SAP Cloud Connector
SAP Cloud Connector is an on-premise agent from SAP BTP Connectivity that links SAP BTP applications to systems inside a corporate network through a TLS tunnel the agent opens outbound, so no inbound firewall port is needed. SAP Cloud Connector exposes only the hosts and URL paths an administrator explicitly allows, under virtual names.
Quick facts
- Type
- On-premise connectivity agent (reverse invoke proxy)
- Layer
- SAP BTP side lane; installed in the customer network
- Runs on
- Windows or Linux host with a full JDK; macOS for non-productive use
- Administered in
- Cloud Connector administration UI (default port 8443)
- Works with
- SAP BTP Connectivity service and destinations of proxy type OnPremise
- Who works with it
- Basis, network and security teams; SAP BTP administrators
- Applies to
- SAP BTP with SAP S/4HANA on-premise and Private Edition
Layer: SAP BTPWhere it sits ▾
Layer: SAP BTP
Open the architecture map →How does SAP Cloud Connector work?
SAP Cloud Connector reverses the usual direction of a connection:
- An administrator installs SAP Cloud Connector on a host inside the corporate network, next to the backend systems.
- The administrator registers one or more SAP BTP subaccounts. SAP Cloud Connector then opens an outbound, TLS-encrypted tunnel to each subaccount.
- An application in that subaccount calls a destination of proxy type OnPremise, which names a virtual host and port.
- The SAP BTP Connectivity service sends the request through the tunnel.
- SAP Cloud Connector checks its allowlist, maps the virtual host to the real internal host and forwards the call over HTTP, RFC or another supported protocol.
Only applications of the registered subaccount can use the tunnel, and SAP Cloud Connector records inbound traffic and configuration changes in its audit log. SAP Cloud Connector is therefore a controlled gateway that the customer opens from the inside, not a hole in the firewall.
What do you configure in SAP Cloud Connector?
| Setting | What it controls |
|---|---|
| Subaccount | Which SAP BTP subaccounts may use this SAP Cloud Connector |
| Location ID | Distinguishes several connectors attached to the same subaccount |
| Access control | Back-end type, protocol, internal host and port, virtual host and port |
| Resources | URL paths or function modules allowed on each system, exact or with sub-paths |
| Principal propagation | Forwarding the cloud user's identity to the backend for single sign-on |
| High availability | A master instance plus a shadow instance that takes over when the master fails |
A typical example: Alder Manufacturing maps the virtual host s4-alder:443 to its real SAP S/4HANA host and allows only the paths of the OData services that its SAP BTP apps need. The virtual name hides the internal hostname from SAP BTP. Every request outside the allowlist is denied. Configuring SAP Cloud Connector is mostly a decision about what to expose, not how to connect.
What are the strengths of SAP Cloud Connector?
- No inbound firewall changes: the tunnel is opened from the inside, so no port toward the internal network has to be opened and no reverse proxy has to sit in the DMZ.
- Fine-grained exposure: administrators expose single hosts and paths instead of whole network segments.
- SAP protocols included: besides HTTP, SAP Cloud Connector supports RFC, so cloud applications can call ABAP function modules natively.
- Identity propagation: principal propagation lets backend authorizations apply to the real user rather than a shared technical user.
- Operational features: automatic reconnection, audit logging and a master–shadow high-availability setup come with the product, which SAP supports as standard.
For hybrid landscapes, SAP Cloud Connector is the standard SAP way to let SAP BTP reach systems that must stay off the internet.
Where does SAP Cloud Connector stop?
- Transport, not integration. SAP Cloud Connector moves requests; it does not map data, orchestrate calls or retry business logic. Those tasks belong to the calling application or an integration service.
- One more component to run. The customer installs, patches, sizes and monitors it, including its JDK. A failed SAP Cloud Connector takes every dependent SAP BTP scenario down with it.
- High availability depends on the network. Master and shadow talk to each other outside SAP BTP, so an unstable link between them can trigger a takeover while the master is still running.
- Not for every system. SAP documents that SAP Cloud Connector cannot be installed in SAP SaaS solutions, including SAP S/4HANA Cloud Public Edition.
These are boundaries by design: SAP Cloud Connector secures the path into the network, while what travels on it is designed elsewhere.
How does SAP Cloud Connector apply to each SAP S/4HANA deployment option?
- SAP S/4HANA on-premise: the customer installs SAP Cloud Connector in its own network, preferably with the installer version, which runs as a service and supports upgrades.
- SAP S/4HANA Cloud Private Edition: SAP lists SAP-hosted environments such as SAP HANA Enterprise Cloud among the places where SAP Cloud Connector can run; confirm with SAP who installs and operates it in your landscape.
- SAP S/4HANA Cloud Public Edition: SAP Cloud Connector is not installed there. SAP BTP reaches Public Edition over the internet through communication arrangements and destinations.
- IaaS hosting: customer systems on hyperscaler infrastructure count as a network comparable to on-premise, so SAP Cloud Connector can run there too.
SAP Cloud Connector matters wherever the SAP S/4HANA system sits behind a customer-controlled firewall.
Why does a call through SAP Cloud Connector fail?
Work from SAP BTP toward the backend:
- Tunnel status. In the administration UI, check that the subaccount shows as connected.
- Location ID. If several connectors serve the subaccount, the destination's location ID must match the intended one.
- Virtual host. The host and port in the destination URL must match the virtual host and port in access control exactly.
- Resources. The requested path must be allowlisted, and paths are case-sensitive. A missing sub-path option is a frequent cause of denied calls.
- Internal reachability. SAP Cloud Connector must reach the internal host directly, without a proxy.
- Identity. With principal propagation, check the trust setup and the user mapping in the backend.
Most SAP Cloud Connector failures are mismatches between the destination and the access control entry, not network outages.
SAP Cloud Connector vs. SAP BTP destinations: what is the difference?
| SAP Cloud Connector | SAP BTP destination | |
|---|---|---|
| What it is | Agent installed in the customer network | Configuration object in a subaccount or service instance |
| Where it lives | On-premise or IaaS host run by the customer | SAP BTP cockpit or Destination service |
| Question it answers | Which internal systems and paths may SAP BTP reach? | Which URL and authentication does an app use? |
| Needed when | The target sits behind a customer firewall | Any outbound call from an SAP BTP app, internet or on-premise |
| Typical failure | Path not allowlisted or tunnel down | Wrong URL, credentials or location ID |
A destination tells an SAP BTP app where to call; SAP Cloud Connector decides whether an on-premise target may be reached at all.
FAQ
Does SAP Cloud Connector require opening inbound firewall ports?
No. SAP Cloud Connector opens an outbound TLS tunnel to SAP BTP, and requests from SAP BTP travel back through that tunnel. SAP states that the on-premise firewall does not need rules allowing external access to internal systems, provided outbound connections to SAP BTP are permitted.
Can several SAP Cloud Connectors connect to one SAP BTP subaccount?
Yes. Several SAP Cloud Connector instances can attach to the same subaccount as long as each uses a different location ID. Destinations then name the location ID to choose the connector, which is useful when plants or regions have separate networks.
Is SAP Cloud Connector needed for SAP S/4HANA Cloud Public Edition?
Not for reaching Public Edition itself. SAP documents that SAP Cloud Connector cannot be installed in SAP S/4HANA Cloud Public Edition, and SAP BTP calls its released APIs over the internet. SAP Cloud Connector remains relevant for other on-premise systems in the same landscape.
How do you make SAP Cloud Connector highly available?
Install a second instance as a shadow and connect it to the master. The master pushes its configuration to the shadow, and the shadow takes over the tunnel if the master stops responding. SAP warns that master and shadow need a stable network between them.
What is a virtual host in SAP Cloud Connector?
A virtual host is the name that SAP BTP destinations use instead of the real internal hostname. SAP Cloud Connector maps it to the internal host and port, so the internal address never appears in SAP BTP configuration. The virtual name does not need to exist in DNS.
Sources
- SAP Help Portal: Cloud Connector (SAP BTP Connectivity)
- SAP Help Portal: Configure Access Control (HTTP)
- SAP Help Portal: Cloud Connector High Availability Setup
- SAP Help Portal: What Is SAP BTP Connectivity?
- SAP Help Portal: Set Up Trust Between the Cloud Connector and Your On-Premise ABAP Systems (STRUST, CERTRULE)
- Applies to
- SAP BTP · SAP S/4HANA on-premise · SAP S/4HANA Cloud Private Edition
- Last reviewed