SAP Protects Mission-Critical Backups Using Amazon EBS Snapshot Lock

Founded in 1972, SAP is one of the world’s largest enterprise software companies and serves millions of cloud users around the globe. The SAP Enterprise Cloud Services business unit helps enterprise customers migrate their SAP applications to the cloud. To keep this mission-critical data safe, the organization implements robust security measures. For over 7 years, the company has used Amazon EBS to store data for its enterprise applications.

SAP attaches an Amazon EBS volume, a durable, block-level storage device, to every virtual machine that it migrates to AWS. The majority of these are Amazon EBS General Purpose volumes, which offer balanced cost and performance for the majority of workloads. To keep its clients’ data readily recoverable, SAP relies on Amazon EBS Snapshots, a point-in-time copy of data that can be used to facilitate disaster recovery, migrate data across regions and accounts, and improve backup compliance.

The snapshots are managed and stored on Amazon Simple Storage Service (Amazon S3), an object storage service built to retrieve any amount of data from anywhere, for long-term retention. Amazon S3 is designed for 11 nines of durability, facilitating higher availability of data in Amazon EBS Snapshots.

Although this method met SAP’s storage and security requirements, the company sought additional safeguards against accidental or malicious deletions, which can be critical during a ransomware event. SAP’s customers increasingly requested protection against unintentional deletions, so the company turned to AWS to develop a new feature.

“We had Amazon EBS Snapshots to protect our critical data, but we needed additional protection from unauthorized or unintentional deletions to defend against ransomware” says Jayaprakasan Velusamy, senior enterprise architect at SAP Enterprise Cloud Services. “So, we submitted a feature request. It became a high priority for the Amazon EBS team.”

In 2023, AWS announced the release of Amazon EBS Snapshot Lock. This feature takes data stored as Amazon EBS Snapshots and locks it down, preventing any modifications or deletions during the specified lock period. This rigid control mechanism helps SAP better protect cloud environments that it manages on behalf of its enterprise clients because it secures the data in snapshots against unauthorized deletions.

SAP takes snapshots of all its customers’ Amazon EBS volumes to back up data at the application and file levels. The company uses the Amazon Data Lifecycle Manager to automate the creation, retention, and deletion of snapshots based on predefined schedules and retention guidelines. This service simplifies the management of these volumes and helps SAP maintain compliance with data retention policies. Then, it uses Amazon EBS Snapshot Lock to secure these backups under stringent compliance controls. The feature’s compliance mode verifies that the snapshots cannot be deleted, even by authorized users. After an optional cooling-off period of up to 72 hours, neither the snapshot nor the lock can be deleted until the lock duration expires, and the mode cannot be changed. SAP’s customers also have the option of customizing how long they would like to lock their snapshots, which has ranged from a few weeks to up to 2 years.

SAP is also adopting Amazon EBS gp3 volumes, the latest generation general-purpose volume type that balances price performance for a wide variety of transactional workloads. With Amazon EBS gp3 volumes, SAP can provision performance independent of storage capacity while providing up to 20 percent lower price per GB than existing volumes. These volumes are also designed to offer single-digit millisecond latency while delivering the provisioned performance 99 percent of the time. This move will help SAP maintain consistently high performance without inflating costs.

SAP protects over 100 petabytes of data and thousands of virtual machines using Amazon EBS Snapshot Lock. Its customers not only enjoy 70 percent faster backup times with significantly quicker recovery but also benefit from additional security and protection with the new feature. All of SAP’s enterprise clients who store backups have adopted Amazon EBS Snapshot Lock.