2412 Migrating a Large SAP Landscape to the Amazon Public Cloud

8/12/2019 2412 Migrating a Large SAP Landscape to the Amazon Public Cloud

http://slidepdf.com/reader/full/2412-migrating-a-large-sap-landscape-to-the-amazon-public-cloud 1/47

Migrating a Large SAP Landscape to theAmazon Cloud – A Real Life Case Study of Migrating

Joe CoyleNorth American Chief Technology Officer – Capgemini



[Agenda

Client Background The Vision and the Mission

The First Rule We Followed

e o u on

What we Started With

Business Case

The Target Platform / Environment

Timeline and Critical Steps

The Mi ration Process and Ke Learnin 's

Some Challenges Around Adapting SAP Landscapes to AWS

Impacts to People, Process, and Existing Infrastructure

Ada tin Traditional Enter rise Monitorin and Orchestration

Legal, Risk, and Audit Involvement

AWS Cloud Security Model Overview

Ke Lessons

Real Experience. Real Advantage.

© Copyright Capgemini 2012 All Rights Reserved

Wrap-Up



[3 Key Take-Aways





[3 Key Take-Aways

Enterprise Operationalbenefits and

challenges to an AmazonWeb Services On-Demand

and Elastic Infrastructure.





[3 Key Take-Aways

Obtainingapprovals and

demystifying concernsaround SAP environments

Enterprise Operationalbenefits and

challenges to an AmazonWeb Services On-Demand

in the public cloud.and Elastic Infrastructure.







[Client

A massive global SAP ecosystem in an outsourced environment:

B A C K G R O U N D

– ~170 SAP instances

– ~ 150 Terabytes of data across the landscape

– Many non-productive SAP instance with productive data loads used for various critical

– Single global instance strategy

Global SAP Rollouts on-going.

.

Constant Leadership pressure to speed up the rollout and cut IT spend in parallel.

Additional SAP streams of work ongoing including upgrades, BI, etc.



.



[The Vision and the Mission – A True Cloud Experience

Deliver a lower cost solution than existing platform:

Migrate to a “Subscription-Based” Model.

Reduce infrastructure investment and shift costs from CAPEx to OPEx.

Deliver a lower cost solution than existing platform:

Eliminate Capacity constraints in the existing datacenters:

Get out of the IT refresh cycle.

landscapes.

Additional landscapes constantly required for new deployment /

development efforts.

Improved Business Value:

Simplify capacity management with flexibility for infrastructure resizing.

Greater Scalabilit to handle short-term and ad-hoc re uests.

Reduce Time to deployment from weeks to days.

Eliminate HW Life Cycle Management.

Standardization due to abstraction of a lication from hardware to



hypervisor.

Move to an overall “As A Service” model.



[The First Rule We Followed

We want to ensure that our solution brings all five essential components ofCloud to the solution:







Broad network access2








esource poo ng• Location independence









Rapid elasticity4









Rapid elasticity4

Measured service5









Rapid elasticity4

Measured service5

But









Rapid elasticity4

Measured service5

the solution also needs to deliver Enter rise BusinessButIT capabilities around monitoring, metering, orchestration,

service desk, capacity planning, reporting, billing.



capitalize on the components of Cloud.



[The Solution

Migrate SAP environments to the Capgemini Orchestration Management Platform End To

End (COMPLETE) environment powered by the Amazon Web Services.





[The Solution



Customer Applications/Solutions – SAP Ecosystem

Decide►Design► Build► Integrate►Migrate►Run►Support

Service Management Security and Compliance

Service Automation Usage and Accounting

L E

T E

on or ng

Platform/Virtualization

High Availability

Server, Storage, Network C O M

anagemenHardware

Cloud Infrastructure Abstraction & Aggregation Layer



Traditional



[The Solution







L E

T E

on or ng


High Availability


anagemenHardware




Traditional



[The Solution, Continued





L E

T E

on or ng


High Availability


anagemenHardware




Traditional



[The Solution, Continued





L E

T E

the best advantage of the consumption based

computing model of AWS.on or ng


High Availability

Server, Storage, Network C O M Targeted systems after migration should inherit the

ability to rapidly deploy, de-commission, expand,

anagemenHardware


, .



Traditional



[What We Started With – Training and Prototype

Migrate selected landscapes to theCOMPLETE platform

All SAP systems that encompassthe Prototype, Training Landscapes

Prototype Systems Landscape

Training (sandbox) Systems Landscape

Totaling 33 SAP Instances

Running on Unix, Itanium based Servers

Oracle 10/11 Database Training (classroom) Systems Landscape

Approx 25 TB of Data on Enterprise SAN

Vertex and SAP Internet Pricing

Configurator includedin landscape

Global Enterprise MPLS based Extranet

must stay intact for global access





[The Business Case for Migration –

Driven by Cost Savings and Speed to ValueAfter reviewing all IT costs associated with the targeted environment, thebusiness case presented itself.

Client will experience a one time savings of 8 Million dollars. Client will experience a year over year savings of 45% over existing outsourcing

.

– These savings are driven by estimating two areas of the consumption based model:

• Fixed consumption costs

– Amount of storage

– Number of backups

– Secured network

• Variable Consumption Costs

– Compute time – Bandwidth and I/O



the agreement that we should move forward with the project!



[A Few Important Points on Amazon Web Services

– Platforms like Capgemini COMPLETEenhance those SLAs for enterprise

AWS is very much a “productive”

environment! as c y an n ras ruc ure resources an

virtually endless!

AWS is no longer just Infrastructure as a

erv ce. ey are we n o e a orm asa Service model.





[Example of AWS Compute Power and Price Points

NASA’s Jet Propulsion Laboratory (JPL) has developed the All-

Terrain Hex-Limbed Extra-Terrestrial Explorer (ATHLETE)

NASA Jet Propulsion Lab’s Desert Research and Training Studies

robot. Each of the ATHLETE’s six limbs is attached to a wheel,

enabling the vehicle to travel across various types of terrain—ranging from smooth surfaces to rolling hills to ruggedly steep

terrain. Wheels can also be locked to transform the limbs into

general purpose legs that can be used as feet. The ATHLETE

robot can also be used for loading, unloading, and transporting

cargo for long distances.

The a lication is built on Pol hon which is a modular

workflow orchestration framework designed to streamline the

process of leveraging hundreds of nodes on Amazon Elastic

Compute Cloud (Amazon EC2). By accommodating excess

ca acit on local machines and s are resources in the

supercomputing center, Polyphony meshes perfectly with Amazon’s cloud computing. Most important, Polyphony

enables the resources to work together to achieve a common

oal. B usin Amazon Sim le Queue Service Amazon SQS ,



JPL developers can deploy massive computations on Amazon

EC2 by writing as little as a single class.



[Example of AWS Compute Power and Price Points

Polyphony has been delivered to the Mars Science Laboratory to serve as one of

the primary data processing and delivery pipelines that process data downloaded

from Mars.

Khawaja Shams, Senior Solution Architect, explains that the application “allowed

us to process nearly 200,000 Cassini images within a few hours under $200on AWS.” Due to the lack of elasticity available internally before switching to

“ locally and spent more than 15 days on the same task.” The efficiency andcost-savings offered by AWS has proven invaluable.

,from Mars in a few

hours.

Cost on AWS $200.00.

Traditional processing



same task!



Lets Get Technical for a Few Minutes



[The Target Platform on COMPLETE Powered by AWS

Linux & Windows AMI customized & hardened as base for application AMI creation.

Creation of Operating System Amazon Machine Images (AMIs)

Used to launch instances and clone for different landscape needs.

Elastic Block Storage (EBS) defined, logical volumes striped, (can be resized as

re uired .

SAP Application AMIs created for each application version

EBS Snap shots to S3 to preserve golden images.

A ro riate instance size estimated – will be monitorin for resizin as re uired.

Launch of Application instances to create the 3 landscapes

Capgemini COMPLETE to manage monitoring of infrastructure, OS and Instance

operations.

Metrics, thresholds and actions to be confirmed.

management.

SAP Instances were un-coupled (MCOD/MCOS) to leverage the power of AMIs and

leverage the consumption model.





[The AWS Target Platform, Continued

Virtual Private Cloud Infrastructure with customer defined IP addresses and

subnets.

Network Architecture

Secured access from the customer network via VPN Tunnels to customer Internet

Gateways for quick start. Secured access from the customer network by extension of MPLS backbone via

AWS Direct Connect rocess with E uinix Co-location center.

Security Groups templates for enabling only required application ports and

protocols, source and destinations at the instance level.

Internet Gateway managed by Capgemini for use to public subnet only (VPNanager, pac e everse roxy or upp er or a .

Support & Services

SAP Application support will continue to be provided as part of our existing

.

All infrastructure support services will be included in as part of the COMPLETE

service.

Existin SLAs will carr over to a lications su orted on the COMPLETE



platform.



[High Level Network Architecture

Auth.Traffic

Customer Intranet

DC/CustomerLocation 1

CustomerLocation 2

CustomerLocation n

SAP-ProdSolman

Uperform

Non-ProdSolman/CUATransports

CustomerVPN Gateway

CustomerVPN Gateway

CustomerVPN Gateway

upp ers

InternetCustomer VPN

Gateway206.193.136.11

InternetGateway

R

VPN Manager10.109.7.4.

184.72.123.193

Legend

Any IPSec devicecan be used

CustomerVPN Gateway

Customer VPCPrivate subnet

10.109.6.0/24

Train 2 (2)Landscape

Train (N)Landscape

Supplier PortalReverse Proxy

DMZ/Public subnet

10.109.7.0/26

Capgemini/AWS

recommended

Cisco ASA

Site to SiteIPSec Tunnel



Prototype (T)Landscape

As Required



[Customer Connectivity to AWS with MPLS

AWS Cloud

Customer

Datacenter

AWS

Customer

Site 1

Customer

MPLSDirect

Connect

Switch CustomerSite 2

CustomerSite n

MPLS CERouter

Equinix





[Proposed Timeline

Year

SAMPLE

Description Month 1 Month 2 Month 3 Month 4 Month 5

Complete Network and ArchitectureDesign/Financial and Risk Review

Sign-Off by customer to proceed with

m gra on

System Builds are completed (no data)

Complete Multi-tunnel Network

Connectivity

house)

Migrate Training and Prototype to the

COMPLETE Platform

Cutover Training and Prototype systems

from in-house to COMPLETE Platform

Repurpose Training and “T” HW tosupport SMI Group 3



Task End Milestone



[Critical Steps

The list below tracks the tasks which need to be completed prior to approving themigration to move forward.

Next Ste s Res onsible Status

Agree on proposed network solution

Identify the number of locations for VPN Tunneltermination (configuration is required)

ss gn requ re a ress space

Capgemini to create small POC environment with a

couple of SAP instances with no data to test/prove out

network connectivity to 1 location

Confirm data load process with MDM team

Complete Financial review

Complete Risk Mitigation Review

Complete Legal Review





[The Migration Process

Approximately 25 TB of data will be initially migrated to the COMPLETEplatform powered by AWS:

In order to minimize bandwidth utilization (LAN/WAN/Web)

– Capgemini will provide the transportable storage devices (eSata and USB compliant)

– Ship to AWS & leverage AWS Import / Export Service to AWS S3

– Capgemini will migrate data from AWS S3 to EBS and import data

The approach for additional data migrations and updates will bedetermined based upon a number of factors:

– Size and timing of the data to be migrated – an w requ remen s vs. ava a e an w

– Complete or partial data migrations

– New Capabilities such as AWS Direct Connect

& Storage Gateway option to be investigated





[Key Learning’s Around Migration, Refreshes, and

Hetero eneous S stem Co ies Three acceptable SAP heterogeneous data migrations.

– SAP R3Load, Oracle Transportable Tablespaces and Oracle Export/Import Datapump.

.

Storage Striping via Software RAID recommended for I/O performance. Leverage AWS Import/Export Process.

– .

– Allocate appropriate time for

exports, shipping

and imports.





[Some Challenges Adapting TraditionalSAP Landsca es to the Cloud Availability of Operating System options are limited to Linux & Windows.

Currently only SUSE Linux supported by SAP in AWS for “Production”.

Migration and refresh of large data sets in a timely manner.

Network Connectivity Options – Careful Planning Needed:

– Native Internet

– Internet VPN

– Direct Connect (for Enterprise WAN Connectivity)

– IP addressing & Routing

– AWS Routing Options Limited to Border Gateway Protocol (a routing protocol betweenautonomous systems)

High Availability architecture

– Traditional Cluster / RAC not supported

n y a coup e o nstance s zes supporte or ro uct on w tBenchmark.

DB/2 migrations limited to R3Load process (did not apply in this case).

•



.

• SAP static tuning parameters can not dynamically leverage the elastic compute

power of AWS. Plan accordingly.



[Impacts to Existing Ecosystem (Infrastructure, Process, People)

The decision needs to be per business process, solution, or per software application:

What SLA do We need?

– What uptime do we expect (availability), backup policy and data retention needs, when do we expect

, .

Regulations / Compliance

– Government regulations that may apply such as FDA validation, special data protection rules such as

PCI Compliance or security rules beyond the standard.

– Focuses on how the solution functions, and how predictable it is. Do we need more computing

power for month-end, will we have unpredictable bursting such as a promotional website or even a

temporary environment that may have unpredictable growth.

– Although a move to the Cloud is a step toward getting out of the IT business, adjustments to your

infrastructure still need to be planned as part of the process. Areas here are around network security,

ability to connect in the Cloud, and reviewing the integration points between systems.

– Current leases, value of owned technology assets, datacenter layout today and labor costs to reducethe footprint, and possible changes around software licensing due to the migration.

People & Processes



– . -

– Changes in roles, processes and procedures.



[Adapting Traditional Enterprise Monitoring and Orchestration

Landscape Uptime will match closely to real life needs / requests.

– Proposed 10 hours/day Mon-Fri & as required for

.

– Monitoring needs to understand scheduled up and down

times.

Automated Landscape startup (OS Instance &Application).

Automated Landscape Application Shutdown.

– Triggering. EBS Data Snapshots to AWS S3 & AMI creation.

– (14 day retention planned excluding golden image.)

– The S3 Snapshots replicates the data across AWS

.

– Periodic snapshot of archive logs to S3.

Weekly refresh of landscapes for Training businessneeds.



– Flashback functionality integration / S3 Snapshots.



[Legal, Risk, and Audit Involvement

Involved these groups early.

Engage the client directly with the Amazon security team.

Focus on dispelling the Cloud rumors early withso ac s:

– The Cloud is secure, It’s their business. – Amazon is not just “public Cloud”.

ar y up ron w a secur y s:

– Moving to a cloud solution does NOT

put the burden of security on only

the Cloud provider.

– Understand, formalize, and document

which party owns which piece

of the security ecosystem.

–

do not go away, they adapt.





[AWS Cloud Security Model Overview

Certifications &Accreditations

PhysicalSecurity

VMSecurity

NetworkSecurity

SAS 70 Type IIMulti-Level Multi-Factor Multi-Factor Access to

Instance Firewalls can

be configured in security

groups

SOX Compliance Controlled Need-Based Access AWS Employees

Customer ControlledFirewall at Hypervisor

Level

Traffic may be restrictedby port, protocol, source

IP

ISO 27001 CertificationMgmt Admin

AccessNeighboring Instances

prevented access

Virtual Private Cloud

(VPC)

PCI DSS Level Multi-Factor Controlled Access to Host

Virtual Disk Mgmt Layer

Assure Only Owners

VPC IPSec VPN Access

to Enterprise Dataan ccess orage en ers

HIPAA Compliant

Architecture

All Access Logged

Monitored & Reviewed

Support for SSL

Endpoint Encryption for

API Calls

SharedResponsibility

–

FISMA

Access to Customer VM, Application & Data SI – Control Guest OS

SI – OS Security,

Patching & Maintenance



SI/Customer –

Application Level

Security



[Key Lessons

This is a mindset change. Not everything needs to be up and running 24x7. Match running

environment to actual user need to maximize cost savings.

Don’t be afraid to Convert Unix to Linux for some non-prod use cases.

ons an so u on arc ec ure an cos rev ew as e capa es are cons an yimproving and cost options are getting better. (Example: Reserve Instances, new instance

sizes, new support from SAP, storage gateway.)

You can and should extend traditional monitoring and security to the Cloud including

Solution Manager CCMS.

Put the time in and focus on Import / Export Data Migration Planning

Network Planning is critical. As it always is. Orchestration is key – Scripting of Launch, Start, Stop, Backup with proper Tagging.

Template/AMI creation for hardened Operating System as well as each SAP application.

Constantly Review Usage Charges – the truth will emerge.

Traditional instance stacking (MCOD/MCOS) and

virtualization don’t always make the best sense in a

consumption based cloud. Focus on usage to make

these decisions.



Traditional Basis decisions and processes are

the same. There is no magic here.



[If You Forgot Everything Else – Remember This:











Set it and Forget it!













Add intelligence to the environment to take advantage





[



[



[

.Please remember to complete and return your

evaluation form following this session.

For ongoing education on this area of focus, visit the

Year-Round Community page at www.asug.com/yrc

[ SESSION CODE:

INSERT SESSION CODE

Real Experience. Real Advantage. 47

Documents

2412 Migrating a Large SAP Landscape to the Amazon Public Cloud