BTP Cloud Connector Part 2: Subaccount Pairing, Access Control and System Mapping
Configure Cloud Connector properly: subaccount definitions with location IDs, system mappings (back-end type, protocol, virtual/internal host), resources with path policies, principal propagation settings (system certificate, CA), audit logs, and testing from BTP.
Explanation
📌 KEY POINTS
✅ Each subaccount definition can have a location ID to distinguish multiple connectors.
✅ System mapping: back-end type, protocol, virtual host/port → internal host/port.
✅ Resources define exact paths (or RFC functions) with "path only" or "path and all sub-paths".
✅ Principal propagation needs a system certificate and CA configuration plus back-end trust.
⚠️ Using HTTP instead of HTTPS to the back end sends data unencrypted inside the network.
━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 1 explained the tunnel. Now configuration.
━━━━━━━━━━━━━━━━━━━━
▶ 1. SUBACCOUNT DEFINITION
- Region, subaccount, location ID.
━━━━━━━━━━━━━━━━━━━━
▶ 2. SYSTEM MAPPING
- Virtual vs internal host; protocol.
━━━━━━━━━━━━━━━━━━━━
▶ 3. RESOURCES
- Path policies; RFC function names/prefixes.
━━━━━━━━━━━━━━━━━━━━
▶ 4. PRINCIPAL PROPAGATION
- System certificate, CA, subject pattern.
━━━━━━━━━━━━━━━━━━━━
▶ 5. AUDIT & TEST
- Audit log level; check from BTP.
━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP
- Add a system mapping (HTTPS).
- Add resources for one OData path.
- Configure principal propagation and test.
✅ CHECKPOINT: only allowed paths respond; others are denied.
Code example
===== SYSTEM MAPPING =====Back-end type: ABAP System | Protocol: HTTPS | Virtual host: s4h-prd-virtual:443 → Internal host: s4hprd01.corp.local:44300Principal type: X.509 Certificate ===== RESOURCES =====/sap/opu/odata/sap/API_BUSINESS_PARTNER → Path and all sub-pathsRFC: BAPI_SALESORDER_* → prefix (only if needed) ===== PRINCIPAL PROPAGATION =====System certificate (SCC) | CA certificate for short-lived certs | back-end: trust SCC system cert + certificate-to-user ruleReal project scenario
An audit found Cloud Connector exposing the full ICF tree of an S/4HANA system. Restricting resources to three OData services and switching to HTTPS closed the finding.
Common mistakes
- Exposing full trees.
- HTTP to back end.
- Wildcard RFCs.
- Real host names as virtual.
- No audit logging.
Best practices
- Minimal resources.
- HTTPS.
- Specific RFCs.
- Virtual naming convention.
- Audit logs on.
Interview angle
Questions: "What is a system mapping?", "How do you restrict access?", "What's needed for principal propagation?"
Strong answer: subaccount definition, mapping, resources, PP setup, audit/testing.
Practice this lesson
Quick check
1. What is the function of the 'Accessible Resources' (URL path/resource whitelist) configuration within a system mapping in Cloud Connector?
2. An audit finds Cloud Connector exposes the full ICF tree of S/4HANA. What should be done?
3. What information does the Cloud Connector administration UI's connectivity monitoring/dashboard typically provide to an administrator?
Interview questions
1. How would you apply Cloud Connector in a real SAP project? Walk through the design or implementation approach.
Answer it in your own words first, then compare.
2. What are the most important design decisions, trade-offs, and best practices in Cloud Connector?
Answer it in your own words first, then compare.
Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.