWS
An apartment building is a shared structure with many separate living spaces, each needing its own protection.
In this building, the front door is locked with a special fob that only residents possess – this is like AWS Identity and Access Management (IAM), where each person gets a unique credential to enter the AWS environment. The building has a guard desk that checks every visitor against an approved list before allowing them upstairs – this mirrors network security features like security groups and network access control lists (ACLs) that inspect every packet trying to reach an SAP system.
Each apartment door has its own deadbolt, which a tenant can lock from the inside – this represents encryption at rest: data stored on AWS volumes is scrambled so that even if someone breaks into the physical data centre, they cannot read the files without the key. The building manager also encrypts all mail that arrives in the post room before handing it to the tenant – this is like encryption in transit, which protects data moving between SAP applications and databases.
Finally, the building must follow strict fire safety and accessibility laws, and it undergoes annual inspections to prove compliance – this is analogous to AWS compliance frameworks (like SOC, ISO, and GDPR) that SAP customers rely on to meet their regulatory obligations. Every part of the building works together to keep the residents safe, just as every AWS security service works together to protect an SAP workload.
SAP Security and Compliance on AWS is about protecting your SAP systems from unauthorised access, data leaks, and compliance failures while they run on Amazon Web Services. Because SAP is often the backbone of a company’s operations, securing it is not optional – it is a legal and business necessity. Let’s break down the four main pillars: identity and access management (IAM), encryption, network security, and compliance frameworks.
Identity and Access Management (IAM) is the system that controls who can do what inside your AWS account. Think of IAM as the master list of keys and permissions for your cloud building. You create IAM users for each person, IAM groups for teams (like “SAP-Admin”), and IAM roles for services to assume temporary permissions. The key principle is “least privilege” – give only the minimum permissions required to do a job. For SAP, you might create an IAM role that allows the SAP application server to read a specific Amazon S3 bucket for backups, but nothing else. AWS IAM also supports identity federation, meaning you can connect your company’s existing Microsoft Entra ID (formerly Azure Active Directory) or other identity provider to AWS, so users log in with their corporate credentials instead of creating new AWS passwords.
Encryption is the process of scrambling data so that only authorised parties can read it. There are two main types:
Encryption at rest protects data stored on disks – for example, SAP HANA databases and EBS volumes. AWS offers Key Management Service (KMS) to create and manage encryption keys. You can choose to encrypt an EBS volume when you create it, and AWS handles the encryption automatically when data is written and decryption when it is read.
Encryption in transit protects data moving across the network – for instance, between an SAP application server and a database server. You enable this by using TLS (Transport Layer Security) certificates for SAP connections. All SAP-to-database traffic should be encrypted, and AWS recommends using only encrypted connections (like HTTPS) for SAP Fiori and web interfaces.
Network security is about controlling which traffic can reach your SAP systems. The main tools are:
Virtual Private Cloud (VPC): your own private network inside AWS, isolated from other customers.
Security groups: virtual firewalls for individual resources (like an EC2 instance running SAP). You define rules that allow or deny traffic based on IP addresses, ports, and protocols. For SAP, you must open specific ports for SAProuter, SAP application servers, and database connections – and close everything else.
Network Access Control Lists (NACLs): stateless firewalls at the subnet level, providing an extra layer of filtering.
AWS WAF (Web Application Firewall): protects SAP web applications from common attacks like SQL injection and cross-site scripting.
AWS Shield: protects against Distributed Denial of Service (DDoS) attacks.
Compliance frameworks are sets of standards that organisations must follow to meet legal, regulatory, and industry requirements. Common ones include:
SOC (Service Organization Control) reports for financial audits.
ISO 27001 for information security management.
GDPR for handling personal data of EU citizens.
HIPAA for healthcare data in the US.
PCI DSS for payment card data.
AWS provides compliance certifications for its infrastructure, but the customer (you) is responsible for securing what runs on top of that infrastructure – this is called the Shared Responsibility Model. For SAP, you must ensure your SAP configuration itself meets compliance standards, not just the underlying AWS platform. AWS provides services like AWS Config and AWS Audit Manager to help automate compliance checks and generate reports.
Finally, security monitoring is vital. AWS CloudTrail logs all API calls made in your account, so you can see who did what and when. Amazon GuardDuty uses machine learning to detect suspicious behaviour. And AWS Security Hub gives you a single dashboard to view security alerts across all your accounts. For SAP, you should also enable SAP security audit logs and integrate them with AWS services for centralised monitoring.
Set Up IAM Roles and Policies
Create IAM roles for your SAP EC2 instances (e.g., SAPAppServerRole, SAPDatabaseRole) with only the permissions needed. For example, allow the app server role to write backups to a specific S3 bucket. Attach the role to each instance at launch. This ensures no long-term credentials are stored on the instance.
Enable Encryption at Rest
Create a customer-managed KMS key for SAP data. When launching EC2 instances, enable EBS encryption and select your KMS key. For S3 buckets used for SAP backups, enable default encryption (SSE-S3 or SSE-KMS). This protects data even if physical storage media is stolen.
Configure Network Security Groups and NACLs
Design a VPC with separate subnets for web, app, and database tiers. Create a security group for each tier with rules that allow only necessary traffic. For example, the database security group allows inbound on port 30015 only from the app server security group. Add a NACL at the subnet level for an extra layer of filtering.
Enable Encryption in Transit
Configure TLS certificates for all SAP-to-database connections. Enable HTTPS on the SAP Fiori web gateway. Use AWS Certificate Manager (ACM) to provision and manage SSL/TLS certificates for public-facing endpoints. This protects data as it travels across the network.
Set Up Compliance Monitoring with AWS Config and Audit Manager
Define AWS Config rules to check for common misconfigurations (e.g., ‘encrypted-volumes’ rule). Enable AWS Audit Manager and select the SAP-relevant compliance framework (e.g., ISO 27001). Audit Manager will continuously collect evidence and generate reports for audits.
Enable Security Logging and Monitoring
Turn on AWS CloudTrail to log all API calls. Stream CloudTrail logs to Amazon CloudWatch Logs. Set up a metric filter to detect suspicious activity (e.g., changes to security groups). Integrate SAP security audit logs with AWS Security Hub for a unified view of alerts.
Let’s walk through a realistic scenario. A mid-sized manufacturing company called “EuroParts Ltd” runs its SAP ERP system on AWS to manage inventory, orders, and financials. They have just migrated from an on-premises data centre and need to ensure their SAP environment is secure and compliant with ISO 27001.
First, the IT team sets up IAM. They create an IAM group called “SAP-Admin” and attach a policy that allows full access to EC2 instances tagged as “SAP”. They then add two system administrators to this group. For the SAP application itself, they create an IAM role named “SAP-Backup-Role” that permits only PutObject and GetObject actions on a specific S3 bucket called “europarts-sap-backups”. The SAP backup script assumes this role when it runs. This follows the principle of least privilege: the backup script can only write to and read from that one bucket, not access other S3 data.
Next, they tackle encryption. The team enables default encryption on the SAP HANA database EBS volumes using AWS KMS. They create a customer-managed key specifically for SAP workloads so that no other department can accidentally decrypt SAP data. For in-transit encryption, they configure TLS certificates for all SAP application-to-database connections and enable HTTPS on the SAP Fiori web gateway. They also encrypt the S3 backup bucket using server-side encryption with S3-managed keys (SSE-S3).
For network security, they design a VPC with three subnets: a public subnet for the SAP Fiori web server (which needs internet access), a private subnet for the SAP application server, and an isolated subnet for the SAP HANA database. They configure security groups so that:
The web server security group allows inbound HTTPS (port 443) from the internet and outbound traffic to the application server on port 50000.
The application server security group allows inbound from the web server on port 50000 and outbound to the database on port 30015 (SAP HANA default).
The database security group allows inbound only from the application server security group on port 30015.
All other inbound traffic is denied by default.
They add a Network ACL to block traffic from known malicious IP ranges and enable AWS Shield Advanced for DDoS protection on the web-facing endpoint. They also deploy AWS WAF rules to block SQL injection attempts against the Fiori login page.
For compliance, they use AWS Config to define rules that check for common misconfigurations, such as “is EBS encryption enabled?” and “are security groups too permissive?” They set up AWS Audit Manager to continuously assess their SAP environment against the ISO 27001 framework. When the annual audit arrives, they generate a compliance report directly from Audit Manager, showing that all encryption is enabled, access controls are in place, and network security is correctly configured – saving weeks of manual evidence gathering.
Finally, they enable CloudTrail to log all AWS API calls and stream those logs to Amazon CloudWatch Logs. They set up a metric filter to detect when an IAM user creates or modifies a security group, triggering an alert to the security team’s email. They also integrate SAP security audit logs with AWS Security Hub to view alerts from both systems in one place.
The PAS-C01 exam tests Domain 3.4 specifically through scenario-based questions that ask you to choose the most secure and compliant configuration for an SAP environment. You will not be asked to write AWS CLI commands, but you will need to know which AWS service to use in a given situation and why.
Exam topics that appear frequently:
The Shared Responsibility Model: AWS is responsible for security of the cloud (physical data centres, hardware, networking), and the customer is responsible for security in the cloud (IAM, encryption, OS patches, SAP configuration). Questions often present a scenario and ask which responsibility belongs to the customer vs. AWS.
IAM roles vs. IAM users: Questions love to test whether you use an IAM role for an EC2 instance (because it provides temporary credentials) or an IAM user for a human. A common trap is suggesting ‘store an IAM access key on the instance’ – the correct pattern is always to use an IAM role attached to the instance.
Encryption types: Know the difference between encryption at rest (EBS encryption, S3 server-side encryption) and encryption in transit (TLS/SSL). The exam may ask: “An SAP application must ensure data is encrypted while being sent from the web server to the database. Which solution should you use?” Answer: TLS encryption on the database connection.
Security groups vs. NACLs: Security groups are stateful (if you allow inbound, the response outbound is automatically allowed), NACLs are stateless (you must explicitly allow both inbound and outbound). A question might describe a network filtering requirement and ask which tool to use – if it needs stateful tracking, the answer is security group.
AWS KMS key types: Customer-managed keys (CMKs) give you more control (you can rotate, disable, and set policies) versus AWS managed keys (automatic, less control). For SAP compliance, you typically want CMKs to prove you control the keys.
Common traps set by the exam:
Suggesting you use the same security group for web and database tiers because it’s simpler – the correct answer is separate security groups with least privilege rules.
Telling you to store database passwords in plain text in a configuration file – you should use AWS Secrets Manager or AWS Systems Manager Parameter Store instead.
Proposing EC2-Classic (the old shared network model) instead of a VPC – the exam will always assume you are using a VPC.
Forgetting that SAP HANA requires specific ports; the exam expects you to know the common ports (e.g., 30015 for HANA, 50000 for SAP Application Server).
Key definitions to memorise:
IAM role: A set of permissions that an AWS service can assume, without long-term credentials.
Security group: A stateful virtual firewall that controls traffic to one or more EC2 instances.
NACL: A stateless firewall that controls traffic at the subnet level.
AWS KMS: A service for creating and managing encryption keys.
AWS Config: A service that evaluates your AWS resources against desired configurations for compliance.
AWS Audit Manager: A service that continuously audits your environment against frameworks like ISO 27001, GDPR, and SOC 2.
You will also see questions about compliance frameworks – for example, “Which AWS service helps you demonstrate compliance with GDPR for an SAP system?” The answer is AWS Audit Manager, because it automates evidence collection. Another common question: “What is the customer’s responsibility under the Shared Responsibility Model for an SAP workload?” The correct answer includes managing IAM users, encrypting data at rest, and patching the SAP OS.
The Shared Responsibility Model means AWS secures the cloud infrastructure, and you secure everything you run on it, including SAP applications, IAM policies, and data encryption.
Always use IAM roles for EC2 instances and AWS services, never store long-term access keys on an instance.
Encryption at rest and encryption in transit are two separate requirements — both must be explicitly configured for SAP workloads on AWS.
Use separate security groups for each application tier (web, application, database) and apply the principle of least privilege to reduce the attack surface.
AWS KMS customer-managed keys give you full control over encryption keys, which is essential for compliance audits in SAP environments.
AWS Audit Manager automates evidence collection for compliance frameworks like ISO 27001 and GDPR, saving weeks of manual work for SAP systems.
These come up on the exam all the time. Here's how to tell them apart.
IAM Role
Used by AWS services (EC2, Lambda) to get temporary credentials.
Credentials rotate automatically every few hours.
No long-term access keys to manage or lose.
IAM User
Used by human users or applications that need permanent credentials.
Credentials are long-term (access key ID and secret access key).
Must manually rotate keys and store them securely.
Security Group
Stateful: if inbound is allowed, response outbound is automatically allowed.
Operates at the resource level (e.g., one EC2 instance).
Supports allow rules only; denies must be explicit by omission.
Network ACL (NACL)
Stateless: you must explicitly allow both inbound and outbound traffic.
Operates at the subnet level (affects all resources in that subnet).
Supports both allow and deny rules (numbered list).
Encryption at Rest (EBS/S3)
Protects data stored on disks or in storage services.
Uses AWS KMS keys (customer or AWS managed).
Enabled per volume or bucket; data is encrypted when written and decrypted when read.
Encryption in Transit (TLS)
Protects data while it travels across the network.
Uses TLS/SSL certificates; no AWS KMS involvement.
Enabled per connection (e.g., HTTPS, TLS on database port).
AWS Config
Evaluates resources against custom or AWS-managed rules for compliance.
Provides a score and details of non-compliant resources.
Good for continuous monitoring and troubleshooting misconfigurations.
AWS Audit Manager
Automates evidence collection for specific compliance frameworks (e.g., SOC, ISO, GDPR).
Generates pre-built reports and readiness assessments.
Good for demonstrating compliance to auditors with less manual work.
Mistake
Once I enable encryption on an EBS volume, all data that ever was on that volume is automatically encrypted.
Correct
Only new data written after encryption is enabled is encrypted. Data that was already on the volume before enabling encryption remains unencrypted. To ensure everything is encrypted, you must create a new encrypted volume and copy the data to it.
Beginners often think encryption is a magical 'overwrite everything' button, but it actually only encrypts data as it is written to disk.
Mistake
Using the same security group for all tiers (web, app, database) is fine because security groups are secure by default.
Correct
Security groups default to deny all inbound traffic, but if you allow any inbound rule, that rule applies to all resources in the group. Using one group for all tiers means any resource can communicate with any other resource inside the group, violating the principle of least privilege.
The word 'group' makes beginners think all resources in the group should be able to talk to each other, missing the point that each tier should be isolated.
Mistake
Compliance frameworks like SOC or ISO are automatically covered because AWS is certified.
Correct
AWS certifications cover the infrastructure layer only. The customer is still responsible for configuring their SAP system and IAM policies to meet compliance requirements. AWS being SOC 2 compliant does not automatically make your SAP workload SOC 2 compliant.
People confuse the cloud provider's compliance with their own compliance, overlooking the Shared Responsibility Model.
Mistake
IAM users are the best way to give permissions to an EC2 instance running SAP.
Correct
The correct approach is to use an IAM role attached to the EC2 instance. IAM users require long-term access keys that could be compromised; IAM roles provide temporary credentials that rotate automatically and are more secure.
The word 'user' sounds like it should apply to a person or a server, but IAM roles are designed specifically for AWS services.
Mistake
AWS WAF and AWS Shield are the same service with different names.
Correct
AWS WAF protects web applications from common web exploits like SQL injection and XSS. AWS Shield protects against DDoS attacks. They complement each other but serve different purposes.
Both deal with 'web security' and have similar acronyms, so beginners conflate them.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
It is strongly recommended and often required for compliance (like GDPR or SOC 2). AWS EBS encryption is free for most volumes and adds no performance penalty, so you should enable it by default.
An IAM role provides temporary credentials that rotate automatically, while an IAM user has long-term access keys that never change unless you rotate them. For EC2 instances, always use an IAM role because it is more secure and easier to manage.
Use AWS Audit Manager to continuously assess your environment against the ISO 27001 framework. It will automatically collect evidence from AWS services (like Config, CloudTrail, and KMS) and show you where you meet or fall short of requirements.
No, you should use separate security groups for each tier. The web server security group should only allow inbound HTTP/HTTPS from the internet, while the database security group should only allow inbound traffic from the app server security group on the database port. This limits the attack surface.
AWS protects the physical infrastructure (data centres, networking, hardware). You are responsible for securing everything you run on that infrastructure, including your SAP OS, applications, IAM configurations, encryption, and network rules.
You can use AWS Site-to-Site VPN or AWS Direct Connect to securely connect your on-premises network to your AWS VPC. This allows your SAP system to communicate across environments without sending data over the public internet.
You've finished SAP Security and Compliance on AWS. Continue through the PAS-C01 study guide to build a complete picture of the exam.
Done with this chapter?