RAP / CDS / ODataadvanced

AMDP Part 6: AMDP in Clean Core and ABAP Cloud

Key takeaway

Use AMDP responsibly under clean core: what ABAP Cloud allows (C4-released objects, own objects), what to avoid on-premise, and how to design AMDP so it survives upgrades.

Explanation

📌 KEY POINTS
✅ Clean core does not forbid AMDP — it restricts what AMDP may read.
✅ In ABAP Cloud, USING may contain only own objects and SAP objects released for AMDP (contract C4).
✅ Never read SAP tables in new AMDP code; read released CDS views (C4) or your own data.
⚠️ AMDP writing to SAP tables bypasses all business logic — not acceptable in clean-core designs.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Parts 1–5 covered AMDP technically. This final part places it in the clean-core world (see ABAP Cloud Part 7 for release contracts).

━━━━━━━━━━━━━━━━━━━━
▶ 1. WHAT ABAP CLOUD ALLOWS

AMDP is available in ABAP for Cloud Development (on HANA).
The USING clause may reference:

– your own database tables, CDS entities and AMDPs;
– SAP objects released with contract C4 ("Use in ABAP-Managed Database Procedures and Functions").

SAP tables and non-C4 views are rejected by the syntax check.

━━━━━━━━━━━━━━━━━━━━
▶ 2. WHY C4 IS A SEPARATE CONTRACT
Reading a CDS view in ABAP SQL (C1) lets the ABAP runtime apply client handling, access control and future changes. SQLScript reads the database objects directly, so SAP must explicitly promise that the database-level structure stays stable — that is C4.

━━━━━━━━━━━━━━━━━━━━
▶ 3. ON-PREMISE STANDARD ABAP
Technically you can read any table in AMDP. Clean-core recommendations still apply:

Prefer C4-released CDS views over SAP tables.
Keep AMDP read-only.
Document every SAP table access as technical debt (tier 3 / tier 2 thinking from ABAP Cloud Part 2).

━━━━━━━━━━━━━━━━━━━━
▶ 4. NEVER WRITE SAP DATA WITH AMDP
Updating SAP tables in SQLScript bypasses validations, change documents, locks and follow-up processing. Change SAP data only via released APIs (RAP BO interfaces via EML, released classes).

━━━━━━━━━━━━━━━━━━━━
▶ 5. UPGRADE-SAFE DESIGN

Minimal USING list; each dependency is an upgrade risk.
Read through a small number of released/own CDS views rather than many tables.
Keep SQLScript declarative (easier to adapt).
Tests that run after upgrades (ATC + ABAP Unit).
Check periodically whether new CDS features let you remove the AMDP.

━━━━━━━━━━━━━━━━━━━━
▶ 6. AUTHORIZATION
AMDP does not apply CDS access control or ABAP authorization checks automatically. Either check authorization in ABAP before the call, or expose results via a CDS table function wrapped by a view with DCL.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

List USING objects of your AMDPs; classify: own / C4-released / other SAP.
Replace "other SAP" with C4-released views or own data where possible.
Ensure AMDPs are read-only; move writes to released APIs.
Add authorization checks or a DCL-protected wrapper.
Run ATC cloud checks.

✅ CHECKPOINT: your AMDP code is clean-core compliant. AMDP series complete.

Code example

ABAP Code

" ===== ABAP Cloud: allowed and rejected USING entries =====CLASS zcl_pr_amdp DEFINITION PUBLIC FINAL CREATE PUBLIC.  PUBLIC SECTION.    INTERFACES if_amdp_marker_hdb.    TYPES: BEGIN OF ty_row, supplier TYPE c LENGTH 10, open_requests TYPE i, END OF ty_row,           tt_rows TYPE STANDARD TABLE OF ty_row WITH EMPTY KEY.    CLASS-METHODS open_by_supplier      EXPORTING VALUE(et_rows) TYPE tt_rows.ENDCLASS. CLASS zcl_pr_amdp IMPLEMENTATION.  METHOD open_by_supplier BY DATABASE PROCEDURE FOR HDB LANGUAGE SQLSCRIPT                          OPTIONS READ-ONLY                 " read-only by design                          USING zpr_head.                   " own table: allowed    et_rows = SELECT supplier, COUNT(*) AS open_requests                FROM zpr_head               WHERE client = SESSION_CONTEXT( 'CLIENT' )                 AND status = 'S'               GROUP BY supplier;  ENDMETHOD.ENDCLASS. " ===== Rejected in ABAP for Cloud Development =====" USING ekko            -> SAP table, not released for AMDP" USING i_supplier      -> only if released with contract C4 (check API state!)" UPDATE ekko SET ...   -> never: bypasses SAP business logic " ===== Authorization: AMDP does not check it =====" AUTHORITY-CHECK / released authorization API in ABAP BEFORE calling," or wrap a table function in a CDS view with @AccessControl + DCL role. " ===== Dependency review table =====" AMDP            | USING object | Type          | Clean-core status" ZCL_PR_AMDP     | ZPR_HEAD     | own table     | OK" ZCL_SALES_AMDP  | ZSALES_ITEM  | own table     | OK" ZCL_OLD_REPORT  | VBAK         | SAP table     | replace (C4 view / redesign)

Real project scenario

During an ABAP Cloud readiness assessment, 25 AMDP classes were found, 9 of which read SAP tables directly and one of which updated a status field in an SAP table "for performance". The update bypassed change documents, and auditors had flagged missing history.
The team replaced the update with a released API call in ABAP, switched table reads to C4-released views or own replicated data where possible, and documented the remaining two as tier 3 debt with a migration date. New AMDPs were only approved with a USING list reviewed against the C4 rule.

Common mistakes

Believing clean core forbids AMDP entirely.
Reading SAP tables in new AMDP code.
Writing SAP tables with SQLScript.
Assuming AMDP applies access control.
Large USING lists with many SAP dependencies.
Not re-running tests after upgrades.

Best practices

Restrict USING to own and C4-released objects.
Keep AMDP read-only; change SAP data via released APIs.
Add authorization checks or DCL-protected wrappers.
Minimize and document dependencies.
Run ATC and ABAP Unit after every upgrade.

Interview angle

Questions: "Can AMDP be used in ABAP Cloud?", "What is contract C4?", "Why shouldn't AMDP update SAP tables?"
Strong answer: yes, with restrictions — USING may reference only own objects and SAP objects released with C4 (use in AMDP), because SQLScript accesses database objects directly and SAP must guarantee their structure; AMDP must not write SAP tables (bypasses validations, locks, change documents); AMDP does not apply authorization, so check in ABAP or wrap with DCL; keep dependencies minimal and tested.

Practice this lesson

Quick check

1. A readiness check finds AMDPs reading SAP table EKKO. What is the clean-core direction?

2. A team wraps every simple calculation in a CDS table function. What is the main drawback?

3. What structural requirement applies to a class that contains AMDP methods?

Interview questions

1. You inherit 25 AMDP classes. What do you review?

Answer it in your own words first, then compare.

2. Can AMDP be used in ABAP Cloud, and what are the restrictions?