Skip to main content

18.10 Security & Network Architecture

1. Security starts at the boundary​

For every connection document:

  • source identity,
  • target identity,
  • authentication,
  • authorization,
  • network path,
  • encryption,
  • secrets,
  • audit,
  • ownership.

2. Identity patterns​

Possible patterns include:

  • technical users,
  • database users,
  • certificate authentication,
  • OAuth-based mechanisms,
  • principal propagation where supported.

SAP HANA Cloud supports principal propagation patterns for supported HANA and ABAP remote sources.

3. Network model​

Enterprise network
      |
 firewall / private path
      |
connectivity layer
      |
Datasphere
      |
space security
      |
data access control
      |
consumer

Network reachability does not grant data access.

4. Least privilege​

Separate:

  • connection administration,
  • data acquisition,
  • modeling,
  • execution,
  • monitoring,
  • business consumption.

Do not use a single powerful integration identity for every workload.

5. Secret lifecycle​

Define:

  • creation,
  • storage,
  • rotation,
  • expiration,
  • emergency replacement,
  • audit.

6. Source protection​

Security includes operational protection.

A technically authorized federated query can still be an architectural failure if it overloads a production source.

7. Exercise​

Design secure connectivity for:

  • on-premise Oracle,
  • HANA Cloud,
  • Redshift,
  • S3,
  • SaaS API.

For each source document identity, network, authentication, ingestion pattern and failure boundary.