Work / Infrastructure assessment
Infrastructure assessment, June 2025
Assessment of an SAP S/4HANA estate on AWS
An enterprise ran SAP S/4HANA on 36 EC2 instances in AWS. We assessed the estate in six domains and found 15 or more critical findings and 6,278 USD per month of savings.
The estate
The client ran SAP S/4HANA on AWS on 36 EC2 instances. Infrastructure changes were made by hand in the console. Backups were stored in the production account. We assessed six domains, and each received a rating and a main finding.
Governance, risk and compliance Average
Incomplete logging
Security Average
Instances not scanned
Business continuity Average
Gaps in backup
Operations Low
Manual processes
Infrastructure Average
Architecture issues
Costing Low
Over-provisioned resources
Two domains rated low: operations and costing. Both have the same cause, manual provisioning without a standard.
Security and compliance
Four findings, two of them critical. The two critical findings concern instances that were not scanned and operating systems that no longer receive patches.
| Finding | Severity | Detail |
|---|---|---|
| Amazon Inspector coverage gap | Critical | 6 instances, 4 of them production servers, were not scanned by Amazon Inspector. Vulnerabilities on them were not detected. |
| Operating systems at end of life | Critical | 29 instances ran discontinued operating systems that no longer receive security patches. |
| Incomplete VPC flow logs | High | Logs recorded rejected traffic only and omitted source and destination IP addresses, which security analysis and compliance need. |
| No backup isolation | High | All backups were in the same AWS account as production, exposed to ransomware and accidental deletion. |
Remediation actions
Scan every instance
Enable Amazon Inspector on every EC2 instance and build a central dashboard.
Complete the flow logs
Change the flow log format to include source and destination IP addresses.
Isolate the backups
Create a central backup account with cross-account replication.
Lock the backup vault
Enable AWS Backup Vault Lock so that a compromised administrator cannot delete backups.
Replace the operating systems at end of life
Move the instances at end of life to supported operating systems.
Operations
Automation and standards were absent. This raised the chance of human error and slowed the response to incidents.
Manual AWS operations
Every infrastructure change was made by hand in the console. There was no infrastructure as code.
No golden AMI process
There was no standard, hardened machine image. Each instance was configured on its own.
Manual patching
Operating system and application patches were applied by hand. The time between a patch release and its installation was long.
Recommended improvements
Infrastructure as code
Write a Terraform code base and import the existing AWS resources into it. Make every change through infrastructure as code.
Golden AMI pipeline
Build a pipeline that produces hardened golden AMIs.
Automated patching
Automate patching with AWS Systems Manager Patch Manager.
SAP S/4HANA
We also assessed the SAP S/4HANA system itself for performance, data growth and security.
Database growth Critical
At the current growth rate, the disk capacity will be reached in 10 to 12 months. Data archival and clean-up are urgent.
Large tables near the record limit High
The core tables ACDOCA, MLRUNLIST and VBFA are approaching the SAP HANA limit of 2.1 billion records per table. Partitioning is recommended.
Slow custom programs Medium
Custom programs have long response times. RFC integration logs show inefficient API calls.
Database connection errors High
DBSQL_NO_MORE_CONNECTION dumps were found. Work processes exceed the connection limit, with a risk of data corruption.
SAP recommendations
Data archival
Archive to SAP Content Server every six months instead of once a year.
Table partitioning
Partition the large tables to improve query performance and stay under the record limit.
Performance tuning
Analyse and optimize the custom programs with long response times.
Security hardening
Add validity dates to SYSTEM users and reduce the number of debug role assignments.
Network architecture
Three findings concern the inbound and outbound VPCs. The redesign below consolidates them with the inspection VPC.
NAT gateway in the inbound VPC
The inbound VPC used a NAT gateway, which is an unusual design. Traffic analysis showed low utilization, so the gateway can be consolidated.
Outbound VPC in one Availability Zone
The outbound VPC ran in a single Availability Zone. This avoids cross-zone charges but puts production availability at risk.
About 100 GB per day outbound
The outbound NAT gateway processed about 100 GB per day. A review of the data transfer paths is recommended.
Proposed network redesign
Inbound VPC NAT gateway, low utilization
Outbound VPC NAT gateway, one Availability Zone, about 100 GB per day
Inspection VPC traffic inspection
Inbound, outbound and inspection in one architecture
The figures
The cost review found 6,278 USD per month of savings in four items. Rightsizing 14 EC2 instances is 84 % of the total.
| Item | Saving, USD per month | Share, % | Detail |
|---|---|---|---|
| EC2 rightsizing | 5,242 | 84 | 14 over-provisioned instances to resize |
| Unused Network Firewall | 568 | 9 | Firewall endpoints with no traffic for 3 months or more |
| EBS volumes | 450 | 7 | 32 idle volumes and over-provisioned IOPS |
| Unused VPC endpoints | 18 | 0 | Interface endpoints with no active connection |
| Total | 6,278 | 100 |
Rightsizing is 84 % of the saving
14 of the 36 EC2 instances were larger than their load required. Resizing them saves 5,242 USD per month. The other three items save 1,036 USD per month together.
What the client received
- A report with a rating and the findings for each of the six domains.
- Five security remediation actions, from Amazon Inspector coverage to a locked backup account.
- An operations plan: Terraform, golden AMIs and automated patching.
- A cost plan worth 6,278 USD per month, 84 % of it from resizing 14 instances.
- SAP S/4HANA findings with archival, partitioning, tuning and hardening recommendations.
- A proposal to consolidate the inbound, outbound and inspection VPCs.
An assessment of your AWS estate
You grant read-only access to your accounts. We read configuration and billing data only. You receive a report with each finding, its saving per month and the effort to apply it.
Talk to an engineer