SAP Cloud Connector
The secure, reverse-proxy bridge between SAP BTP cloud applications and on-premise SAP systems. Cloud Connector establishes an outbound-only encrypted tunnel — no inbound firewall changes required in the corporate network.
Executive Summary
Cloud Connector is a lightweight Java application installed in the corporate DMZ. It establishes an outbound-only HTTPS tunnel to SAP BTP's Connectivity service — meaning no inbound firewall rules are needed in the corporate network. BTP applications make outbound calls that are routed through the Connectivity service and down the tunnel to reach on-premise systems.
Architecture & Sizing
- Installation
- JAR/installer — Windows, RHEL, Ubuntu, macOS
- Admin UI
- HTTPS on port 8443 (localhost only)
- Multi-Subaccount
- One CC instance → multiple BTP subaccounts
- Access Control
- Explicit allowlist — deny by default
- Protocols
- HTTP/HTTPS · RFC (ABAP) · LDAP · TCP
- High Availability
- Master + Shadow with auto-failover
- Current Version
- 2.17.x (update regularly)
- Standard Sizing
- 2 CPU + 4 GB RAM
- High-Throughput
- 4 CPU + 8 GB RAM
Installation & Configuration
Cloud Connector is installed as a system service on a dedicated Linux server in the DMZ. After installation, connect it to your BTP subaccount via the admin UI on port 8443.
1# Linux installation (Cloud Connector 2.17)
2# 1. Download from SAP Software Downloads
3# https://tools.hana.ondemand.com/#cloud → Cloud Connector
4
5# 2. Install as system service
6sudo rpm -i sapcc-2.17.0-linux-x64.rpm # RHEL/CentOS
7# or
8sudo dpkg -i sapcc_2.17.0_amd64.deb # Ubuntu/Debian
9
10# 3. Start the service
11sudo systemctl start scc_daemon
12sudo systemctl enable scc_daemon
13
14# 4. Access admin UI (from local browser)
15# https://localhost:8443
16# Default credentials: Administrator / manage (change immediately!)
17
18# 5. Verify tunnel status
19curl -k https://localhost:8443/api/v1/connector/status \
20 -u Administrator:YourNewPasswordAccess Control Configuration
Access control rules define which backend hosts and paths are accessible through the tunnel. The virtual host is what BTP apps see; the backend host is the real internal address.
1{
2 "virtualHost": "s4hana-prod.corp.internal",
3 "virtualPort": 443,
4 "backendHost": "actual-s4-hostname.dewa.local",
5 "backendPort": 44310,
6 "protocol": "HTTPS",
7 "authenticationMode": "CERTIFICATE",
8 "description": "S/4HANA 2023 Production OData Services",
9 "allowedResources": [
10 {
11 "enabled": true,
12 "exactMatchOnly": false,
13 "path": "/sap/opu/odata/sap/"
14 }
15 ]
16}s4hana-prod.corp.internal) rather than raw IP addresses. This makes access control rules readable and survives IP changes during infrastructure migrations.Enterprise Example (DEWA)
DEWA has Cloud Connector 2.17 installed in their Abu Dhabi data center DMZ on a dedicated RHEL 8 server (4 CPU, 8GB RAM). A Master + Shadow HA pair is configured with automatic failover. One Cloud Connector instance serves 5 BTP subaccounts. 23 access control rules are defined covering S/4HANA OData APIs (/sap/opu/odata/) and 4 RFC function module groups. Mutual TLS with an X.509 certificate (rotated annually by the basis team). Cloud Connector admin access is restricted to 2 basis administrators via IP allowlist on the host firewall.
Security Hardening
Host hardening: Dedicated VM, minimal OS install, no other services running alongside Cloud Connector.
Admin UI access: Restrict to DEWA basis admin team IPs via host firewall rules. Cloud Connector admin UI should never be reachable from production application servers.
Certificate authentication: Use X.509 certificate authentication (not username/password) for the BTP subaccount connection. Certificates expire after 1 year by default.
Audit log: Enable Cloud Connector audit log and ship to the organisation's SIEM. Logs connectivity attempts, access control rule matches, and admin console actions.
Annual rotation: Rotate the subaccount connection certificate annually. Add calendar reminders 30 days before expiry.
Best Practices
Cloud Connector must reside in the corporate DMZ — not on the S/4HANA application server itself, and not on the internal network without a DMZ buffer.
Deploy a Master + Shadow instance for production. Automatic failover prevents all hybrid connectivity from dropping during Cloud Connector maintenance.
The default Administrator/manage credentials are publicly documented. Change them immediately after first login before connecting any BTP subaccount.
Cloud Connector defaults to denying all access. Add only the specific host/port/path combinations that BTP applications actually need.
SAP releases Cloud Connector security patches regularly. Quarterly updates are essential — outdated versions have known vulnerabilities.
Check Cloud Connector availability and tunnel health from BTP Cockpit under Connectivity. Set up alerting for tunnel disconnects.