# AWS Backint Agent for SAP HANA AWS Backint Agent for SAP HANA (AWS Backint agent) is an SAP-certified backup and restore application for SAP HANA workloads running on Amazon EC2 instances in the cloud. AWS Backint agent runs as a standalone application that integrates with your existing workflows to back up your SAP HANA database to Amazon S3 and AWS Backup. AWS Backint agent restores SAP HANA workloads using SAP HANA Cockpit, SAP HANA Studio, and SQL commands. AWS Backint agent supports full, incremental, and differential backup of SAP HANA databases. Additionally, you can back up log files and catalogs to Amazon S3 or AWS Backup. AWS Backint agent runs on an SAP HANA database server, where backups and catalogs are transferred from the SAP HANA database to AWS Backint agent. Based on the configurations in your agent file, AWS Backint agent stores your files in Amazon S3 or AWS Backup. To restore your SAP HANA database server, SAP HANA reads the stored catalog files using AWS Backint agent. It then initiates a request to restore the required files. If you want to deploy an SAP HANA database application with AWS Backint agent, you can use [AWS Launch Wizard for SAP](https://docs.aws.amazon.com/launchwizard/latest/userguide/launch-wizard-sap.html), a service that guides you through the sizing, configuration, and deployment of SAP applications on AWS, and follows AWS cloud application best practices. **Topics** + [How AWS Backint Agent for SAP HANA works](#aws-backint-agent-working-with) + [Billing](#aws-backint-agent-billing) + [Supported operating systems](#aws-backint-agent-operating-systems) + [Supported databases](#aws-backint-agent-databases) + [Supported Regions](#aws-backint-agent-regions) + [Backup and restore SAP HANA workloads to Amazon S3](aws-backint-agent-amazon-s3.md) + [AWS Backup](aws-backint-agent-backup.md) + [Verify the signature of the AWS Backint agent and installer for SAP HANA](aws-backint-agent-signature.md) + [Uninstall AWS Backint agent](uninstall-agent.md) + [Troubleshoot AWS Backint Agent for SAP HANA](aws-backint-agent-troubleshooting.md) + [Version history for AWS Backint agent](aws-backint-agent-version-history.md) ## How AWS Backint Agent for SAP HANA works You can deploy the AWS Backint agent to your SAP HANA instances from the [AWS Systems Manager (SSM)](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html) console. From the AWS SSM console, an AWS SSM document is executed on the instances to install the agent. You provide the configuration information in the document as parameters. You can also download and manually install and configure the agent. When the agent is installed, you can back up your SAP HANA database to Amazon S3 or AWS Backup. AWS Backint agent increases scalability through parallel processing of backup and restore processes, providing maximum throughput and reducing backup Recovery Time Objective (RTO) during recovery. To use AWS Backup with AWS Backint agent, see the following documentation. + [AWS Backup for AWS Backint agent](https://docs.aws.amazon.com/sap/latest/sap-hana/aws-backint-agent-backup.html) + [AWS Systems Manager for SAP](https://docs.aws.amazon.com/ssm-sap/latest/userguide/what-is-ssm-for-sap.html) + [AWS Backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-saphana.html) ## Billing AWS Backint agent is a free service. You pay for only the underlying AWS services that you use, for example Amazon S3 or AWS Backup. See the following references for more information. + [Amazon S3 pricing](https://aws.amazon.com/s3/pricing/) + [AWS Backup pricing](https://aws.amazon.com/backup/pricing/) ## Supported operating systems AWS Backint agent is supported on the following operating systems: + SUSE Linux Enterprise Server + SUSE Linux Enterprise Server for SAP + Red Hat Enterprise Linux for SAP ## Supported databases AWS Backint agent supports the following databases: + SAP HANA 1.0 SP12 (single node and multi node) + SAP HANA 2.0 and later (single node and multi node) ## Supported Regions AWS Backint agent is available in all commercial Regions, as well as in China (Beijing), China (Ningxia), and GovCloud. AWS Backint agent with storage on AWS Backup is available in all commercial Regions. # Backup and restore SAP HANA workloads to Amazon S3 This section provides information about setting up and using AWS Backint agent to backup and restore your SAP HANA workloads to Amazon S3. **Topics** + [Prerequisites for use of the AWS Backint Agent for SAP HANA](aws-backint-agent-s3-prerequisites.md) + [Install and configure AWS Backint Agent for SAP HANA](aws-backint-agent-s3-installing-configuring.md) + [Backup and restore your SAP HANA system with the AWS Backint Agent for SAP HANA](aws-backint-agent-s3-backup-restore.md) # Prerequisites for use of the AWS Backint Agent for SAP HANA After your SAP HANA system is successfully running on an Amazon EC2 instance, verify the following prerequisites to install AWS Backint agent using the Amazon EC2 Systems Manager document or using AWS Backint installer. **Topics** + [AWS Identity and Access Management](#aws-backint-agent-iam) + [AWS Systems Manager Agent (SSM Agent)](#aws-backint-agent-ssm) + [Amazon S3 bucket](#s3-bucket) + [Data perimeter](#data-perimeter) + [AWS CLI](#install-aws-cli) ## AWS Identity and Access Management 1. To access the AWS resources required to install AWS Backint agent with AWS Systems Manager, you must attach the `AmazonSSMManagedInstanceCore` managed policy to your IAM role. **Note** If you choose to install the AWS Backint agent using the AWS Backint installer, you can skip this step. 1. To allow your Amazon EC2 instance to access your target Amazon S3 bucket, you must create or update an inline IAM policy with the following permissions and attach it to your EC2 service role. Replace the resource names, such as the S3 bucket name, to match your resource name. You must provide the AWS Region and Amazon S3 bucket owner account ID along with the Amazon S3 bucket name. ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::bucket-name/*", "arn:aws:s3:::bucket-name" ] }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" }, { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "s3:PutObjectTagging", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::bucket-name/folder-name/*" } ] } ``` **Note** If you want to allow cross-account backup and restore, you must add your account details under a principal element in your policy. For more information about principal policies, see [AWS JSON Policy Elements: Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in the * AWS Identity and Access Management User Guide*. In addition, you must ensure that the S3 bucket policies allow your account to perform the actions specified in the IAM policy example above. For more information, see the example for [Bucket owner granting cross-account bucket permissions](https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html) in the *Amazon S3 Developer Guide*. For more information about managed and inline policies, see the [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html). ## AWS Systems Manager Agent (SSM Agent) To install the AWS Backint agent with the AWS Systems Manager Agent (SSM Agent) document, you must install the [AWS Systems Manager Agent (SSM Agent)](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html) version 2.3.274.0 or later, and your instance must be a managed instance that is configured for AWS Systems Manager. If you want to install AWS Backint agent using AWS Backint installer, you can skip this step. For more information about managed instances, see [AWS Systems Manager Managed Instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/managed_instances.html). To update the SSM Agent, see [Update SSM Agent by using Run Command](https://docs.aws.amazon.com/systems-manager/latest/userguide/rc-console.html#rc-console-agentexample). **Note** The SSM Agent will not work if you do not attach the `AmazonSSMManagedInstanceCore` policy to your EC2 instance role. ## Amazon S3 bucket When you install the AWS Backint agent, you must provide the name of the S3 bucket where you want to store your SAP HANA backups. Only Amazon S3 buckets created after May 2019 are compatible with AWS Backint agent. If you do not own a bucket created after May 2019, create a new S3 bucket in your target Region. Additionally, ensure that the Amazon S3 bucket where you want to store your backups doesn’t have public access enabled. If the S3 bucket has public access enabled, backups will fail. AWS Backint agent supports backing up to Amazon S3 with VPC endpoints. Amazon S3 gateway endpoint can improve performance, and help potentially avoid timeouts. It increases security while reducing cost. For more information, see [VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html). **S3 storage classes** — AWS Backint agent supports backing up your SAP HANA database to an Amazon S3 bucket with the S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Intelligent-Tiering storage classes. S3 Reduced Redundancy, Deep Archive, and Glacier storage classes are not supported by AWS Backint agent. By default, the S3 Standard storage class is used to store your backups. You can change the storage class to use for backups by modifying the AWS Backint agent configuration file. Alternatively, you can change your backup files to one of the supported storage classes through [S3 LifeCycle configuration](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) or directly using APIs. To learn more about Amazon S3 storage classes, see [Amazon S3 Storage Classes](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) in the *Amazon S3 Developer Guide*. **Note** S3 Intelligent-Tiering storage class enables movement of objects between four access tiers. It can also move objects to the archival tiers. However, ** AWS Backint agent for SAP HANA does not support backup and recovery from archival tiers.** To recover or delete objects from the archival tiers, you must first [restore the archived S3 objects](https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects.html) before initiating a recovery or deletion with the AWS Backint agent. **Encryption** — AWS Backint agent supports encrypting your SAP HANA backup files while storing them in Amazon S3, using server-side encryption with AWS KMS (KMS). You can encrypt your backups with a `aws-managed-key` called `aws/s3` or you can use your own custom symmetrical AWS KMS key stored in KMS. To encrypt your backup files with keys stored in KMS (AWS-managed or custom), you must provide the KMS ARN during the install, or update the AWS Backint agent configuration file at a later time. To learn more about encrypting your S3 objects using AWS KMS, see [How Amazon S3 uses AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html) in the * AWS Key Management Service Developer Guide*. Alternatively, you can enable default encryption for your Amazon S3 bucket using keys managed by Amazon S3. To learn more about enabling default encryption for your bucket, see [How do I enable default encryption for an Amazon S3 bucket?](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html) in the *Amazon S3 Console User Guide*. **Object locking** — You can store objects using a *write-once-read-many* (WORM) model with S3 Object Lock. Use S3 Object Lock if you want to prevent your SAP HANA backup files from being accidentally deleted or overwritten for a specific time period or indefinitely. If S3 Object Lock is enabled, you can’t delete your SAP HANA backups stored in Amazon S3 using SAP HANA Cockpit, SAP HANA Studio, or SQL commands until the retention period expires. To learn about S3 Object Lock, see [Locking objects using S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html) in the *Amazon S3 Developer Guide*. **Object tagging** — By default, AWS Backint agent adds a tag called ` AWSBackintAgentVersion` when it stores your SAP HANA backup files in your S3 bucket. This tag helps to identify the AWS Backint version and the SAP HANA version used when backing up your SAP HANA database. You can [list the value of the tags from S3 console](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/view-object-properties.html) or [using APIs](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html). To disable default tagging, modify the AWS Backint agent configuration file. ## Data perimeter AWS Backint Agent must be installed on your Amazon EC2 instance. To download the installation binary, your EC2 instance needs access to the AWS-managed S3 buckets where the installer packages are hosted. If your organization uses data perimeter policies to control access to Amazon S3 in your environment, you might need to explicitly allow these service-owned buckets so that the EC2 instance can retrieve the required installer. The following policy shows an example Service control policy to permit access to service-owned resources through the resource perimeter, relevant service owned buckets are listed in the NotResource element of the policy. ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EnforceResourcePerimeterAWSResources", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:aws:s3:::awssap-backint-agent", "arn:aws:s3:::awssap-backint-agent/*" ], "Condition": { "StringNotEqualsIfExists": { "aws:ResourceOrgID": "", "aws:PrincipalTag/dp:exclude:resource": "true" } } } ] } ``` The following policy shows an example VPC endpoint policy allowing access to specific service-owned resources through a VPC endpoint. Relevant service owned buckets are listed in the Resource element of the statement. ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "AllowRequestsToAWSOwnedResources", "Effect": "Allow", "Principal": "*", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::awssap-backint-agent", "arn:aws:s3:::awssap-backint-agent/*" ] } ] } ``` For AWS GovCloud, replace the bucket name with s3://awssap-backint-agent-us-gov-east-1 or s3://awssap-backint-agent-us-gov-west-1. ## AWS CLI AWS Backint agent installation leverages the AWS CLI to validate S3 bucket properties. To install or update to the AWS CLI, see [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). # Install and configure AWS Backint Agent for SAP HANA This section provides information to help you install the AWS Backint agent using an AWS Systems Manager document or AWS Backint installer. It also provides information to help you configure the agent, view logs, and get the current agent version. **Topics** + [Install AWS Backint agent using the AWS Systems Manager document](#aws-backint-agent-ssm-document) + [Install AWS Backint agent using AWS Backint installer — interactive mode](#aws-backint-agent-installer-interactive) + [Install AWS Backint agent using AWS Backint installer — silent mode](#aws-backint-agent-installer-silent) + [Use a proxy address with AWS Backint agent](#aws-backint-agent-sap-hana-proxy) + [Backint-related SAP HANA parameters](#aws-backint-agent-sap-hana-parameters) + [Modify AWS Backint agent configuration parameters](#aws-backint-agent-modifying-config) + [Configure SAP HANA to use a different Amazon S3 bucket and folder for data and log backup](#configure-sap-hana-to-use-different-amazon-s3-bucket-and-folder-for-data-and-log-backup) + [Configure SAP HANA to use a different Amazon S3 bucket and folder for catalog backup](#configure-sap-hana-to-use-different-amazon-s3-bucket-and-folder-for-catalog-backup) + [Configure AWS Backint agent to use shorter Amazon S3 paths](#configure-aws-backint-agent-to-use-shorter-amazon-s3-paths) + [View AWS Backint agent logs](#aws-backint-agent-view-logs) + [Get the currently installed AWS Backint agent version](#aws-backint-agent-latest-version) + [Update to the newest version or install a previous version of AWS Backint agent](#aws-backint-agent-update-version) + [Performance tuning](#aws-backint-agent-performance-tuning) + [Subscribe to AWS Backint agent notifications](#aws-backint-agent-sns) ## Install AWS Backint agent using the AWS Systems Manager document Use the following steps to install the AWS Backint agent using the AWS SSM document. **Important** Disable any existing backup processes (including scheduled log backups) before continuing with the installation. If you don’t disable existing backup processes before running the SSM document, you can corrupt an in-progress backup, which can impact your ability to recover your database. 1. From the AWS Management Console, choose **Systems Manager** under **Management & Governance**, or enter `Systems Manager` in the **Find Services** search bar. 1. From the Systems Manager console, choose **Documents** under **Shared Resources** in the left navigation pane. 1. On the Documents page, select the **Owned by Amazon** tab. You should see a document named ** AWSSAP-InstallBackint**. 1. Select the ** AWSSAP-InstallBackint** document and choose **Run command**. 1. Under the Command parameters, enter the following 1. **Bucket Name**. Enter the name of the Amazon S3 bucket where you want to store your SAP HANA backup files. 1. **Bucket Folder**. Optionally, enter the name of the folder within your Amazon S3 bucket where you want to store your SAP HANA backup files. 1. **System ID**. Enter your SAP HANA System ID, for example `HDB`. 1. **Bucket Region**. Enter the AWS Region of the Amazon S3 bucket where you want to store your **SAP HANA backup files**. AWS Backint agent supports cross-Region and cross-account backups. You must provide the AWS Region and Amazon S3 bucket owner account ID along with the Amazon S3 bucket name for the agent to perform successfully. 1. **Bucket Owner Account ID**. Enter the account ID of the Amazon S3 bucket where you want to store your SAP HANA backup files. 1. **Kms Key**. Enter the ARN of AWS KMS that AWS Backint agent can use to encrypt the backup files stored in your Amazon S3 bucket. 1. **Installation Directory**. Enter the path of the directory location where you want to install the AWS Backint agent. Avoid using `/tmp` as the install path. 1. **Agent Version**. Enter the version number of the agent that you want to install. If you do not enter a version number, the latest published version of the agent is installed. **Note** 1.0 versions are unavailable in the GovCloud Regions. 1. **Modify Global ini file**. Choose how you want to modify the `global.ini` file. The `global.ini` file of the SAP HANA SYSTEM DB must be updated to complete the setup. 1. "modify" — SSM will update the `global.ini` file directly. 1. "sql" — SSM will create a file called `modify_global_ini.sql` with SQL statements that you can run in your target SAP HANA system to set the required parameters. You can find the `modify_global_ini.sql` file in the `/aws-backint-agent/` folder. 1. "none" — No action will be taken by SSM to modify the `global.ini` file. You must manually update it to complete the setup. 1. **Ignore Bucket Checks**. Select **yes** to ignore sanity checks of the S3 bucket. S3 Bucket sanity checks verify the following: + the bucket exists in your account + the bucket Region is correct + the bucket is public 1. **Debug Mode**. Select **yes** to activate debug mode. 1. **Important\$1 Ensure No Backup In Process**. Choose **Yes** to confirm that you have disabled existing backups and are ready to proceed with the installation. **The SSM document will fail if you choose "No" **. 1. Under **Targets**, select the method for your target instance to use to install the AWS Backint agent, and then choose the instance on which to install it. If you are not able to find your instance in the list, verify that you have followed all of the steps in the [prerequisites](aws-backint-agent-s3-prerequisites.md). 1. Under **Other parameters**, leave the field empty and choose **Run**. **Important** If you do not have the latest version of the SSM Agent installed (2.3.274.0 or later), **Run Command** will fail to execute. 1. When the agent is successfully installed, you will see the **Success** status under the **Command ID**. 1. To verify the installation, log in to your instance and view the `//aws-backint-agent` directory. You should see the following files in the directory: the AWS Backint agent binary, `THIRD_PARTY_LICENSES.txt` file, which contains licenses of libraries used by the agent, the launcher script, the YAML configuration file, and the optional `modify_global_ini.sql` file. In addition, a source file (`aws-backint-agent.tar.gz`) of AWS Backint agent is stored in the package directory. You can verify the signature of this file to ensure that the downloaded source file is original and unmodified. See the [Verifying the signature of AWS Backint agent and installer for SAP HANA](aws-backint-agent-signature.md) section in this document for details. The SSM document creates symbolic links (symlinks) in the SAP HANA global directory for the Backint configuration. Verify that the symlink for `hdbbackint` exists in the `/usr/sap//SYS/global/hdb/opt` directory and the symlink for `aws-backint-agent-config.yaml` exists in the `/usr/sap//SYS/global/hdb/opt/hdbconfig` directory. ## Install AWS Backint agent using AWS Backint installer — interactive mode Another way to install the AWS Backint agent is with the AWS Backint installer. You can download the AWS Backint installer from an Amazon S3 bucket. The name of the S3 bucket is `s3://awssap-backint-agent/` **Note** For AWS GovCloud (US-East), the name of the S3 bucket is `s3://awssap-backint-agent-us-gov-east-1`. For AWS GovCloud (US-West), the name of the S3 bucket is `s3://awssap-backint-agent-us-gov-west-1`. The latest installer can always be found at `s3://awssap-backint-agent/binary/latest/install-aws-backint-agent` **Note** For AWS GovCloud (US-East), the latest installer can always be found at `s3://awssap-backint-agent-us-gov-east-1/binary/latest/install-aws-backint-agent`. For AWS GovCloud (US-West), the latest installer can always be found at `s3://awssap-backint-agent-us-gov-west-1/binary/latest/install-aws-backint-agent`. Follow these steps to install AWS Backint agent using the AWS Backint installer from an SSH session on your SAP HANA instance. **Important** Disable any existing backup processes (including scheduled log backups) before continuing with the installation. If you don’t disable existing backup processes before running the AWS Backint agent installer, you can corrupt an in-progress backup, which can impact your ability to recover your database. 1. Navigate to `/tmp` (or another temporary directory where you downloaded the installer). ``` $ cd /tmp ``` 1. Run one of the following commands to download the installer. ``` $ sudo aws s3 cp s3://awssap-backint-agent/binary/latest/install-aws-backint-agent /tmp/ --region us-east-1 ``` or ``` $ sudo wget https://s3.amazonaws.com/awssap-backint-agent/binary/latest/install-aws-backint-agent -O /tmp/install-aws-backint-agent ``` **Note** If you encounter permission issues while downloading the AWS Backint installer using the AWS CLI, check your IAM policy and ensure that your policies allow for downloading objects from the `awssap-backint-agent` bucket. See the [Identity and Access Management](aws-backint-agent-s3-prerequisites.md#aws-backint-agent-iam) section of this documentation for details. 1. (Optional) For AWS GovCloud (US-East) and AWS GovCloud (US-West), run one of the following commands to download the installer. ``` $ sudo aws s3 cp s3://awssap-backint-agent-us-gov-east-1/binary/latest/install-aws-backint-agent /tmp/ --region us-gov-east-1 ``` ``` $ sudo aws s3 cp s3://awssap-backint-agent-us-gov-west-1/binary/latest/install-aws-backint-agent /tmp/ --region us-gov-west-1 ``` or ``` $ sudo wget https://awssap-backint-agent-us-gov-east-1.s3.us-gov-east-1.amazonaws.com/binary/latest/install-aws-backint-agent -O /tmp/install-aws-backint-agent ``` ``` $ sudo wget https://awssap-backint-agent-us-gov-west-1.s3.us-gov-west-1.amazonaws.com/binary/latest/install-aws-backint-agent -O /tmp/install-aws-backint-agent ``` 1. Run the installer with the `-h` flag to find all of the available options. ``` $ sudo python install-aws-backint-agent -h ``` 1. Run the following command to execute the installer. ``` $ sudo python install-aws-backint-agent ``` **Note** Run the installer with the `-l` flag if you want the installer to get the AWS Backint agent binary file from your own file system or Amazon S3 bucket. Specify the location of the `aws-backint-agent.tar.gz` file. ``` $ sudo python install-aws-backint-agent -l /tmp/backint/aws-backint-agent.tar.gz ``` ``` $ sudo python install-aws-backint-agent -l s3:///aws-backint-agent.tar.gz ``` ``` $ sudo python install-aws-backint-agent -l https://.s3.amazonaws.com/aws-backint-agent.tar.gz ``` 1. Enter information for the following parameters. 1. **Installation directory** — Enter the path of the directory location where you want to install the AWS Backint agent. The default value for the installation directory is `/hana/shared/`. 1. **Amazon S3 bucket owner** — Enter the account ID of the Amazon S3 bucket owner of the bucket where you want to store your SAP HANA backup files. 1. **Amazon S3 bucket Region** — Enter the AWS Region of the Amazon S3 bucket where you want to store your SAP HANA backup files. 1. **Amazon S3 bucket name** — Enter the name of the Amazon S3 bucket where you want to store your SAP HANA backup files. 1. **Folder in the S3 bucket** — Enter the name of the folder in the Amazon S3 bucket where you want to store your SAP HANA backup files. This parameter is optional. 1. **Amazon S3 SSE KMS ARN** — Enter the ARN of the AWS KMS that AWS Backint agent can use to encrypt the backup files stored in your Amazon S3 bucket. **Note** If you leave this field empty, AWS Backint installer will prompt you to confirm that you don’t want to encrypt your backup files with encryption keys stored in AWS KMS. If you do not confirm that you do not want to encrypt with the kms-key, the installer will abort. We strongly recommend that you encrypt your data. 1. **SAP HANA system ID** — Enter your SAP HANA System ID, for example `HDB`. 1. **HANA opt dir** — Confirm the location of the SAP HANA opt directory. 1. **Modify global.ini [modify/sql/[none]]** — Choose how you want to modify the `global.ini` file. The `global.ini` file of the SAP HANA SYSTEM must be updated to complete the setup. 1. "modify" — AWS Backint installer will update the `global.ini` file directly. 1. "sql" — AWS Backint installer will create a file called `modify_global_ini.sql` with SQL statements that you can run in your target SAP HANA system to set the required parameters. You can find the `modify_global_ini.sql` file in the `/aws-backint-agent/` folder. 1. "none" — No action will be taken by AWS Backint installer to modify the `global.ini` file. You must manually update them to complete the setup. 1. **HANA SYSTEM db global.ini file** — Confirm the location of `global.ini` file. 1. **Verify signature of the agent binary `–0—tar` file** —  + Choose `y` to verify the signature of the AWS Backint agent source file. If you choose `y`, enter the Amazon S3 bucket location of the signature file of the agent binary `–0—tar` file, for example, `https://s3.amazonaws.com/awssap-backint-agent/binary/latest/aws-backint-agent.sig`. Or, provide a local file that is stored on the instance. If you proceed without making a selection, the default location listed within brackets ([]) is used. + Choose `n` if you do not want to verify the signature of the AWS Backint agent source file. 1. **Save responses for future usage?** — You can save your information for the AWS Backint installer to a file. You can then use it later to run the installer in silent mode, if needed. 1. **Do you want to proceed with the installation?** — Confirm that you have disabled the existing backups and are ready to proceed with the installation. 1. To verify the installation, log in to your instance and view the `//aws-backint-agent` directory. You should see the following files in the directory: the AWS Backint agent binary, the `THIRD_PARTY_LICENSES.txt` file, which contains licenses of libraries used by the agent, the launcher script, the YAML configuration file, and the optional `modify_global_ini.sql` file. In addition, a source file (`aws-backint-agent.tar.gz`) of AWS Backint agent is stored in the package directory. You can verify the signature of this file to ensure that the downloaded source file is original and unmodified. See the [Verifying the signature of AWS Backint agent and installer for SAP HANA](aws-backint-agent-signature.md) section in this document for details. In addition, the AWS Backint installer creates symbolic links (symlinks) in the SAP HANA global directory for the Backint configuration. Verify that the symlink for `hdbbackint` exists in the `/usr/sap//SYS/global/hdb/opt` directory, and that the symlink for `aws-backint-agent-config.yaml` exists in the `/usr/sap//SYS/global/hdb/opt/hdbconfig` directory. **Note** If your installation fails due to validation errors and you want to ignore the validation and proceed with the installation, you can execute the installer with the `-n` flag to ignore the validation steps. You can also use the `-d` flag to run the installer in debug mode to generate detailed installation logs for troubleshooting. ## Install AWS Backint agent using AWS Backint installer — silent mode You can install the AWS Backint agent with the AWS Backint installer in a silent mode. Choose this option if you want the installation process to be automated without manual intervention. To run the AWS Backint installer in silent mode, create a response file with all of the required installation parameters. Follow the steps in the [section on installing using the interactive mode](#aws-backint-agent-installer-interactive) to download AWS Backint installer and create a response file. You don’t have to confirm to continue with the AWS Backint agent installation in interactive mode. AWS Backint installer will create a response file called `aws-backint-agent-install-YYYYMMDDHHMMSS.rsp`. When you have a response file, you can modify it with a vim editor and adjust the parameters as needed. The following is an example response file. ``` [DEFAULT] s3_bucket_name = s3_bucket_owner_account_id = 111122223333 modify_global_ini = sql s3_bucket_region = s3_sse_kms_arn = arn:aws:kms::111122223333:key/1abcd9b9-ab12-1a2a-1abc-12345abc12a3 s3_bucket_folder = myfolder hana_sid = TST installation_directory = /hana/shared/ ``` If you want to generate the response file programmatically instead of using AWS Backint installer in interactive mode, you can use the `-g` flag to generate a new response file. The following is an example of how to generate a response file using AWS Backint installer. ``` $ sudo python install-aws-backint-agent -g "s3_bucket_owner_account_id = 111122223333,s3_bucket_name = ,s3_bucket_region = ,hana_sid = TST,s3_sse_kms_arn = arn:aws:kms::111122223333:key/1abcd9b9-ab12-1a2a-1abc-12345abc12a3,s3_bucket_folder = myfolder,installation_directory = /hana/shared/,modify_global_ini = sql" -f myresponse.rsp ``` After the response file is created, use the following steps to run AWS Backint installer in silent mode. **Important** Disable any existing backup processes (including scheduled log backups) before continuing with the installation. If you don’t disable existing backup processes before running the AWS Backint agent installer, you can corrupt an in-progress backup, which can impact your ability to recover your database. Run the following command to execute the installer using the generated response file. ``` $ sudo python install-aws-backint-agent -m silent -f backint-agent-install-YYYYMMDDHHMMSS.rsp -a yes ``` If you want to choose the location from which to install the agent, run the command with the `-l` flag and specify the location. ``` $ sudo python install-aws-backint-agent -f aws-backint-agent-install-YYYYMMDDHHMMSS.rsp -m silent -a yes -d -l /tmp/backint/aws-backint-agent.tar.gz ``` **Note** You must confirm that you have disabled the existing backups and are ready to proceed with the installation in silent mode by passing an acknowledgement flag (`-a yes`). If you don’t pass the acknowledgement flag, AWS Backint installer will fail to execute. ## Use a proxy address with AWS Backint agent If you use a proxy address in your SAP HANA environment when you install the agent, you must use the following shell script to install the agent to ensure that the correct proxy settings are used by the AWS Backint agent installer. ``` #!/bin/bash export https_proxy=: export HTTP_PROXY= export no_proxy=169.254.169.254 export NO_PROXY=169.254.169.254 sudo python install-aws-backint-agent ``` If you use a proxy address in your SAP HANA environment, you must update the `aws-backint-agent-launcher.sh` file, which is located in the AWS Backint agent installation directory (for example, `/hana/shared/aws-backint-agent/`). You must perform the following update to ensure that the correct proxy settings are used by AWS Backint agent during backup and restore operations. Add `http_proxy`, `HTTP_PROXY`, `no_proxy`, and `NO_PROXY` variables to the `aws-backint-agent-launcher.sh` script. It is important to exclude the `169.254.169.254` address with the `no_proxy` variable. If you do not exclude this address, instance metadata service calls made by AWS Backint agent will fail and cause errors during backup and restore operations. For more information about instance metadata and user data, see [Instance metadata and user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) in the *Amazon EC2 User Guide for Linux Instances*. ``` #!/bin/bash export https_proxy=: export HTTP_PROXY=: export no_proxy=169.254.169.254 export NO_PROXY=169.254.169.254 /hana/shared/aws-backint-agent/aws-backint-agent "$@" ``` ## Backint-related SAP HANA parameters To enable SAP HANA backups using AWS Backint agent, you must set the following SAP HANA parameters. If you chose the "modify" option for the `global.ini` file update, the SSM document or AWS Backint installer adds or updates the following backup related SAP HANA parameters in `global.ini` for the system database. If you chose "sql", you can run the SQL statements specified in the `modify_global_ini.sql` file to update these parameters. For more details about these parameters, see [Backup Configuration Parameters](https://help.sap.com/viewer/6b94445c94ae495c83a19646e7c3fd56/2.0.03/en-US/c1eb6ff410f946318dae539cb3d33f9f.html) in the *SAP HANA Administration Guide*. ``` [backup] catalog_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml data_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml log_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml catalog_backup_using_backint = true log_backup_using_backint = true parallel_data_backup_backint_channels = 8 data_backup_buffer_size = 4096 max_recovery_backint_channels = 1 [communication] tcp_backlog = 2048 [persistence] enable_auto_log_backup = yes verify_signature = yes input_signature_filepath = https://s3.amazonaws.com/awssap-backint-agent/binary/latest/aws-backint-agent.sig ``` **Note** Changing the `tcp_backlog` parameter requires a restart of SAP HANA to take effect. `max_recovery_backint_channels` determines the number of log files restored/recovered in parallel during the recovery process. When multistreamed backups are recovered, SAP HANA always uses the same number of channels that were used during the backup. For more information, see [Multistreaming Data Backups with Third-Party Backup Tools](https://help.sap.com/viewer/6b94445c94ae495c83a19646e7c3fd56/2.0.02/en-US/9159de1e829740908e0ba022f8e8d1b0.html) in the SAP documentation. ## Modify AWS Backint agent configuration parameters The AWS Backint agent configuration parameters are maintained in a YAML file in the `//aws-backint-agent/` directory. The name of the configuration file is `aws-backint-agent-config.yaml`. The following tables summarize the configuration parameters added as part of the AWS Backint agent installation process, and additional parameters that you can add or change. **Parameters added to the `aws-backint-agent-config.yaml` during initial setup** | Name of the parameter | Description | Default value | | --- | --- | --- | | `S3BucketName` | Name of the Amazon S3 bucket where you want to store your SAP HANA backup files. For example, `amzn-s3-demo-bucket`. | N/A | | `S3BucketAwsRegion` | AWS Region of your Amazon S3 bucket. For example, `us-east-1`. | N/A | | `S3BucketFolder` | Name of the folder in the Amazon S3 bucket where you want to store your SAP HANA backup files. For example, `my-folder`. | Empty | | `S3BucketOwnerAccountID` | 12-digit account ID of the Amazon S3 bucket owner. For example, `111122223333`. | N/A | | `LogFile` | Location of the AWS Backint agent log file. | `/hana/shared/aws-backint-agent/aws-backint-agent.log` | | `S3SseKmsArn` | ARN of the kms-key that AWS Backint agent can use to encrypt the backup files stored in Amazon S3. For example, `arn:aws:kms:: 111122223333:key/5bfbc9b9-ab12-ab12-a123-11111xxx22xx`. | Empty | | `S3SseEnabled` | Specifies whether KMS encryption is enabled. | Set to `false` if the `S3SseKmsArn` parameter is empty. Otherwise, set to `true`. | **Parameters that can be added to the `aws-backint-agent-config.yaml` file to update default values** | Name of the parameter | Description | Default value | Supported since | | --- | --- | --- | --- | | `BackupObjectTags` | Enables support for additional S3 object tags. `EnableTagging` must be set to `true` in order to use `BackupObjectTags`. Allowed values: must be a valid JSON string that uses the following syntax: 
-BackupObjectTags: "[{Key=string,Value=string},{Key=string,Value=string},...]
For applicable tag restrictions, see [Tag restrictions](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions) in the *Amazon EC2 User Guide*. | N/A | Version 1.03 | | `EnableTagging` | Enables or disables default object tagging for backups files stored in S3. Tagging helps to identify the AWS Backint version and SAP HANA version used during the backup. Allowed values: `true` or `false`. | `true` | Version 1.03 | | `LogLevel` | Specifies the logging level for agent logs. Allowed values: `info` or `debug`. | `info` | Version 1.0 | | `LogRotationFrequency` | Specifies the `aws-backint-agent.log` file rotation frequency. Allowed values: `minute`, `hour`, `day`, or `never`. | `never` | Version 1.03 | | `S3StorageClass` | Specifies the S3 storage class type that AWS Backint agent can use while storing your backup files. Allowed values: `STANDARD`, `STANDARD_IA`, `ONEZONE_IA`, or `INTELLIGENT_TIERING`. | `STANDARD` | Version 1.0 (Intelligent-Tiering since version 1.05) | | `UploadConcurrency` | Specifies the number of Amazon S3 threads that can work in parallel during backup. Allowed values: `1` to `200`. | `100` | Version 1.0 | | `UploadChannelSize` | Specifies the number of files that can be uploaded in parallel to the S3 bucket during the backups. Allowed values: `1` to `32`. | `10` | Version 1.0 | | `MaximumConcurrentFilesForRestore` | Specifies the number of files that can be downloaded in parallel from S3 during the restore. Allowed values: `1` to `32`. | `5` | Version 1.0 | | `S3ShortenBackupDestinationEnabled` | Specifies whether to use a shorter Amazon S3 path. Allowed values: `true` or `false`. | `false` | Version 1.05 | | `DownloadConcurrency` | Specifies the number of Amazon S3 threads that can work in parallel during restore Allowed values: `1` to `200`. | `100` | Version 1.0 | ## Configure SAP HANA to use a different Amazon S3 bucket and folder for data and log backup AWS Backint agent uses the same parameters by default for the data and log backups. It stores the data and log backups in the same Amazon S3 bucket and folder. ``` data_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml log_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml ``` To use a different Amazon S3 bucket and folder for the data and log backups, follow these steps. 1. **Check the SAP HANA backup parameters** Locate the `data_backup_parameter_file` and `log_backup_parameter_file` parameters. The default value of these parameters should be `//aws-backint-agent/aws-backint-agent-config.yaml`. If you do not see this default value, check the configuration file to confirm that it is displaying the same Amazon S3 location. 1. **Retain access to the logs backup stored in the previous Amazon S3 location** If this is a new setup or you do not want to retain the previous logs backup, skip this step and continue with Step 3. Move the previous logs backup with source type `volume` to the new Amazon S3 location for logs backup only. You can confirm the source type by running the following SQL command. ``` select SOURCE_TYPE_NAME, DESTINATION_PATH from M_BACKUP_CATALOG_FILES ``` The backup catalog is assigned a name in the following format: `log_backup_0_0_0_0.`. This type of backup is managed by a different SAP HANA parameter, has a source type `catalog`, and should remain in the data backup location. This file contains the backup catalog file that stores the history of all backups. Only the log backups with source type `volume` should be moved to the new Amazon S3 location. To change the Amazon S3 location for catalog backup, see [Configure SAP HANA to use a different Amazon S3 bucket and folder for catalog backup](#configure-sap-hana-to-use-different-amazon-s3-bucket-and-folder-for-catalog-backup). The following table provides an example of a SYSTEM DB folder structure: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.html) The following table provides an example of a TENANT DB folder structure: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.html) **Note** Before doing steps a and b, ensure that there is no backup process running. 1. **Change the location of the logs backup for SYSTEM DB** Run the following commands to move the volume type of SYSTEM DB logs. In the example, we use the same Amazon S3 bucket, but create another folder for the logs backup. ``` # Create the folder structure aws s3api put-object --bucket --key //usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --region # Execute a Dry Run to check aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "*" --include "log_backup_1_0*" --recursive --dryrun --region # Run the command to move the logs to the new S3 location aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "*" --include "log_backup_1_0*" --recursive --region # Check the output of the S3 location for logs aws s3 ls s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --region ``` 1. **Change the location of the logs backup for TENANT DB** Run the following commands to move the volume type TENANT DB logs. In the example, we use the same Amazon S3 bucket, and create another folder for the logs backup. You need to repeat this step for every TENANT DB. ``` # Create the folder structure aws s3api put-object --bucket --key //usr/sap//SYS/global/hdb/backint/DB_/ --region # Execute a Dry Run aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/DB_/ s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include "log_backup_2_0" --include "log_backup_3_0" --recursive --dryrun --region # Run the command to move the logs to the new S3 location aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/DB_/ s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include "log_backup_2_0" --include "log_backup_3_0" --recursive --region # Check the output of the S3 location for logs aws s3 ls s3://///usr/sap//SYS/global/hdb/backint/DB_/ --region ``` 1. **Create the `aws-backint-agent-config-logs.yaml` parameter file** 1. Make a copy of the existing AWS Backint agent configuration for logs backup. ``` $ cp /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml /hana/shared/aws-backint-agent/aws-backint-agent-config-logs.yaml ``` 1. Modify the `S3BucketName`, `S3BucketFolder`, and `LogFile` parameters in `aws-backint-agent-config-logs.yaml`, using your preferred editor. ``` S3BucketName: "" S3BucketFolder: "" LogFile: "/hana/shared/aws-backint-agent/aws-backint-agent-logs.log" ``` 1. Create a `hdbbackint` soft link from `/usr/sap//SYS/global/hdb/opt/hdbconfig/` to `/hana/shared/aws-backint-agent/`. ``` $ ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config-logs.yaml /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config-logs.yaml ``` 1. **Update the `global.ini` file** Update the `global.ini` file with the following configuration. ``` log_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config-logs.yaml ``` 1. **Run reconfiguration for the update** Run `hdbnsutil -reconfig` for the update to take effect. 1. **Validate to ensure that all steps have been processed correctly** 1. Run a point-in-time recovery to a previous state, to ensure that you can access the previous log files in the new Amazon S3 location. 1. Verify that new logs are uploaded to the new S3 location. 1. **Delete previous backups** After a successful validation, we recommend waiting for at least a week before deleting the previous logs. When you’re ready, delete the previous logs with the following commands. ``` # Delete previous backups in SYSTEMDB aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "" --include "log_backup_1_0" --recursive --dryrun --region aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "" --include "log_backup_1_0" --recursive --region # Delete previous backups in the TENANT database (Repeat for each tenant) aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include --include "log_backup_2_0" --include "log_backup_3_0" --recursive --dryrun --region aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include "log_backup_2_0" --include "log_backup_3_0" --recursive --region ``` ## Configure SAP HANA to use a different Amazon S3 bucket and folder for catalog backup AWS Backint agent uses the same parameters by default for the data, log, and catalog backups. It stores all of the backups in the same Amazon S3 bucket and folder. ``` data_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml log_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml catalog_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config.yaml ``` To use a different Amazon S3 bucket and folder for catalog backup, follow these steps. 1. **Check the SAP HANA backup parameters** Locate the `data_backup_parameter_file`, `log_backup_parameter_file`, and `catalog_backup_parameter_file` parameters. The default value of these parameters should be `//aws-backint-agent/aws-backint-agent-config.yaml`. If you do not see this default value, check the configuration file to confirm that it is displaying the same Amazon S3 location. 1. **Retain access to the logs backup stored in the previous Amazon S3 location** If this is a new setup or you do not want to retain the previous catalog backup, skip this step and continue with Step 3. Move the previous catalog backup with source type `catalog` to the new Amazon S3 location for catalog backup only. You can confirm the source type by running the following SQL command. ``` select SOURCE_TYPE_NAME, DESTINATION_PATH from M_BACKUP_CATALOG_FILES ``` The backup catalog is assigned a name in the following format: `log_backup_0_0_0_0.`. This type of backup has a source type `catalog`. This file contains the backup catalog file that stores the history of all backups. Only the catalog backups with source type `catalog` should be moved to the new Amazon S3 location. To change the Amazon S3 location for log backup, see [Configure SAP HANA to use a different Amazon S3 bucket and folder for data and log backup](#configure-sap-hana-to-use-different-amazon-s3-bucket-and-folder-for-data-and-log-backup). The following table provides an example of a SYSTEM DB folder structure: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.html) The following table is an example of a TENANT DB folder structure: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.html) **Note** Before doing steps a and b, ensure that there is no backup process running. 1. **Change the location of the catalog backup for SYSTEM DB** Run the following commands to move the `catalog` type of SYSTEM DB logs. In the example, we use the same Amazon S3 bucket, but create another folder for catalog backup. ``` # Create the folder structure aws s3api put-object --bucket --key S3 folder for catalog//usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --region # Execute a Dry Run to check aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "*" --include "log_backup_0_0_0_0*" --recursive --dryrun --region # Run the command to move the logs to the new S3 location aws s3 cp s3://example-s3-bucket;///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "*" --include "log_backup_0_0_0_0*" --recursive --region # Check the output of the S3 location for logs aws s3 ls s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --region ``` 1. **Change the location of the catalog backup for TENANT DB** Run the following commands to move the `catalog` type tenant database logs. In the example, we use the same Amazon S3 bucket, and create another folder for catalog backup. You need to repeat this step for every TENANT DB. ``` # Create the folder structure aws s3api put-object --bucket --key S3 folder for catalog//usr/sap//SYS/global/hdb/backint/DB_/ --region # Execute a Dry Run aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/DB_/ s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include "log_backup_0_0_0_0*" --recursive --dryrun --region # Run the command to move the catalog to the new S3 location aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/DB_/ s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include "log_backup_0_0_0_0*" --recursive --region # Check the output of the S3 location for catalog ``` 1. Create the ` aws-backint-agent-config-catalog.yaml ` parameter file 1. Make a copy of the existing AWS Backint agent configuration for catalog backup. ``` $ cp /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml /hana/shared/aws-backint-agent/aws-backint-agent-config-catalog.yaml ``` 1. Modify the `S3BucketName`, `S3BucketFolder`, and `LogFile` parameters in `aws-backint-agent-config-catalog.yaml`, using your preferred editor. ``` S3BucketName: "Amazon S3 bucket for SAP HANA catalog" S3BucketFolder: "Amazon S3 folder for SAP HANA catalog" LogFile: "/hana/shared/aws-backint-agent/aws-backint-agent-catalog.log" ``` 1. Create a `hdbbackint` soft link from `/usr/sap//SYS/global/hdb/opt/hdbconfig/` to `/hana/shared/aws-backint-agent/`. ``` $ ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config-catalog.yaml /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config-catalog.yaml ``` 1. Update the ` global.ini ` file Update the `global.ini` file with the following configuration. ``` log_backup_parameter_file = /usr/sap//SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config-logs.yaml ``` 1. Run reconfiguration for the update Run `hdbnsutil -reconfig` for the update to take effect. 1. Validate to ensure that all steps have been processed correctly 1. Run a point-in-time recovery to a previous state to ensure that you can access the previous log files in the new Amazon S3 location. 1. Verify that new logs are uploaded to the new S3 location. 1. Delete previous backups After a successful validation, we recommend waiting for at least a week before deleting the previous catalog. When you’re ready, delete the previous logs with the following commands. ``` # Delete previous backups in SYSTEMDB aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "" --include "log_backup_0_0_0_0" --recursive --dryrun --region aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ --exclude "" --include "log_backup_0_0_0_0" --recursive --region # Delete previous backups in the TENANT database (Repeat for each tenant) aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include --include "log_backup_0_0_0_0" --recursive --dryrun --region aws s3 rm s3://///usr/sap//SYS/global/hdb/backint/DB_/ --exclude "" --include "log_backup_0_0_0_0" --recursive --region ``` ## Configure AWS Backint agent to use shorter Amazon S3 paths AWS Backint agent uses the SAP HANA operating system path as the default location for backups, but you can configure it to use a shorter path. | | | | --- |--- | | Default path | s3://///usr/sap//SYS/global/hdb/backint/ | | New path | s3:///// | To use a shorter path, complete the following steps. 1. Check the SAP HANA backup parameters Locate the `data_backup_parameter_file`, `log_backup_parameter_file`, and `catalog_backup_parameter_file` parameters. If you are using the same parameter for data, log, and catalog backups, you only need to make this change in the `aws-backint-agent-config.yaml` file. If you are using different files, these changes need to be made in both files. 1. Retain access to backups that are stored in the previous Amazon S3 location If this is a new setup or you do not want to retain the previous catalog backup, skip this step and continue with Step 3. Ensure that there is no backup process running, then run the following command to move all of the previous backups to the new Amazon S3 location. This step assumes that you are using the same configuration parameter for both data and log. The example below uses the same S3 bucket, but you can use a new bucket. ``` # Execute a Dry Run to check aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/ s3:///// --recursive --dryrun --region # Run the command to move the backups to new S3 location aws s3 cp s3://///usr/sap//SYS/global/hdb/backint/ s3:///// --recursive --region # Check the output of both S3 location aws s3 ls s3:///// --region ``` 1. Modify `aws-backint-agent-config.yaml`. ``` $ vi /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml ``` Add the `S3ShortenDestinationBackupEnabled` parameter in `aws-backint-agent-config.yaml`, using your preferred editor. ``` S3ShortenBackupDestinationEnabled: "true" ``` 1. Validate to ensure that all steps have been processed correctly 1. Run a point-in-time recovery to a previous state to ensure that you can access the previous log files in the new Amazon S3 location. 1. Verify that new logs are uploaded to the new S3 location. 1. Delete previous backups After a successful validation, we recommend waiting for at least a week before deleting the previous catalog. When you’re ready, delete the previous logs with the following commands. ``` # Execute a Dry Run to make sure aws s3 rm s3://///usr --recursive --dryrun --region # Run the command to delete it in the previous S3 location aws s3 rm s3://///usr --recursive --region # Check the output of both S3 location aws s3 ls s3:///// --region ``` ## View AWS Backint agent logs When the AWS Backint agent is called by SAP HANA for backup and restore related operations, the logs are written as `aws-backint-agent.log` to the `/aws-backint-agent/` folder. If you want to change the location of AWS Backint agent logs, you can update the parameter `LogFile` in the `aws-backint-agent-config.yaml` file. ## Get the currently installed AWS Backint agent version To display the backint version and the current AWS Backint agent version that it supports, run the `hdbbackint` command with the `–v` parameter from the install directory as the `adm` user as shown in the following example. ``` $ /usr/sap//SYS/global/hdb/opt/hdbbackint -v ``` For instance, running the preceding command on a system with `` as `HDB` returns the AWS Backint agent version as 1.05 as displayed in the image below. ![\[Image of the Backint agent version as 1.05.\]](http://docs.aws.amazon.com/sap/latest/sap-hana/images/get-currently-installed-backint-example.png) ``` $ /usr/sap//SYS/global/hdb/opt/hdbbackint -v ``` ## Update to the newest version or install a previous version of AWS Backint agent **Prerequisite** You must complete the following tasks before updating the agent. + Disable scheduled data backups as these can fail during the version update. + Stop log backups from SAP HANA Cockpit, SAP HANA Studio or through SQL command. **Update using installation method** The latest and previous versions of the installer can be found at the following S3 bucket locations. + *Latest version* – `s3://awssap-backint-agent/binary/latest/install-aws-backint-agent` * AWS GovCloud (US-East) latest version* – `s3://awssap-backint-agent-us-gov-east-1/binary/latest/install-aws-backint-agent` * AWS GovCloud (US-West) latest version* – `s3://awssap-backint-agent-us-gov-west-1/binary/latest/install-aws-backint-agent` + *Previous version* – `s3://awssap-backint-agent/binary/agent-version/install-aws-backint-agent` * AWS GovCloud (US-East) previous version* – `s3://awssap-backint-agent-us-gov-east-1/binary/agent-version/install-aws-backint-agent` * AWS GovCloud (US-West) previous version* – `s3://awssap-backint-agent-us-gov-west-1/binary/agent-version/install-aws-backint-agent` **Update using agent binary** 1. Based on your AWS Region, download the agent binary tar file into a temporary location from the relevant Amazon S3 location. ``` $ cd /tmp ``` ``` $ mkdir agent_download && cd agent_download ``` ``` $ aws s3 cp s3://awssap-backint-agent/binary//aws-backint-agent.tar.gz aws-backint-agent.tar.gz --region ``` The latest and previous versions of the installer can be found at the following S3 bucket locations. + *Latest version* – `s3://awssap-backint-agent/binary/latest/aws-backint-agent.tar.gz` * AWS GovCloud (US-East) latest version* – `s3://awssap-backint-agent-us-gov-east-1/binary/latest/aws-backint-agent.tar.gz` * AWS GovCloud (US-West) latest version* – `s3://awssap-backint-agent-us-gov-west-1/binary/latest/aws-backint-agent.tar.gz` + *Previous version* – `s3://awssap-backint-agent/binary/agent-version/aws-backint-agent.tar.gz` * AWS GovCloud (US-East) previous version* – `s3://awssap-backint-agent-us-gov-east-1/binary/agent-version/aws-backint-agent.tar.gz` * AWS GovCloud (US-West) previous version* – `s3://awssap-backint-agent-us-gov-west-1/binary/agent-version/aws-backint-agent.tar.gz` 1. Extract the binary using the following command. ``` $ tar -xf aws-backint-agent.tar.gz ``` 1. Disable scheduled data and log backups, if not already disabled as prerequisite. 1. Backup existing agent binary using the following command. This is to ensure that you have a backup if you need to revert the agent version. ``` $ cp /aws-backint-agent/aws-backint-agent /aws-backint-agent/aws-backint-agent. ``` 1. Copy the newly extracted agent binary using the following command. ``` $ cp aws-backint-agent /aws-backint-agent/aws-backint-agent ``` 1. Change the ownership and mode with the following commands. ``` $ cd /aws-backint-agent ``` ``` $ chmod 770 aws-backint-agent ``` ``` $ chown adm:sapsys aws-backint-agent ``` 1. Once the installation or update is complete, you can re-enable scheduled data backups and log backups. See [Modify AWS Backint agent configuration parameters](#aws-backint-agent-modifying-config) for the configuration parameters of the agent that are applicable according to the version. For installing the agent with AWS Systems Manager, leave the **Agent version** blank or input a specific agent version, and follow the steps in [Install AWS Backint agent using the AWS Systems Manager document](#aws-backint-agent-ssm-document). ## Performance tuning AWS Backint agent is installed with default values that optimize the performance of backup and restore operations. If you want to further optimize the performance of your backup and restore operations, you can adjust the `UploadChannelSize` and `MaximumConcurrentFilesForRestore` parameters. Ensure that you are using the right instance type and storage configurations to get the best performance. AWS Backint agent is constrained by the resources available in the instance. The `UploadChannelSize` parameter is used to determine how many files can be uploaded in parallel to the S3 bucket during backups. The default value for this parameter is `10` and it provides optimal performance in most cases. The `UploadConcurrency` parameter is used to determine how many S3 threads can work in parallel during backups. The default value for this parameter is `100` and it provides optimal performance in most cases. The `MaximumConcurrentFilesForRestore` parameter is used to determine how many files can be downloaded in parallel from S3 during a restore operation. The default value for this parameter is `5`, which provides the optimal performance for most use cases. If you want to adjust these parameters, you can add them to the `aws-backint-agent-config.yaml` file and adjust the values (up to the allowed maximum). We strongly recommend that you test both the backup and recovery operations after the change to ensure there is no unintended impact to your backup and restore operations, as well as to other standard operations. For non-production servers and SAP HANA instances smaller than 512 GB, you can lower the Amazon S3 upload and restore parameters to avoid maxing out the data volume Amazon EBS throughput. You can assign lower parameter values for non-production instances. | | | | --- |--- | | `UploadConcurrency` | 10 | | `UploadChannelSize` | 5 | You can test the speed of your backup and Amazon EBS usage before increasing the parameter values for optimal backup time and disk usage. For more information, see [Storage configuration for SAP HANA](https://docs.aws.amazon.com/sap/latest/sap-hana/hana-ops-storage-config.html). ## Subscribe to AWS Backint agent notifications Amazon Simple Notification Service (Amazon SNS) can notify you when new versions of AWS Backint agent or AWS Backint installer are released. The following procedure shows how to subscribe to these notifications. 1. Open the Amazon SNS console at https://console.aws.amazon.com/sns/v3/home. 1. From the Region selector in the navigation bar, choose **US East (N. Virginia)**, if it is not selected already. You must select this Region because the SNS notifications for AWS Backint agent that you are subscribing to are generated from this Region only. 1. In the navigation pane, choose **Subscriptions**. 1. Choose **Create subscription**. 1. For **Create subscription**, do the following: 1. For **Topic ARN**, use the following Amazon Resource Name (ARN): `arn:aws:sns::464188257626:AWS-Backint-Agent-Update` For the and Regions, use `arn:aws-cn:sns:cn-north-1:476271213511:AWS-Backint-Agent-Update` For AWS GovCloud (US-East) and AWS GovCloud (US-West), use `arn:aws-us-gov:sns:us-gov-east-1:516607370456:AWS-Backint-Agent-Update` 1. For **Protocol**, choose **Email** or **SMS**. 1. For **Endpoint**, enter an email address that you can use to receive the notifications. If you choose **SMS**, enter an area code and number. 1. Choose **Create subscription**. 1. If you chose **Email**, you’ll receive an email asking you to confirm your subscription. Open the email and follow the directions to complete your subscription. Whenever a new version of AWS Backint agent or AWS Backint installer is released, we send notifications to subscribers. If you no longer want to receive these notifications, use the following procedure to unsubscribe. 1. Open the Amazon SNS console. 1. In the navigation pane, choose **Subscriptions**. 1. Select the subscription and then choose **Actions**, **Delete subscriptions**. When prompted for confirmation, choose **Delete**. # Backup and restore your SAP HANA system with the AWS Backint Agent for SAP HANA When the AWS Backint agent is installed and configured on your Amazon EC2 instance, you can initiate backup and recovery using SQL statements, SAP HANA Cockpit, or SAP HANA Studio. **Topics** + [Backup and recovery using SQL statements](#aws-backint-agent-backup-recovery-sql) + [Backup and recovery using SAP HANA Cockpit or SAP HANA Studio](#aws-backint-agent-backup-recovery-sap-hana-cockpit-studio) + [Get backup and recovery status](#aws-backint-agent-backup-recovery-status) + [Find your backup in an Amazon S3 bucket](#aws-backint-agent-backup-recovery-s3) + [Schedule and manage backups](#aws-backint-agent-backup-schedule) + [Backup retention](#aws-backint-agent-backup-retention) ## Backup and recovery using SQL statements The following are a limited number of examples of SQL statements that you can use to perform backup and recovery. We recommend that you always refer to the SAP, SAP HANA Administration, or SQL Reference guides to find the syntax of all of the other options for your specific SAP HANA version. For more details, see [Backup and Recovery Statements](https://help.sap.com/viewer/4fe29514fd584807ac9f2a04f6754767/2.0.04/en-US/6304145fdb044950a55b1c419775a2a1.html) in the *SAP HANA SQL Reference Guide*. The following example shows the syntax to initiate a full data backup of the system database. ``` BACKUP DATA USING BACKINT ('/usr/sap//SYS/global/hdb/backint/SYSTEMDB/') ``` The following example shows the syntax to initiate a full data backup of the tenant database. ``` BACKUP DATA FOR USING BACKINT ('/usr/sap//SYS/global/hdb/backint/DB_/') ``` The following example shows the syntax to initiate a differential data backup of the tenant database. ``` BACKUP DATA DIFFERENTIAL FOR USING BACKINT ('/usr/sap//SYS/global/hdb/backint/DB_/') ``` The following example shows the syntax to initiate an incremental data backup of the tenant database. ``` BACKUP DATA INCREMENTAL FOR USING BACKINT ('/usr/sap//SYS/global/hdb/backint/DB_/') ``` The following example shows the syntax to recover your tenant database to a particular point in time. ``` RECOVER DATABASE FOR UNTIL TIMESTAMP 'YYYY-MM-DD HH:MM:SS' USING DATA PATH ('/usr/sap//SYS/global/hdb/backint/DB_/') USING LOG PATH ('/usr/sap//SYS/global/hdb/backint/DB_') USING BACKUP_ID 1234567890123 CHECK ACCESS USING BACKINT ``` The following example shows the syntax to recover your tenant database with a specific data backup using catalogs stored in S3. ``` RECOVER DATA FOR USING BACKUP_ID 1234567890123 USING CATALOG BACKINT USING DATA PATH ('/usr/sap//SYS/global/hdb/backint/DB_/') CLEAR LOG ``` The following example shows the syntax to recover your tenant database with a specific data backup without using a catalog. ``` RECOVER DATA FOR USING BACKINT ('/usr/sap//SYS/global/hdb/backint/DB_/') CLEAR LOG ``` With AWS Backint agent, you can perform system copies by restoring a backup of the source database into the target database. To perform system copies using AWS Backint agent, verify the following requirements. 1. You must have AWS Backint agent configured in both the source and target systems. 1. Check the compatibility of the SAP HANA software version of the source and target systems. 1. The AWS Backint agent in your target system should be able to access the Amazon S3 bucket where the backups of the source system are stored. If you use a different Amazon S3 bucket for backups in the source and target systems, you have to adjust the configuration parameters of the AWS Backint agent in the target system to temporarily point to the Amazon S3 bucket where the backups are stored in the source system. 1. If you are performing a system copy across two different AWS accounts, ensure that you have the appropriate IAM permissions and Amazon S3 bucket policies in place. See the [Identity and Access Management](aws-backint-agent-s3-prerequisites.md#aws-backint-agent-iam) section in this document for details. The following is the syntax to restore a specific backup of the source tenant database into your target tenant database. ``` RECOVER DATA FOR USING SOURCE '@' USING BACKUP_ID 1234567890123 USING CATALOG BACKINT USING DATA PATH ('/usr/sap//SYS/global/hdb/backint/DB_/') CLEAR LOG ``` The following is an example of a SQL statement to restore a specific backup of the source tenant database, called `SRC`, in the source system `QAS` into a target tenant database called `TGT`. ``` RECOVER DATA FOR TGT USING SOURCE 'SRC@QAS' USING BACKUP_ID 1234567890123 USING CATALOG BACKINT USING DATA PATH ('/usr/sap/QAS/SYS/global/hdb/backint/DB_SRC/') CLEAR LOG ``` The following is an example of a SQL statement to perform a point-in-time recovery of a source tenant database, called `SRC`, in a source system `QAS` into a target tenant database called `TGT`. ``` RECOVER DATABASE FOR TGT UNTIL TIMESTAMP '2020-01-31 01:00:00' CLEAR LOG USING SOURCE 'SRC@QAS' USING CATALOG BACKINT USING LOG PATH ('/usr/sap/QAS/SYS/global/hdb/backint/DB_SRC') USING DATA PATH ('/usr/sap/QAS/SYS/global/hdb/backint/DB_SRC/') USING BACKUP_ID 1234567890123 CHECK ACCESS USING BACKINT ``` ## Backup and recovery using SAP HANA Cockpit or SAP HANA Studio In addition to using SQL statements, you can initiate the backup and recovery process from SAP HANA Cockpit or SAP HANA Studio. For more information, see [Backup and Recovery](https://help.sap.com/viewer/afa922439b204e9caf22c78b6b69e4f2/2.4.0.0/en-US/7b60ff9fc11a4c36adb2e75b993a06c9.html) and [Reference: Backup Console (SAP HANA Studio)](https://help.sap.com/viewer/6b94445c94ae495c83a19646e7c3fd56/2.0.03/en-US/2febf2472303493fbfe26eeb822f26f4.html) in the SAP documentation. Ensure that you are using the latest version of SAP HANA Cockpit or SAP HANA studio to get all of the latest features from SAP. ## Get backup and recovery status Use your current backup and restore methods to confirm the status of a backup and restore request, and to verify whether the AWS Backint agent is working correctly. For example, if you are using SAP HANA Studio to monitor the progress of a running backup, you can do the same for any backup requests triggered by the AWS Backint agent. For failure scenarios, you can review the AWS Backint agent logs or the SAP HANA backup logs for errors, and take action or reach out to AWS Support for assistance. ## Find your backup in an Amazon S3 bucket You can verify the backup files in your Amazon S3 bucket from the Amazon S3 console or by using APIs. AWS Backint agent stores your backup files using a designated folder structure within your Amazon S3 bucket. During backup and restore, SAP HANA uses this folder structure to stream data into a pipe that Backint agents can read and write. AWS Backint agent maintains this same folder structure in the Amazon S3 bucket. We recommend that you do not change this structure after you back up your files. Changing the folder structure can cause issues during the restore operation and impact your recoverability. For system and tenant databases, you can find your data, log, and catalog backups in the following locations. Your data backups will include an additional prefix that you used during the backup. ``` ///usr/sap//SYS/global/hdb/backint/SYSTEMDB/ ``` ``` ///usr/sap//SYS/global/hdb/backint/DB_/ ``` ## Schedule and manage backups You can use SAP HANA Cockpit to schedule periodic backups of your target SAP HANA database, including log backups. Ensure that you choose Backint as the backup type when scheduling your backup. For more details, see [Schedule Backups](https://help.sap.com/viewer/afa922439b204e9caf22c78b6b69e4f2/2.6.0.0/en-US/307452ce29b942c895e5de614043983a.html) in the *SAP HANA Administration with SAP HANA Cockpit Guide*. ## Backup retention Beginning with SAP HANA 2 SPS 03, you can use SAP HANA Cockpit to set the retention policies for your SAP HANA database backups. Based on your retention policies, SAP HANA Cockpit can automatically trigger jobs to delete old backups from catalogs, as well as the physical backups. This process also automatically deletes backup files stored in your Amazon S3 buckets. For more information, see "Retention Policy" under [Backup Configuration Settings](https://help.sap.com/viewer/afa922439b204e9caf22c78b6b69e4f2/2.10.0.0/en-US/b495da9a043a499893abc50c5cd367d9.html) in the *SAP HANA Administration with SAP HANA Cockpit Guide*. # AWS Backup This section provides information about setting up and using to backup and restore your SAP HANA databases to AWS Backup. **Topics** + [Prerequisites](#backint-backup-prerequisites) + [Install and configure AWS Backint Agent for SAP HANA](#backint-backup-install) + [Backup and restore your SAP HANA system with AWS Backup](#backint-backup-restore) ## Prerequisites The following prerequisites must be completed before to use to backup and restore SAP HANA databases to AWS Backup. For more information, see [Get started with AWS Systems Manager for SAP](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html) and [Register your SAP HANA databases with AWS Systems Manager for SAP](https://docs.aws.amazon.com/ssm-sap/latest/userguide/register-database.html). + [Set up required permissions for Amazon EC2 instance running SAP HANA database](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html#ec2-permissions) + [Set up required permissions for Amazon EC2 instance for backup and restore of SAP HANA database](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html#backup-permissions) + [Register SAP HANA database credentials in AWS Secrets Manager](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html#register-secrets) + [Verify AWS Systems Manager Agent (SSM Agent) is running](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html#verify-ssm-agent) + [Verify parameters before registering your SAP HANA database](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html#verification) + [Register your SAP HANA databases with AWS Systems Manager for SAP](https://docs.aws.amazon.com/ssm-sap/latest/userguide/register-database.html) ## Install and configure AWS Backint Agent for SAP HANA **Topics** + [AWS Systems Manager Agent (SSM Agent)](#aws-backint-backup-ssm) + [Systems Manager document](#aws-backint-backup-ssm-doc) + [Switch to AWS Backup from Amazon S3](#aws-backint-backup-switch) ### AWS Systems Manager Agent (SSM Agent) To install the with the AWS Systems Manager Agent (SSM Agent) document, you must install the [AWS Systems Manager Agent (SSM Agent)](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html) version 2.3.274.0 or later, and your instance must be a managed instance that is configured for AWS Systems Manager. For more information about managed instances, see [AWS Systems Manager Managed Instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/managed_instances.html). To update the SSM Agent, see [Update SSM Agent by using Run Command](https://docs.aws.amazon.com/systems-manager/latest/userguide/rc-console.html#rc-console-agentexample). **Note** The SSM Agent will not work if you do not attach the `AmazonSSMManagedInstanceCore` policy to your Amazon EC2 instance role. ### Systems Manager document Ensure that your installed SSM Agent is running, and then follow these steps. 1. Go to [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager) > Shared Resources > Documents. 1. Search for the **AWSSAP-InstallBackintForAWSBackup** document. 1. Select **Run command**. 1. Specify the following parameters in **Command parameters**. + System ID – Enter a system ID for your SAP HANA database. For instance, `HDB`. + Installation Directory Confirmation – yes + Modify Global Ini File – modify + Confirm Log Backup Post Install – yes + Ensure No Backup In Process – yes You can retain the other parameters without any manual changes. 1. Under **Target selection**, choose **Choose instances manually**, and search for the Amazon EC2 instance on which your SAP HANA database is running. Alternatively, you can select an instance with the `SSMForSAPManaged: True` tag. 1. **Run** the **AWSSAP-InstallBackintForAWSBackup** SSM document. The `Run` command takes a few minutes to complete. You can refresh the page to check the status. On successful completion, the *Overall status* and *Detailed status* display Success. ### Switch to AWS Backup from Amazon S3 You can switch your storage media to be AWS Backup if you have setup with Amazon S3. Before you do that, ensure the following: + Scheduled data backups are disabled – these can fail during switch-over. + Scheduled backup from SAP HANA Cockpit, SAP HANA Studio or through SQL to stop log backups to Amazon S3 are disabled – these are re-enabled with AWS Backup. To make the switch from Amazon S3 to AWS Backup, you must reinstall with Systems Manager document. The **AWSSAP-InstallBackintForAWSBackup** document replaces existing with a newer version that supports AWS Backup. For more details, see the preceding section [Systems Manager document](#aws-backint-backup-ssm-doc). Once the switch-over is complete, setup AWS Systems Manager for SAP for an automated backup solution. For more information, see [Get started with AWS Systems Manager for SAP](https://docs.aws.amazon.com/ssm-sap/latest/userguide/get-started.html). ## Backup and restore your SAP HANA system with AWS Backup You can now create a backup plan or perform on-demand backups. For more information, see [Backup Operations in the AWS Backup console](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-saphana.html#saphanabackupconsole). For details about backup and restore of your SAP HANA databases on AWS Backup, see [SAP HANA databases on Amazon EC2 instances backup](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-saphana.html#saphanabackupconsole). AWS Backup supports PrivateLink for SAP HANA on AWS. To create a backup dataplane VPC endpoint, see [Create an AWS Backup VPC endpoint](https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-network.html). # Verify the signature of the AWS Backint agent and installer for SAP HANA The source file of AWS Backint agent (`aws-backint-agent.tar.gz`) and AWS Backint installer (`install-aws-backint-agent`) supports signature verification. You can use a public key to verify that the downloaded source file and AWS Backint installer are original and unmodified. You can find the AWS Backint installer in your `/tmp` directory or any other location where you have downloaded the installer. You can find the source file (`aws-backint-agent.tar.gz`) of AWS Backint agent under `/aws-backint-agent/package/`. ## Verify the signature **Automatic signature verification** To enable automatic signature verification during agent installation, see the parameter descriptions at [Install AWS Backint agent using AWS Backint installer — interactive mode](aws-backint-agent-s3-installing-configuring.md#aws-backint-agent-installer-interactive) (Step 6k). **To verify the AWS Backint agent package on a Linux server** 1. Download the public key. ``` $ wget https://s3.amazonaws.com/awssap-backint-agent/binary/public-key/aws-backint-agent.gpg ``` 1. (Optional) For AWS GovCloud (US-East) or AWS GovCloud (US-West), download one of the following keys. ``` $ wget https://awssap-backint-agent-us-gov-east-1.s3.us-gov-east-1.amazonaws.com/binary/public-key/aws-backint-agent.gpg ``` ``` $ wget https://awssap-backint-agent-us-gov-west-1.s3.us-gov-west-1.amazonaws.com/binary/public-key/aws-backint-agent.gpg ``` 1. Import the public key into your keyring. ``` $ gpg --import aws-backint-agent.gpg gpg: key 1E65925B: public key "{aws} Backint Agent" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) ``` Make a note of the key value, as you will need it in the next step. In the preceding example, the key value is `1E65925B`. 1. Verify the fingerprint by running the following command. ``` $ gpg --fingerprint 1E65925B pub 2048R/1E65925B 2020-03-18 Key fingerprint = BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B uid [ unknown] AWS Backint Agent ``` The fingerprint should be equal to the following: ``` BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B ``` If the fingerprint string doesn’t match, don’t install the agent. Contact Amazon Web Services. After you have verified the fingerprint, you can use it to verify the signature of the AWS Backint agent binary. 1. Download the signature files for the source file and the installer. ``` $ wget https://s3.amazonaws.com/awssap-backint-agent/binary/latest/aws-backint-agent.sig $ wget https://s3.amazonaws.com/awssap-backint-agent/binary/latest/install-aws-backint-agent.sig ``` 1. (Optional) For AWS GovCloud (US-East) and AWS GovCloud (US-West), download the signature files from one of the following locations. ``` $ wget https://awssap-backint-agent-us-gov-east-1.s3.us-gov-east-1.amazonaws.com/binary/latest/aws-backint-agent.sig $ wget https://awssap-backint-agent-us-gov-east-1.s3-us-gov-east-1.amazonaws.com/binary/latest/install-aws-backint-agent.sig ``` ``` $ wget https://awssap-backint-agent-us-gov-west-1.s3.us-gov-west-1.amazonaws.com/binary/latest/aws-backint-agent.sig $ wget https://awssap-backint-agent-us-gov-west-1.s3-us-gov-west-1.amazonaws.com/binary/latest/install-aws-backint-agent.sig ``` 1. To verify the signature, run `gpg --verify` against the `aws-backint-agent.tar.gz` source file and `install-aws-backint-agent` installer. ``` $ gpg --verify aws-backint-agent.sig aws-backint-agent.tar.gz gpg: Signature made Fri 08 May 2020 12:24:48 AM UTC using RSA key ID 1E65925B gpg: Good signature from "AWS Backint Agent" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B $ gpg --verify install-aws-backint-agent.sig install-aws-backint-agent gpg: Signature made Fri 08 May 2020 12:15:40 AM UTC using RSA key ID 1E65925B gpg: Good signature from "AWS Backint Agent" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B ``` If the output includes the phrase `BAD signature`, check whether you performed the procedure correctly. If you continue to get this response, contact Amazon Web Services and avoid using the downloaded files. **Note** A key is trusted only if you or someone you trust has signed it. If you receive a warning about trust, this doesn’t mean that the signature is invalid. Instead, it means that you have not verified the public key. # Uninstall AWS Backint agent Use the following steps to uninstall AWS Backint agent. 1. Disable scheduled data and log backups if you are still using the agent for backups. 1. Remove the following symbolic links from the SAP HANA opt directory `/usr/sap//SYS/global/hdb/opt`. 1. SAP HANA link – `/hdbbackint` 1. Config YAML link – `/hdbconfig/aws-backint-agent-config.yaml` 1. Remove or rename the agent installation directory. 1. Modify or remove the agent configuration parameters in the `global.ini` file. Reset the following parameters that are modified during agent installation, to default. 1. `catalog_backup_parameter_file` 1. `data_backup_parameter_file` 1. `log_backup_parameter_file` 1. `catalog_backup_using_backint` – Set to false 1. `log_backup_using_backint` – Set to false 1. Reconfigure the changes as database administrative user for them to take effect. ``` hdbnsutil -reconfig ``` Your backups on Amazon S3 or AWS Backup remain intact even after uninstalling AWS Backint agent from your Amazon EC2 instances. If you do not need the backups, you can delete them from Amazon S3 or AWS Backup. # Troubleshoot AWS Backint Agent for SAP HANA The following documentation can help you troubleshoot problems that you might have with your AWS Backint Agent for SAP HANA installation or backups. **Topics** + [Agent logs](#aws-backint-agent-troubleshooting-agent-logs) + [Installation](#aws-backint-agent-troubleshooting-installation) + [Backup and recovery](#aws-backint-agent-troubleshooting-backup-recovery) + [Backup deletion](#aws-backint-agent-troubleshooting-deletion) ## Agent logs To find logs to help you troubleshoot errors and failures, check the following locations. **Agent logs** ``` {INSTALLATION DIRECTORY}/aws-backint-agent/aws-backint-agent.log ``` **System db backup/recovery logs** ``` /usr/sap//HDB//trace/backup.log /usr/sap//HDB//trace/backint.log ``` **Tenant db backup/recovery logs** ``` /usr/sap//HDB//trace/DB_/backup.log /usr/sap//HDB//trace/DB_/backint.log ``` ## Installation **Problem: Error returned when installing AWS Backint agent.** Error returned: ``` SyntaxError: Non-UTF-8 code starting with '\xf3' in file install-aws-backint-agent on line 1, but no encoding declared; see http://python.org/dev/peps/pep-0263/ for details ``` + **Root Cause**: Only Python version 3 is installed on the user environment. + **Resolution**: Run the following commands to install Python version 2 and create a symbolic link to `usr/bin/python`. ``` yum install -y python2 ``` ``` ln -s /usr/bin/python2.7 /usr/bin/python ``` **Problem: Unable to view the instance listed for installation with the SSM document.** + **Root Causes**: 1. The SSM Agent is not installed on the instance. 1. If the SSM Agent is installed, either the instance is not running or the SSM Agent on the instance is not running. 1. The SSM Agent installed on the instance is a version older than 2.3.274.0. + **Resolution**: Follow the steps listed at [Practice Installing or Updating SSM Agent on an Instance](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-agent.html). You can verify whether the SSM Agent is running with the following command. ``` sudo systemctl status amazon-ssm-agent ``` **Problem: The following error is returned when you use the SSM installation document.** `failed to download manifest - failed to retrieve package document description: InvalidDocument: Document with name AWSBackintAgent with version x does not exist.` + **Root Cause**: An unsupported version of AWS Backint agent was entered. + **Resolution**: See the version history for AWS Backint agent. For more information, see [Version history for AWS Backint agent](aws-backint-agent-version-history.md). ## Backup and recovery **Problem: `AccessDenied` appears in agent logs.** + **Root Causes**: 1. The IAM role for the EC2 instance does not have the correct permissions to access the S3 bucket. 1. The agent configuration file does not have the `S3BucketOwnerAccountID` in double quotes. The `S3BucketOwnerAccountID` is the 12-digit AWS Account ID. 1. The S3 bucket is not owned by the provided account for `S3BucketOwnerAccountID`. 1. The S3 bucket provided for the `S3BucketOwnerAccountID` was created before May 2019. + **Resolution**: Verify the [prerequisite steps](aws-backint-agent-s3-prerequisites.md) for installing the AWS Backint agent. **Problem: Backup or recovery failed due to S3 connectivity** + **Root Cause**: The IAM role attached to the instance does not have the correct permissions to access the S3 bucket. + **Resolution**: Verify the [prerequisite steps](aws-backint-agent-s3-prerequisites.md) for installing the AWS Backint agent. **Problem: Agent logs display `Backint cannot execute hdbbackint` or `No such file or directory`.** + **Root Causes**: 1. If you are installing the agent manually, the creation of a symlink for the agent executable did not succeed. 1. If you are using the SSM agent, step 2 of the agent failed while creating symlinks. You can verify this by viewing the RunCommand implementation details. + **Resolution**: Verify that you have correctly followed the [installation steps](aws-backint-agent-s3-installing-configuring.md) in this document. **Problem: The following error is displayed when initiating a backup from the SAP HANA console:** `Could not start backup for system DBC: [447]: backup could not be completed: [110091] Invalid path selection for data backup using backint: /usr/sap//SYS/global/hdb/backint/COMPLETE_DATA_BACKUP must start with /usr/sap//SYS/global/hdb/backint/DB_` + **Root Cause**: When adding your SAP HANA system to SAP HANA Studio, you chose the single container mode instead of the multiple container mode. + **Resolution**: Add the SAP HANA system to SAP HANA Studio and select multiple container mode, and then try to initiate your backup again. For more details, see [Invalid path selection for data backup using backint](https://me.sap.com/notes/2803753) (portal access required). **Problem: Your backup fails and the following error appears in `aws-backint-agent.log`:** `Error creating uploadId: AuthorizationHeaderMalformed: The authorization header is malformed; the region '' is wrong; expecting ''` + **Root Cause**: You specified an incorrect Region ID for the `AwsRegion` parameter in the `aws-backint-agent-config.yaml` configuration file. + **Resolution**: Specify the AWS Region of your Amazon S3 bucket and initiate the backup again. You can find the Region in which your Amazon S3 bucket is created from the Amazon S3 console. **Problem: Any AWS Backint agent operation fails with one of the following errors, which appear in the `aws-backint-agent.log`:** `Error creating upload id for bucket:` or `NoCredentialProviders: no valid providers in chain.` + **Potential Root Cause**: No IAM role is attached to your Amazon EC2 instance. + **Resolution**: AWS Backint agent requires an attached IAM role to your EC2 instance to access AWS resources for backup and restore operations. Attach an IAM role to your EC2 instance and attempt the operation again. For more information, see the [prerequisites](aws-backint-agent-s3-prerequisites.md) for installing AWS Backint agent. + **Potential Root Cause**: Use of proxy for HANA instance on which agent is run causes agent failure. + **Resolution**: When using a proxy for the HANA instance on which the agent is run, do not use a proxy for the instance metadata call, otherwise the call hangs. Instance metadata information can not be obtained via proxy, so it must be excluded. Update the launcher script at `{INSTALLATION DIRECTORY}/aws-backint-agent-launcher.sh` to designate `169.254.169.254` as a `no_proxy` host. ``` # cat aws-backint-agent-launcher.sh #!/bin/bash export https_proxy=: export HTTP_PROXY=: export no_proxy=169.254.169.254 export NO_PROXY=169.254.169.254 /hana/shared/aws-backint-agent/aws-backint-agent "$@" ``` For more information about using a proxy address in your SAP HANA environment, see [Use a proxy address with AWS Backint agent](aws-backint-agent-s3-installing-configuring.md#aws-backint-agent-sap-hana-proxy). **Problem: When you initiate a backup or restore, you get the following error in SAP HANA Studio or SAP HANA Cockpit:** `backup could not be completed, Backint cannot execute /usr/sap//SYS/global/hdb/opt/hdbbackint, Permission denied (13)` + **Root Cause**: The AWS Backint agent binary or launcher script doesn’t have the execute permission at the operating system level. + **Resolution**: Set the execute permission for AWS Backint agent binary `aws-backint-agent` and for the launcher script `aws-backint-agent-launcher.sh` in the installation directory (for example, `/hana/shared/aws-backint-agent/`). **Problem: My backup is running too slowly and is taking a longer time to complete.** + **Root Cause**: The performance of backup and restore depends on many factors, such as the type of EC2 instance used, the EBS volumes, and the number of SAP HANA channels. If your database size is less than 128 GB, SAP HANA defaults to a single channel, or your SAP HANA parameter `parallel_data_backup_backint_channels` is set to 1. + **Resolution**: The speed of your database backup depends on how much storage throughput is available to your SAP HANA data volumes (/hana/data). Total storage throughput available for SAP HANA data volumes depends on your Amazon EBS storage type and the number of volumes used for striping. For best performance, follow the [storage configuration](https://docs.aws.amazon.com/sap/latest/sap-hana/hana-ops-storage-config.html) best practices. You can switch your Amazon EBS volumes associated with SAP HANA data filesystem to `io1`, `io2` or `gp3` volume type. Additionally, if your database size is greater than 128 GB, you can improve your backup performance by adjusting the number of parallel backup channels. Increase the value of `parallel_data_backup_backint_channels` and try to initiate your backup again. We recommend that you take the resource contention with normal system operation performance into consideration when you try to tune the performance of your backup. **Problem: My backup and restore fails with one of the following errors:** 1. `Backint exited with exit code 1 instead of 0. console output: Crashed during fetch and conversion read/write tcp 10.0.2.83:56192→52.216.88.123:443: use of closed network connection` 1. `Backint exited with exit code 1 instead of 0. console output: Crashed during fetch and conversion caused by: read tcp 10.0.2.83:54890→52.216.130.243:443: read: connection reset by peer` + **Root Cause**: The connection between AWS Backint agent and S3 fails due to high throughput. + **Resolution**: Use the following steps to troubleshoot this issue. 1. Update AWS Backint agent version to 2.0.4.768 or higher. These versions have improved resiliency to S3 connection timeouts. + Once the agent is updated, ensure that SAP HANA picks up the latest version of the agent. Run the following command to verify the version of the agent. ``` /usr/sap//SYS/global/hdb/opt/hdbbackint -v ``` For more information, see \$1https---docs-aws-amazon-com-sap-latest-sap-hana-aws-backint-agent-s3-installing-configuring-html-aws-backint-agent-latest-version\$1[Get the currently installed AWS Backint agent version]. 1. Use these steps if the issue persists – lower the following backup and restore parameters. + **Backup** + `UploadConcurrency` + `UploadChannelSize` + **Restore** + `MaximumConcurrentFilesForRestore` + `DownloadConcurrency` *These values reduce concurrency and parallelism used by AWS Backint agent to achieve high performance during backup and restore. See [Modify AWS Backint agent configuration parameters](https://docs.aws.amazon.com/sap/latest/sap-hana/aws-backint-agent-s3-installing-configuring.html#aws-backint-agent-latest-version) for the default values of the preceding parameters.* 1. Review network setup and configuration. 1. Perform trace route to see if Amazon S3 traffic goes through firewall package scanners or any other software that could significantly increase network latency. **Problem: When you set the `S3ShortenBackupDestinationEnabled = ‘true’` parameter in the `aws-backint-agent-config.yaml`, a ‘No data backups found’ error is displayed when processing a database recovery.** ![\[Image showing a '`No data backups found’ error displayed when processing a database recovery in S3S.\]](http://docs.aws.amazon.com/sap/latest/sap-hana/images/s3-shorten-true-troubleshoot-backint.jpg) + **Root Cause**: AWS Backint agent searches for the logs and data backups only in the Amazon S3 path that’s provided in the configuration file. Because the `S3ShortenBackupDestinationEnabled` parameter changes the Amazon S3 folder, it cannot find the backup. + **Resolution**: You can either change the `S3ShortenBackupDestinationEnabled` parameter to `false` and run the restore, or you can move the previous backups and the SAP HANA backup catalog to the new S3 location. For more details, see [Configure AWS Backint agent to use shorter Amazon S3 paths](aws-backint-agent-s3-installing-configuring.md#configure-aws-backint-agent-to-use-shorter-amazon-s3-paths). **Problem: When processing a database recovery, a 'No data backups found' error is displayed and the agent log shows, 'The operation is not valid for the objects' access tier'.** ![\[Image showing a 'No data backups found' error and the agent log message 'The operation is not valid for the objects' access tier'.\]](http://docs.aws.amazon.com/sap/latest/sap-hana/images/s3-intelligent-tiering-troubleshoot-backint.png) + **Root Cause**: With the **S3StorageClass = "INTELLIGENT\$1TIERING" ** parameter set in the `aws-backint-agent-config.yaml`, the objects have moved to archival storage tiers. AWS Backint agent does not support recovery from archival tiers. + **Resolution**: You must first [restore the archived S3 objects](https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects.html) to move them in the access tier. This can take from a few minutes to 12 hours, depending on the archival tier and restore option that is selected. After the S3 restore is complete, you can initiate recovery for the HANA database. **Problem: Backup request initiated by IAM doesn’t have access to your Amazon S3 bucket.** Error returned: ``` Error Fetching Bucket: Access Denied ``` + **Root Cause**: Credentials for internal tasks are configured in the `–0—/aws` folder which is picked by default instead of the configured IAM role for initiating a backup request. + **Resolution**: When you initialize a new service client without providing any credential arguments, the SDK uses the default credential provider chain to find AWS credentials. The SDK uses the first provider in the chain that returns credentials without an error. The default provider chain looks for credentials in the following order: 1. Environment variables 1. Shared credentials file 1. If your application uses an Amazon ECS task definition or RunTask API operation, IAM role for tasks 1. If your application is running on an Amazon EC2 instance, IAM role for Amazon EC2 For more information, see [Configuring the AWS SDK for Go](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html). **Problem: "/bin/sh: error importing function definition for `which`" when performing backup and restore with AWS Backint agent.** "/bin/sh: error importing function definition for `which`" error may occur when performing backup and restore with AWS Backint agent. This error occurs when ` BASH_FUNC_which%%` environment variable has a multi-line value that is not supported by some older SAP scripts. **Affected environment** + Red Hat Enterprise Linux 8.5 and later + Systems with "which" package 2.21-18 or later + **Root cause**: The `which-2.21-18.el8.x86_64 RPM` package sets the `BASH_FUNC_which%%` variable with a multi-line function definition in `/etc/profile.d/which2.{csh,sh}` files. Some older SAP scripts are unable to parse this correctly. + **Resolution**: Check if `BASH_FUNC_which%%` is running using the following command. ``` $ env | grep -A 2 BASH_FUNC_which ``` Based on your business requirements, use one of the following resolutions. 1. *Temporary*: Run `unset -f which` to unset the function. This step must be repeated for each new session. 1. *User-level*: Add `unset -f which` to the user’s `–0—bashrc` file. Verify if this is a scalable resolution for you. 1. *System-level*: Move `/etc/profile.d/which2.{sh,csh}` files to a backup location or create `/etc/profile.d/zzz_which2.{sh,csh}` using the following steps. `sh: echo "unset -f which"` > `/etc/profile.d/zzz_which2.sh csh: echo "unalias which"` > `/etc/profile.d/zzz_which2.csh`. The system-level fix is a persistent solution that survives package updates to the "which" package. We recommended this resolution. ## Backup deletion **Problem: You deleted your SAP HANA backup from the SAP HANA backup console (SAP HANA Studio or SAP HANA Cockpit) but the deleted backup files still appear in the Amazon S3 folder.** + **Root Cause**: AWS Backint agent couldn’t delete the associated backup files from the Amazon S3 bucket due to a permission issue. + **Resolution**: AWS Backint agent requires `s3:DeleteObject` permission to delete the backup files from your target Amazon S3 bucket when you delete the backup from the SAP HANA backup console. Ensure that the IAM profile attached to your EC2 instance has `s3:DeleteObject` permission. For backups that are already deleted from SAP HANA, you can manually delete the associated files from the Amazon S3 bucket. We recommend that you take additional precaution before manually deleting any backup files. Manually deleting the wrong backup file could impact your ability to recover your SAP HANA system in the future. # Version history for AWS Backint agent The following table summarizes the changes for each release of AWS Backint agent. | Version | Details | Release date | | --- | --- | --- | | 2.1.5 | \$1 Added support for PrivateLink with AWS Backup | February 16, 2026 | | 2.0.5.>=892 | \$1 Added Region support: `ap-southeast-5` / Asia Pacific (Malaysia) \$1 Bug fix: Agent binary signature verification in silent mode | December 9, 2024 | | 2.0.5.873 | Improved management of SSM documents. | September 24, 2024 | | 2.0.5.862 | \$1 Improved Agent logging. | July 16, 2024 | | 2.0.5.824 | \$1 Improved resiliency for AWS Backup connection timeouts. \$1 Added Region support: `il-central-1` / Israel (Tel Aviv) and `ca-west-1` / Canada West (Calgary) | April 17, 2024 | | 2.0.4.797 | Manual installer update | January 10, 2024 | | 2.0.4.779 | \$1 Added Region support: `ap-southeast-4` / Asia Pacific (Melbourne), `eu-central-2` / Europe (Zurich), and `eu-south-2` / Europe (Spain) | January 2, 2024 | | 2.0.4.768 | \$1 Improved resiliency for Amazon S3 connection timeouts. | October 06, 2023 | | 2.0.3.755 | \$1 Improved `AWSSAP-InstallBackint` and `AWSSAP-InstallBackintForAWSBackup` input validation. \$1 Removed boto3 requirement for installation of the agent. | September 13, 2023 | | 2.0.2.732 | \$1 Set `config file` permissions to `sapsys` group. \$1 Added Region support: `ap-south-2` / Asia Pacific (Hyderabad) and `me-central-1` / Middle East (UAE) | July 14, 2023 | | 2.0.1.671 | \$1 Added support for AWS Backup as storage media. \$1 Added support for `backint protocol` 1.5. \$1 Added support for Python 3. | April 17, 2023 | | 1.05.4 | \$1 Added Region support: `ap-southeast-3` / Asia Pacific (Jakarta) | February 22, 2023 | | 1.05.4 | \$1 Improved `AWSSAP-InstallBackint SSM` document AWS KMS input validation. | February 25, 2022 | | 1.05.3 | \$1 Improved `AWSSAP-InstallBackint SSM` document input validation. | February 04, 2022 | | 1.05.2 | \$1 Bug fix: Robust error handling for Amazon S3 connection failures. | December 08, 2021 | | 1.05 | \$1 Added support for Intelligent-Tiering S3 storage class. \$1 Add support for shortening S3 paths. \$1 Added support for separate log, data, and catalog backup S3 paths. \$1 Added support for `python3` non-compiled version of the installer. \$1 Added support for installation through Ansible configurations. \$1 Bug fix: Removal of ASCII characters. \$1 Bug fix: Agent binary signature verification in silent mode. | August 30, 2021 | | 1.04 | \$1 Added support for bucket owner full control access to backup objects for cross-account backups. \$1 Bug fix: Parallel restore configuration issue. \$1 Added support for Amazon EC2 Instance Metadata Service (IMDS) v2. | May 28, 2021 | | 1.03 | \$1 Added Region support: `ap-northeast-3` / Asia Pacific (Osaka) \$1 Added support for rotating agent log files. \$1 Added support for additional S3 object tags. \$1 Improved parallel restore using efficient parallelism. \$1 Bug fix: SSM document to locate `python2` library for installation. \$1 Bug fix: Support for isolated instances to make Regional S3 calls. \$1 Add support for automatic agent signature verification. | March 31, 2021 | | 1.02.1 | \$1 Bug fix: kms-key formatting issue. | December 4, 2020 | | 1.02 | \$1 Bug fix: Backup failure at high throughput due to failed connection with S3. | November 19, 2020 | | 1.01 | \$1 Added Region support: AWS GovCloud (US) \$1 Added support for specifying number of S3 threads that can run in parallel using UploadConcurrency parameter in configuration file. \$1 Removed -o flag. \$1 Added -l flag, which allows you to specify the location of the agent .tar file. \$1 Added support for specifying the agent installation version. \$1 Added support to ignore S3 bucket validations. \$1 Bug fix: Occasional installation failure when AWS CLI installation is selected. | July 17, 2020 | | 1.0 | Initial release | May 18, 2020 |