Simplifying deployment of SAP Application for your...

AdityaKarnam · ‎2025 Feb 11

The blog post AWS Launch Wizard for SAP: A Step by Step Illustration walks you through step by step on how to use AWS Launch Wizard for SAP for deployment in high availability setup. In this blog we will get into technical details of one of the use cases Repeatable deployments of SAP applications using AWS Launch Wizard.

Benefits of Using Service Catalog and Launch Wizard Together

Combining Service Catalog and Launch Wizard unlocks a plethora of benefits for your organization:

Repeatability: Launch Wizard captures your deployment configurations and creates Service Catalog products. These products can be reused for future deployments, ensuring consistency, and reducing errors.

Standardization: Define standardized deployment processes and best practices within Service Catalog, ensuring everyone follows the same guidelines.

Reduced Risk: Eliminate manual configuration errors and inconsistencies by automating deployments through Launch Wizard and Service Catalog.

Improved Efficiency: Save time and effort by automating repetitive tasks and streamlining the deployment process.

Simplified Governance: Gain centralized control and visibility over your deployments with Service Catalog's governance features.

Use Cases for Service Catalog and Launch Wizard

The combination of Service Catalog and Launch Wizard is ideal for a variety of use cases, including:

Deploying complex applications: Launch Wizard simplifies the deployment of multi-tier applications with its guided configuration steps. Service Catalog then allows you to package these deployments as easily consumable services.

Standardizing infrastructure provisioning: Define your standard infrastructure configurations within Service Catalog and use Launch Wizard to automatically provision them, ensuring consistency across deployments.

Onboarding new environments: Quickly and easily set up new environments with pre-configured deployments stored in Service Catalog.

Enabling self-service deployments: Empower your users to deploy approved services on-demand through Service Catalog's self-service portal.

There are multiple deployment options to deploy SAP workloads using Service Catalog product as which can be found on the page, we will dig deeper into the Launch AWS CFT created in Launch Wizard option.

There are several steps that go into achieving the repeatable deployment for SAP workloads on AWS using Service Catalog

Create a Service Catalog Product for SAP World Loads leveraging the AWS CloudFormation templates created in Launch Wizard
Updating the Service Catalog product to cater to technical specification (optional- additional tags etc.)
Sharing the Products created in one account to a target account for deployment across AWS organizations.

Create a Service Catalog Product for SAP World Loads leveraging the AWS CloudFormation templates created in Launch Wizard

Architecture

The creation of the Service Catalog Product with automated tasks requires multiple AWS resources and services to be used. The main services are Launch Wizard (LW), AWS S3, Service Catalog product, IAM and CloudFormation. The baseline Service Catalog Product is built by leveraging the LW, S3 and CF services. The LW leverages S3 bucket to retrieve software for deploying applications and to store the Cloud Formation template (CFT) artifacts. At the same time a baseline Service Catalog Product is also created for the deployment.

The diagram below depicts the Architecture.

Create Cloud formation templates for deployment using Launch Wizard

AWS Launch Wizard for SAP application has an option to create CFTs that can be used to create and customize Service Catalog product based on your needs.

Users can choose required parameters in the Launch Wizard as per their requirements for each application.

Prerequisites

The IAM group of the user executing the deployment should have the policy AWSServiceCatalogEndUserFullAccess. You can optionally choose AWSServiceCatalogEndUserReadOnlyAccess if you prefer to grant the user only read-only access.
Create Launch Constraint or use your own IAM user (with the above policy assigned) to deploy applications using Service Catalog. For simplicity we will be using the IAM roles of the user.
Create s3 bucket to store the configuration files required for Cloud formation Template.
1. The name should begin with the prefix “launchwizard”
2. Update the below policy (adapt to the naming convention of resources you have in your account) in the IAM role AmazonEC2RoleForLaunchWizard.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LWSAPAppInstall1",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy",
                "s3:*"
            ],
            "Resource": [
"arn:aws:s3:::launchwizard-sap-workloads/*",
            ]
        },
        {
            "Sid": "LWSAPAppInstall2",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                                "arn:aws:s3:::launchwizard-sap-workloads/*",
                        ]
        },
        {
            "Sid": "LWEbsEncrypt1",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:<AWS Account>:alias/aws/ebs"
        }
    ]
}

Run the Launch Wizard and select the check box as shown and enter the s3 bucket you created at the screen below.
Continue the execution of the Launch Wizard as usual till the deployment screen, validate the inputs and confirm to deploy

Artifacts created:

1. Json file that contains the inputs provided in the Launch Wizard with the name <LaunchWizardDeploymentName>-<TimeStamp>-template.json is the root AWS Cloud Formation template file.
2. Directory “sap” which has json files for the multiple stack options that are available using Launch Wizard
3. The path “/sap/templates/” has various json files that will be leveraged based on the deployment application and configuration used.

Service Catalog product created:

When you navigate to the Service Catalog product page go to Administration -> Portfolios > and in the local Portfolios you should be able to see the portfolio names “AWS Launch Wizard Products”

In the “Products” section you will be see the Service Catalog Product created.

Sharing the SC with other accounts for deployment in target accounts

Consider you are creating a Service Catalog product in your Dev account (source account) and you want to share it with the QA and Production accounts (target accounts).

The baseline SC product along with the CFT and software in the S3 bucket are all part of the Dev account. Any enhancement that are to be done to automate the deployment process or adapt the parameters for QA or PRD account are to be done in the DEV account itself. New version of each product is created to adapt to the changes required for deployment in QA and PRD accounts.

The QA and PRD accounts need to be given access to these versions by sharing the Portfolio and providing permission to contents of the S3 bucket via IAM roles.

The applications are deployed in the QA and PRD accounts by using the Products made available in SC in the QA and PRD accounts respectively.

The above figure depicts the Architecture of the Service catalog product shared across accounts.

Step 1: Customize the SC product for deployment in QA and PRD accounts.

The root template.json file has the resource details of the AWS account in which the template was created (Dev account) namely Subnet ID, AMI, region, VPC ID, Security Group ID, EC2 KeyPair Key Name, AWS account ID and any other details specific to that account.

To use the Service Catalog Product in the target account, these details need to be changed to adapt to the target account in the parameters section of the json file.

Once all the required changes are done and tested in Dev env, we deployed our code from Dev to QA env.

Change json file to update the QA account details.

Changes need to me made in the parameters section of the json file. Download a copy of the file and make changes as per your needs.

Update the VPC by changing the “Default” value of the key “VPCID”
Update the Private Subnet1 by changing the “Default” value of the key “AZ1PrivateSubnet1ID”
Update the Private Subnet2 by changing the “Default” value of the key “AZ1PrivateSubnet2ID”
Update the Security Group ID for DB tier by changing the “Default” value of the key “HANADBSecurityGroupID”
Update the Backint Parameters by changing the “Default” value of the key “BackintParameters”
(Keep in mind the IAM Role AmazonEC2RoleForLaunchWizard in the QA account needs to have access to place files in this new backint s3 bucket path in QA account)
Update the Security Group ID for App tier by changing the “Default” value of the key “AppSecurityGroupID”
Update the MS key ARN to be used for EBS encryption by changing the “Default” value of the key “EbsKmsKeyArn”
Create a new version of the json file with the updated details for QA account and upload in the same location as the original file.

Create a new version of the Product in Service Catalog in Dev account.
Navigate to the Service Catalog where the product is created.
Service Catalog -> Administration -> Product List –
- Select the product you want to update with the new version.
- Open the product and click on “Create New Version”
- Use the option highlighted below “Specify a URL”, provide the S3 bucket URL for the newly updated json file. Provide the Version and description accordingly.
  Click on “Create Product Version”

Make products available for deployment in QA account

Updating the IAM policies to provide access for SC in QA to resources ( software and Cloud Formation artifacts) in S3 bucket in DEV. In the target account provide access for the IAM roles used to run the Service Catalog to access the software and CFT artifacts in the DEV bucket where it is stored.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LWSAPAppInstall1",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy",
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::launchwizard-sap-workloads/* "
            ]
        },
        {
            "Sid": "LWSAPAppInstall2",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::launchwizard-sap-workloads/* "
            ]
        },
        {
            "Sid": "LWEbsEncrypt1",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:<Dev Account>:alias/aws/ebs"
        },
        {
            "Sid": "tagResource",
            "Effect": "Allow",
            "Action": [
                "tag:GetResources"
            ],
            "Resource": "*"
        }
    ]
}

Update the S3 bucket permissions with the below json (adapt to your resources)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "QACrossAccountAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<QA account ID>:role/<IAM roles used by user to login to console>",
                    "arn:aws:iam::<QA Account ID>:role/service-role/AmazonEC2RoleForLaunchWizard"
                ]
            },
            "Action": [
                "s3:GetLifecycleConfiguration",
                "s3:ListBucket",
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::launchwizard-sap-workloads/*",
            ]
        },
        {
            "Sid": "S3PolicyStmt-DO-NOT-MODIFY-1111170350200",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::launchwizard-sap-workloads/*"
        }
    ]
}

Sharing the Service Catalog with QA account
Now that you have the QA product version ready and permissions updated, you need to share the product with the QA account (target account)
User should have access to Dev and QA environment with sufficient access to Service Catalog product to perform the task.
Navigate to Service Catalog in Dev env, choose Portfolios and then AWS Launch Wizard Products
In service Catalog Portfolio “AWS Launch Wizard Products” contains all the product which are created by Launch Wizard
Navigate to the “Share” tab and click on “Share” to start sharing the Portfolio with target account.
Provide the details of the target account.
Portfolio is now shared with QA Account
Navigate to the Portfolios section in the QA account.
Select the Version and start provisioning.

Additional Tips for Successful Deployments

Start small and scale gradually. Don't try to migrate everything to Service Catalog at once. Begin with a few pilot projects and gradually expand as you gain comfort and confidence.
Involve your stakeholders. Get buy-in from your team members early on to ensure a smooth transition.
Document your processes. Create clear documentation for your Service Catalog offerings and Launch Wizard configurations.
Utilize training resources. Leverage available training materials and workshops to learn best practices for using Service Catalog and Launch Wizard.

Conclusion

By leveraging Service Catalog and Launch Wizard together, you can achieve a new level of efficiency, standardization, and control over your deployments. This powerful combination can help you reduce errors, save time, and ultimately deliver higher-quality IT services to your users. So, why not give it a try and see how it can transform your deployment process?

Further Resources:

AWS Service Catalog: https://aws.amazon.com/servicecatalog/
AWS Launch Wizard: https://aws.amazon.com/launchwizard/
Example of Using Service Catalog and Launch Wizard for SAP deployments: https://aws.amazon.com/launchwizard/

I hope this blog post has been helpful. If you have any questions, please feel free to leave a comment below.