The Cloud Connector

The Cloud Connector is a small Java-based agent installed close to the systems it exposes. Sam's team thinks of it as a gatekeeper with an allowlist: it keeps a tunnel open to the subaccounts it serves and lets a request through only if it matches a system mapping and an exposed resource. Everything else is denied.

Setting it up

1. Install on a host in the network that can reach the back ends, using the installer or portable version for the operating system. Under RISE, agree with SAP where it runs and who operates it.
2. Log on to the administration UI in a browser at the host and port chosen at installation (default 8443). The initial user is Administrator with the password manage, which must be changed at first logon.
3. Choose master or shadow. A single instance, or the main instance of a high-availability pair, is the master; the shadow takes over if the master fails.
4. Add the subaccount: region, subaccount ID (not its display name) and a user with the Cloud Connector Administrator role (included, for example, in the Subaccount Administrator role collection). Optionally set a location ID.
5. Configure access control: which back ends and paths are exposed (below). Until then the tunnel is open but no requests pass.

After the first connection, the user who set it up is no longer needed; SAP's documentation notes that a certificate is used to open the tunnel from then on, and that the role assignment can be revoked. The subaccount certificate has an expiry date shown in the UI, with optional automatic renewal; an expired certificate disconnects the subaccount. Each connected Cloud Connector also appears in the SAP BTP cockpit under the subaccount's Connectivity section, with its version and high-availability state.

Access control: systems and resources

Under Cloud To On-Premises > Access Control, each entry maps a virtual host and port (what cloud destinations use) to an internal host and port (where the system really is). The virtual host can be a made-up name, which hides internal names from the cloud side. The entry also sets the back-end type, the protocol from Cloud Connector to back end (HTTP or HTTPS, independent of the cloud-side URL), whether principal propagation is allowed and with which principal type, and whether the Cloud Connector's system certificate is used for logon. When you save the mapping, the Cloud Connector pings the internal host to catch typing or firewall errors early.

Then come the resources: URL paths allowed on that system. SAP's documentation describes the allowlist as very strict: only URLs explicitly granted are allowed, paths are case-sensitive, and each resource is either path only or path and all sub-paths. Exposing / with all sub-paths opens the whole server, which is rarely what you want. Resources can be suspended and reactivated without deleting them, which is handy when testing what happens if a service disappears.