Lesson 3 of 5
Setting up the service
9 min
Setting up SAP Cloud Transport Management is a short checklist, but every item matters, and most first-import failures trace back to one of them. SAP's getting-started tutorial and documentation describe the steps; this lesson walks through them as Contoso did, in the shared services subaccount cmc-central-services.
- Choose the subaccountA central subaccount for the service; SAP advises not to use the SAP Cloud ALM subaccount when integrating with Cloud ALM
- Enable Cloud FoundryCreate the org and a space for the service instance
- Assign entitlementsAn application plan for the user interface, plus an instance plan if programmatic access is needed
- SubscribeSubscribe to the application in the service marketplace
- Role collectionsAdd the delivered role templates to role collections and assign them to users or groups
- Instance and keyCreate a service instance in the space and a service key for programmatic access
- DestinationsCreate destinations to each target endpoint, and from source applications to the service
Plans and what they allow
| Plan (cockpit name) | Type | What it is for |
|---|---|---|
| standard | Application | Default plan for the user interface. SAP documents 50 GB total storage, 1 GB per file and 30 days retention of uploaded and transported files. |
| free | Application | Reduced scope for evaluation: 500 MB storage, 7 days retention, community support only and no SLA |
| build-runtime | Application | For content created with services of the SAP Build ecosystem |
| standard | Instance | Full programmatic access; used for integrations such as SAP Cloud ALM |
| export | Instance | Programmatic access limited to upload and export, for example for CI pipelines |
| transport_operator | Instance | Programmatic access limited to import, reset, forward and delete |
SAP Cloud Transport Management service plans as documented by SAP. Check the SAP Discovery Center for current details and pricing.
Two practical consequences follow. Production use belongs on the standard application plan, not the free one. And because uploaded files are kept only for the retention period, the transport service is not your archive: keep the released archives and their versions in your own repository so you can reproduce or audit a release months later.
Roles and least privilege
Access to the user interface is controlled by role templates of the subscription, added to role collections in the subaccount. SAP's examples include an Administrator role for full administration, a LandscapeOperator role for configuring nodes and routes, an ExportOperator role for developers who export content, and a Viewer role; SAP delivers ready-made role collections for the landscape operator and viewer roles. Import operators handle imports into target nodes. Programmatic access does not use these role collections: the rights come from the instance plan chosen for the service instance.
Service key and destinations
A service instance created with an instance plan in the subaccount's space, and a service key for it, give external callers (a CI pipeline, SAP Cloud ALM or a cloud application exporting its own content) the client ID, client secret and token URL they need. Those values go into a destination in the calling subaccount that points to the transport service. In the other direction, each target node needs a destination to the deployment endpoint that will receive the content. For multitarget applications in Cloud Foundry, the default is the SAP Cloud Deployment service of the target subaccount, addressed with the target org and space in the URL and authenticated (with OAuth2Password or basic authentication) as a platform user allowed to deploy in that space. Content of API Management and Cloud Integration can instead be deployed through the SAP Content Agent service.
What would you do?
The first import of the fleet order status app into CMC_TEST ends with status Fatal within seconds. The log mentions an authentication failure at the deploy service. What should Luis check first?
- Setup: subaccount, Cloud Foundry space, entitlements, subscription, role collections, instance and key, destinations.
- Use the standard application plan in production; free has small limits and no SLA.
- Instance plans (standard, export, transport_operator) control programmatic rights.
- Give developers export rights only; imports belong to the release team.
- Fatal usually means a destination or authentication problem; fix it and reimport.
Check your understanding · not graded
Lesson check
1. What do you need to use the CTMS user interface in a subaccount?
2. Which instance plan suits a CI pipeline that should only upload and export?
3. What does a Fatal import status indicate?
4. Why keep released archives in your own repository?