BTP & Integrationbeginner

BTP Cloud Connector Part 1: How Cloud Connector Works

Key takeaway

SAP Cloud Connector links on-premise systems to BTP securely. Learn installation options, how it opens an outbound TLS tunnel to a subaccount, supported protocols (HTTP, RFC, TCP, LDAP), and the principle of exposing only what's needed.

What this complete series covers

Learn Cloud Connector in a clear, practical sequence — from the basic idea to real project use, troubleshooting, and interview-ready understanding.

Who it is for: Best for SAP consultants, developers, and learners who want a practical understanding of Cloud Connector.
Prerequisites: A basic understanding of SAP BTP helps. Hands-on steps may require a BTP subaccount and access to the relevant Integration Suite or BTP service.
Final outcome: By the end, you should be able to explain Cloud Connector clearly, follow the main end-to-end flow, apply it in a project scenario, and troubleshoot the most common issues.

Part 1: BTP Cloud Connector Part 1: How Cloud Connector Works
Understand why Cloud Connector exists, how it establishes secure connectivity between BTP and on-premise systems, and the core components involved in the tunnel architecture.
Part 2: BTP Cloud Connector Part 2: Subaccount Pairing, Access Control and System Mapping
Learn the practical configuration steps for pairing Cloud Connector to a BTP subaccount, defining access control entries, and mapping virtual systems to internal backend hosts for
Part 3: BTP Cloud Connector Part 3: High Availability, Multiple Connectors and Operations
Learn how to design a resilient Cloud Connector setup using master-shadow high availability pairs and understand the failover mechanics, connection distribution, and operational im

System and release assumptions: SAP BTP services evolve regularly. Capability names, screens, and setup steps can differ by region, entitlement, and tenant version; the core design principles remain the same.

Explanation

📌 KEY POINTS
✅ Cloud Connector runs in the customer network and opens an outbound TLS connection to BTP — no inbound ports.
✅ It connects to one or more subaccounts (by region host and subaccount ID).
✅ Back-end systems are exposed via virtual hosts; only allowed resources (paths, RFC functions) are reachable.
✅ Supported: HTTP(S), RFC, TCP, LDAP, and more depending on scenario.
⚠️ Installing Cloud Connector on a developer laptop for production use creates a single point of failure and security risk.

━━━━━━━━━━━━━━━━━━━━
▶ WHAT THIS SERIES COVERS
Part 1: How Cloud Connector works
Part 2: Subaccount connection, access control and mapping
Part 3: High availability and operations

━━━━━━━━━━━━━━━━━━━━
▶ 1. ARCHITECTURE

Outbound tunnel; connectivity service on BTP side.

━━━━━━━━━━━━━━━━━━━━
▶ 2. INSTALLATION

Server installation; admin UI (port 8443 default).

━━━━━━━━━━━━━━━━━━━━
▶ 3. SUBACCOUNT CONNECTION

Region, subaccount, user credentials.

━━━━━━━━━━━━━━━━━━━━
▶ 4. EXPOSURE

Virtual host mapping; resources.

━━━━━━━━━━━━━━━━━━━━
▶ 5. SECURITY

Least exposure; audit logs.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Install Cloud Connector on a server.
Connect to a subaccount.
Expose one OData service path.

✅ CHECKPOINT: BTP cockpit shows the connector as connected.

Code example

ABAP Code

===== TUNNEL =====Cloud Connector (DMZ/intranet) ──outbound TLS──► BTP connectivity service (subaccount) ◄── BTP apps via destinations ===== ADMIN UI =====https://<scc-host>:8443 | Define Subaccount (region, subaccount ID, location ID) | Cloud To On-Premise → Access Control

Real project scenario

A pilot ran Cloud Connector on a developer's laptop; when it slept, integrations stopped. Moving to a dedicated server with HA later stabilized the landscape.

Common mistakes

Laptop installations.
Exposing everything.
No patching.
No audit.
Shared admin passwords.

Best practices

Dedicated servers.
Minimal resources.
Regular updates.
Audit logging.
Personal admin users.

Interview angle

Questions: "How does Cloud Connector work?", "Why no inbound ports?", "Which protocols are supported?"
Strong answer: architecture, installation, connection, exposure, security.

Practice this lesson

Quick check

1. How does the Cloud Connector initiate and maintain its connection to the assigned BTP subaccount?

2. Which back-end connection types can be configured in Cloud Connector's system mappings for on-premise connectivity?

3. What is the primary architectural benefit of using SAP Cloud Connector to link an on-premise system to a BTP subaccount?

Interview questions

1. What are the core concepts of Cloud Connector, and how would you explain them clearly in an SAP interview?

Answer it in your own words first, then compare.

2. A pilot ran Cloud Connector on a laptop and integrations stop randomly. Explain how Cloud Connector works and how to set it up properly.