Security & GRCadvanced

BTP Security Operations: Audit Logs, Secrets, Certificates and Least Privilege (Part 5)

Key takeaway

📌 KEY POINTS ✅ Day-2 operations, not initial setup, determine whether BTP security actually holds up. ⚠️ Secrets and certificates need lifecycle ownership — never embedded in source code or copied into tickets. 💡 Reusing one technical identity/certificate across DEV/TEST/PRD increases blast radius and breaks audit attribution. ━━━━━━━━━━━━━━━━━━━━ ▶ 1.

Explanation

📌 KEY POINTS
✅ Day-2 operations, not initial setup, determine whether BTP security actually holds up.
⚠️ Secrets and certificates need lifecycle ownership — never embedded in source code or copied into tickets.
💡 Reusing one technical identity/certificate across DEV/TEST/PRD increases blast radius and breaks audit attribution.

━━━━━━━━━━━━━━━━━━━━
▶ 1. AUDIT LOGS

Evidence of security-relevant admin/application events per enabled services
Assign read access to auditors/operators separately from broad administrators
Define retention/export/SIEM handling per organizational policy

━━━━━━━━━━━━━━━━━━━━
⚠️ 2. SECRETS AND CERTIFICATES

Service keys, OAuth client secrets, private keys, destination certificates — never in source code or tickets
Store in supported secret/configuration services, rotate before expiry/compromise, monitor certificate expiration

━━━━━━━━━━━━━━━━━━━━
▶ 3. LEAST PRIVILEGE, EVERYWHERE

Applies at global account, directory, subaccount, environment, and service levels
Review who can change trust, destinations, role collections, service instances, Cloud Connector config
Remove dormant project members and stale temporary admin access

━━━━━━━━━━━━━━━━━━━━
⚠️ 4. ENVIRONMENT SEPARATION

Separate DEV/TEST/PRD subaccounts and credentials
One technical identity/certificate reused across environments = bigger blast radius, harder audit attribution

━━━━━━━━━━━━━━━━━━━━
▶ 5. INCIDENT EVIDENCE PACK

Subaccount, app/service instance, user/client, timestamp, audit-log event, sanitized token claims, destination/credential version, recent config changes

✅ CHECKPOINT: list what belongs in an incident evidence pack, from memory.

Real project scenario

A production integration failed when a client certificate expired. The certificate had been uploaded manually two years earlier with no owner or alert. The recovery was simple, but the outage exposed weak security operations. The team implemented certificate inventory, owner, expiry alerts, controlled rotation and environment-specific credentials.

Common mistakes

Storing secrets in Git or support tickets.
Sharing one service key across environments.
Giving auditors full admin to view logs.
Keeping project admins after project completion.
Having no certificate/secret inventory or expiry monitoring.

Best practices

Inventory every secret/certificate with owner and expiry.
Centralize audit-log monitoring.
Review privileged members periodically.
Use separate identities per environment/workload.
Rotate credentials through controlled automation where possible.

Interview angle

Discuss audit, secret/certificate lifecycle, least-privilege platform roles and environment separation. Strong answers focus on operational controls and incident evidence, not only login technology.

Practice this lesson

Quick check

1. Scenario — A production integration failed when a client certificate expired. For the lesson "BTP Security Operations: Audit Logs, Secrets, Certificates and Least Privilege", which response shows the strongest architecture and production judgment?

2. As a security best practice for managing service keys and bindings in SAP BTP, which action most effectively reduces the risk associated with leaked credentials over time?

3. What is the primary security benefit of enabling the Audit Log service in an SAP BTP subaccount?

Interview questions

1. You are the senior consultant/architect responsible for BTP Security for Identity, Authorization and GRC Operations: Audit Logs, Secrets, Certificates and Least Privilege. The project situation is: A production integration failed when a client certificate expired. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

2. You are the senior consultant/architect responsible for SAP BTP Identity and Trust: Platform Users, Business Users and Identity Providers. The project situation is: A consultant could log into BTP cockpit but could not access an application. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

Practice more with Interview AI →

Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.