Configuration & Security Analysis (CSA) collects a comprehensive set of technical configuration data from SAP Solutions – on Premise and Cloud. Data is stored in containers, the so-called Config Stores. Each Config Store stores data of the same semantics.
This document provides a list of available Config Stores as well as information about specifics of Config Stores for SAP Cloud Solutions.
This section provides information about the structure of and content of Config Stores that are available for SAP Business Technology Platform (SAP BTP) Services and other SAP Cloud Solutions.
The following SAP Cloud Products and Services are currently supported:
The list of supported services and products will be enhanced step by step starting Q4 2023.
Services, that are newly made available, must be activated in the CSA Application Configuration by switching on the corresponding Managed Component. New Config Stores, that are made available for already configured services, require no customer action.
Config Store - Structure and Cloud Content
Config Stores for SAP Cloud Solutions typically contain security configurations that are already validated by SAP and delivered with a compliance status with regard to Security Recommendations that are published in SAP Help Portal (e.g. SAP BTP Security Recommendations). Compliance is determined by the Cloud Service before pushing the data to SAP Cloud ALM and reflected in 2 columns that do not contain actual configuration data:
SECREC_INDEX = Index Id of the Security Recommendation as used in SAP Help Portal
SECREC_STATUS = COMPLIANT or NONCOMPLIANT (in rare cases: UNRATED).
Both Columns can have empty values if no recommendation exists for a specific configuration. Records may not exactly correspond to a single actual configuration in the SAP Cloud Service.
Examples:
Example 1: Data Record corresponding to an actual configuration(1:1)
Example 2: Data Record containing a bundle of actual configurations and values (1:N)
Example 3: Data Record based on the analysis of multiple unspecified configurations that are relevant for a SAP Security Recommendation (1:N)
The following table shows available Config Stores for SAP Cloud Solutions:
| Service | Config Store Name | Config Store Description | Has SecRec | Hierarchy Level | Available since |
|---|---|---|---|---|---|
| Credential Store | CRS_CONFIG | Credential Configuration | true | Service | 2023-12 |
| Identity Authentication | IAS_CONFIG | Identity Authentication Configuration | true | Service | 2023-12 |
| Identity Authentication | IAS_LANDSCAPE_INFO | Landscape Information | false | Service | 2023-12 |
| Identity Authentication | IAS_BUNDLED_APP_CONFIG | Bundled Application Configuration | true | App | 2023-12 |
| Identity Authentication | IAS_CHARGED_APP_CONFIGURATION | Charged Application Configuration | true | App | 2023-12 |
| Identity Authentication | IAS_SYS_APP_CONFIG | System Application Configuration | true | App | 2023-12 |
| Identity Provisioning | IPS_CONFIG | Identity provisioning configuration | true | Service | 2024-07 |
| Identity Provisioning | IPS_LANDSCAPE_INFO | Landscape information | false | Service | 2024-07 |
| Identity Provisioning | IPS_PROXY_SYSTEM_CONFIG | Proxy Configuration | true | App | 2024-07 |
| Identity Provisioning | IPS_SOURCE_SYSTEM_CONFIG | Source Configuration | true | App | 2024-07 |
| Identity Provisioning | IPS_TARGET_SYSTEM_CONFIG | Target Configuration | true | App | 2024-07 |
| Destination Service | DEST_SUBACCOUNT_DESTINATIONS | Noncompliant Destinations | true | BTP Subaccount | 2024-01 |
| Destination Service | DEST_LANDSCAPE_INFO | Landscape information | false | Service | 2024-01 |
| Mobile Service | MOB_APPL_CONFIG | Application Configuration | true | App | 2024-01 |
Limitations
HotNews: Activation of Destination Services Instances does not work and will be disabled until the issue with our CSA Integration is fixed (see below)
Other: The table below describes major limitations of services:
| Service | Limitation | Target Date |
|---|---|---|
| Destination Service | No data on destinations can be consumed due to an issue in integration design, that could not be detected during SAP internal testing. A re-implementation is in progress but will take several weeks. | Q3 |
| Destination Service | Store DEST_SUBACCOUNT_DESTINATIONS contains only records of noncompliant destinations | open |
| Destination Service | Some fields describing a destination are delivered empty | open |
| Destination Service | Only destinations (RFC, HTTP), that are maintained in subaccounts are delivered. | open |
| Destination Service | In the course of extending current content, incompatible changes may be required. | open |
| Identity Provisioning | Data provided in stores IPS_* are currently subject to further optimization and enhancement. Records of some configurations and Security Recommendations will change within indicated time frame. | 2024-08 |
This section provides a list of Config Stores that are available for managed systems of type Application Server ABAP:
| Process | |
|---|---|
| ABAP Clients (T000) | Namespace change settings |
| ABAP Code Vulnerability Analyzer status | Namespace change settings - Change log |
| ABAP Database interface | Path for backup and authorization |
| ABAP Generic Whitelists Information | Permitted trusted systems |
| ABAP HTTP URL Location Exception Table (HTTPURLLOC) | RFC destinations type '3' |
| ABAP Instances | RFC destinations type 'G' |
| ABAP Notes | RFC destinations type 'H' |
| ABAP Scenario-Based Checks Information | RFC destinations type 'L' |
| ABAP Secure Storage Encryption Key status | RFC destinations type 'T' |
| ABAP Start Authorization check (USOBAUTHINACTIVE) | SAINT/SPAM level |
| ABAP UCON RFC Basic Scenario | SAP Kernel |
| ABAP UCON http white list Scenario | SAPUI5 library |
| Audit log | SAPUI5 version |
| Clients - Change log | SMLT Languages |
| Component change settings | SNC Access Control List (ACL) |
| Component change settings - Change log | SOAManager Consumer Proxy Logical Ports |
| Crypto library version | SOAManager Service Definitions |
| Customizing settings for authorization process | SSO2 - Access control list |
| Global change setting | Security policy |
| Global change setting - Change log | Set Values for the Session Manager / Profile Generator |
| HTTP Whitelist | Software component level |
| HTTP Whitelist (UCON Client dependent) | Standard users |
| HTTP Whitelist (UCON) | Transport Tool |
| Http services (SICF) | Transports |
| Installed software packages | Usage of password hashing |
| Instance parameter | User with SAP_ALL profile |
| Locked transactions | Virus scan groups |
| Maintenance areas for tables | Virus scan server |