Guidance For Deploying Sap Abap Accelerator For Amazon Q Developer

ABAP Accelerator MCP Server

Enterprise-grade Model Context Protocol (MCP) server for SAP ABAP development, enabling AI-powered coding assistance through Amazon Q Developer and Kiro.

Table of Contents

• [Overview](#overview)
• [Deployment Options](#deployment-options)
• [Environment Guidance](#environment-guidance)
• [Option 1: Local Deployment (Without Docker)](#option-1-local-deployment-without-docker)
• [Option 2: Local Deployment (With Docker)](#option-2-local-deployment-with-docker)
• [Option 3: Central Deployment (ECS Fargate)](#option-3-central-deployment-ecs-fargate)
• [Environment Variables Reference](#environment-variables-reference)
• [Q Developer Configuration](#q-developer-configuration)
• [Kiro Configuration](#kiro-configuration)
• [ECS Fargate Deployment](#ecs-fargate-deployment)
• [OAuth Authentication Setup](#oauth-authentication-setup-for-principal-propagation)
• [SAP System Selection](#sap-system-selection)
• [SAP Port Configuration](#sap-port-configuration)
• [Available Tools](#available-tools)
• [Troubleshooting](#troubleshooting)
• [Security Recommendations](#security-recommendations)
• [Authentication & Authorization](#authentication--authorization)
• [Secrets Management](#secrets-management)
• [Network Security](#network-security)
• [Input Validation](#input-validation)
• [Audit Logging](#audit-logging)
• [Container Security](#container-security)
• [Denial of Service Protection](#denial-of-service-protection)
• [SAP System Security](#sap-system-security)
• [Monitoring & Incident Response](#monitoring--incident-response)
• [Compliance Considerations](#compliance-considerations)
• [CA Private Key Protection](#ca-private-key-protection)
• [SAP Trust Store & Certificate Rule Governance](#sap-trust-store--certificate-rule-governance)
• [Code Change Control](#code-change-control)
• [Identity Provider Hardening](#identity-provider-hardening)
• [Intellectual Property & Data Loss Prevention](#intellectual-property--data-loss-prevention)
• [Supply Chain Integrity](#supply-chain-integrity)
• [DNS Rebinding Prevention](#dns-rebinding-prevention)
• [Denial of Service Resilience](#denial-of-service-resilience)
• [LLM Tool Safety & Human Oversight](#llm-tool-safety--human-oversight)
• [Assumptions](#assumptions)
• [Security Checklist for ECS Based Deployment](#security-checklist-for-ecs-based-deployment)
• [Configuration Comparison: Local vs ECS](#configuration-comparison-local-vs-ecs)
• [Code of Conduct](#code-of-conduct)
• [Support](#support)
• [Terms of Use](#terms-of-use)
• [Notices](#notices)
• [License](#license)

Overview

The ABAP Accelerator provides 15 SAP development tools accessible via MCP protocol:

• Connection management and status checking
• ABAP object creation, retrieval, and modification
• Syntax checking and code activation
• ATC quality checks and unit testing
• Transport request management
• Migration analysis

Deployment Options

| Option | Use Case | Authentication | Best For | |--------|----------|----------------|----------| | [1. Local (Without Docker)](#option-1-local-deployment-without-docker) | Development/testing | Interactive credentials | Quick testing, development | | [2. Local (With Docker)](#option-2-local-deployment-with-docker) | Development/testing | Interactive credentials | Isolated environment, multi-system | | [3. ECS Fargate](#option-3-ecs-fargate-deployment-with-principal-propagation) | Production/multi-user | Principal Propagation + OAuth | Enterprise, multi-user |

---

Environment Guidance

The ABAP Accelerator is designed for specific SAP system types. Please follow this guidance when deploying:

| ✅ Intended | ❌ Not Recommended | |-------------|-------------------| | Development (DEV) | Production (PRD) | | Sandbox (SBX) | Pre-production | | Quality Assurance (QAS) | | | Test (TST) | | | Training | | | Demo | |

Important: This tool provides direct access to ABAP development objects and should only be used in non-production environments. Production systems should follow established change management and transport processes.

---

Option 1: Local Deployment (Without Docker)

Run the MCP server directly with Python on your local machine.

Prerequisites

• Python 3.10+
• Network access to SAP system

Setup

# Clone repository
git clone https://github.com/aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer.git
cd guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer

# Install dependencies
pip install -r requirements.txt

# Run the server
python src/aws_abap_accelerator/main.py

Environment Variables

Create a .env file or set environment variables:

# SAP Connection
SAP_HOST=your-sap-host.example.com
SAP_INSTANCE_NUMBER=00
SAP_CLIENT=100
SAP_USERNAME=your_username
SAP_PASSWORD=your_password
SAP_LANGUAGE=EN
SAP_SECURE=true
# Server
SERVER_HOST=localhost
SERVER_PORT=8000
# SSL (optional)
SSL_VERIFY=true
# CUSTOM_CA_CERT_PATH=/path/to/ca-cert.pem
# Logging
LOG_LEVEL=INFO

Q Developer / Kiro Configuration

{
  "mcpServers": {
    "abap-accelerator": {
      "url": "http://localhost:8000/mcp"
    }
  }
}

---

Option 2: Local Deployment (With Docker)

Run the MCP server in a Docker container for isolated, reproducible deployments.

Prerequisites

• Docker installed
• Network access to SAP system

Building the Docker Image

# Build for AMD64 (Windows/Linux x86)
docker build -f Dockerfile.simple -t abap-accelerator-enterprise:latest .

# Build for ARM64 (Mac M1/M2/M3)
docker buildx build --platform linux/arm64 -f Dockerfile.simple -t abap-accelerator-enterprise:latest .

Deployment Scenarios

Scenario A: Single SAP System

For connecting to a single SAP system with interactive credential input.

Windows:

docker run -it -p 8000:8000 ^
  -e CREDENTIAL_PROVIDER=interactive ^
  -e ENABLE_PRINCIPAL_PR
For local multi-system deployments, you define SAP systems in a `sap-systems.yaml` file. This file contains only non-sensitive connection information - credentials are prompted interactively at container startup.

##### Step 1: Create sap-systems.yaml

Create the file anywhere on your local machine (e.g., `C:\projects\sap-config\sap-systems.yaml` on Windows or `~/sap-config/sap-systems.yaml` on Mac/Linux):

```yaml
# sap-systems.yaml - SAP System Configuration
# Only non-sensitive information stored here
# Credentials are prompted at container startup

systems:
  # Development System
  S4H-DEV:
    host: s4h-dev.company.com:44300    # Include port in host
    client: "100"                       # SAP client number (string)
    description: "S/4HANA Development"  # Optional description
  
  # QA System
  S4H-QAS:
    host: s4h-qas.company.com:44301
    client: "200"
    description: "S/4HANA QA System"
  
  # Production System (read-only recommended)
  S4H-PROD:
    host: s4h-prod.company.com:44302
    client: "300"
    description: "S/4HANA Production"

Step 2: Run Container with Config Mounted

Mount the config file to /app/config/sap-systems.yaml inside the container:

Windows (Command Prompt):

docker run -it -p 8000:8000 ^
  -v C:\projects\sap-config\sap-systems.yaml:/app/config/sap-systems.yaml:ro ^
  -e CREDENTIAL_PROVIDER=interactive-multi ^
  -e ENABLE_PRINCIPAL_PROPAGATION=false ^
  abap-accelerator-enterprise:latest

Windows (PowerShell):

docker run -it -p 8000:8000 `
  -v ${PWD}\sap-systems.yaml:/app/config/sap-systems.yaml:ro `
  -e CREDENTIAL_PROVIDER=interactive-multi `
  -e ENABLE_PRINCIPAL_PROPAGATION=false `
  abap-accelerator-enterprise:latest

Mac/Linux:

docker run -it -p 8000:8000 \
  -v $(pwd)/sap-systems.yaml:/app/config/sap-systems.yaml:ro \
  -e CREDENTIAL_PROVIDER=interactive-multi \
  -e ENABLE_PRINCIPAL_PROPAGATION=false \
  abap-accelerator-enterprise:latest

Step 3: Enter Credentials at Startup

The container will prompt for credentials for each system:

============================================================
  SAP CREDENTIALS INPUT (Stored in memory only)
============================================================

System: S4H-DEV (S/4HANA Development)
  Host: s4h-dev.company.com:44300
  Client: 100
  Username: DEVELOPER01
  Password: ********
  ✓ Credentials stored for S4H-DEV

System: S4H-QAS (S/4HANA QA System)
  Host: s4h-qas.company.com:44301
  Client: 200
  Username: DEVELOPER01
  Password: ********
  ✓ Credentials stored for S4H-QAS

============================================================
  All credentials stored. Starting MCP server...
============================================================

sap-systems.yaml Location Summary

| Location | Mount Path | Example | |----------|------------|---------| | Current directory | -v $(pwd)/sap-systems.yaml:/app/config/sap-systems.yaml:ro | ./sap-systems.yaml | | Specific path | -v /path/to/sap-systems.yaml:/app/config/sap-systems.yaml:ro | /home/user/config/sap-systems.yaml | | Windows path | -v C:\path\to\sap-systems.yaml:/app/config/sap-systems.yaml:ro | C:\Users\dev\sap-systems.yaml |

Important: Always mount as read-only (:ro) for security.

Option 3: Central Deployment (ECS Fargate)

For production multi-user deployments with Principal Propagation:

# ECS Task Definition environment variables
ENABLE_ENTERPRISE_MODE=true
ENABLE_PRINCIPAL_PROPAGATION=true
SERVER_HOST=0.0.0.0
SERVER_PORT=8000
AWS_REGION=us-east-1
DEFAULT_SAP_SYSTEM_ID=S4H-100

See [ECS Deployment Guide](#ecs-fargate-deployment) for complete setup.

---

Environment Variables Reference

Core Server Configuration

| Variable | Required | Default | Description | |----------|----------|---------|-------------| | SERVER_HOST | Yes | 0.0.0.0 | Server bind address | | SERVER_PORT | Yes | 8000 | Server port | | LOG_LEVEL | No | INFO | Logging level (DEBUG, INFO, WARNING, ERROR) | | CORS_ENABLED | No | false | Enable CORS | | CORS_ALLOWED_ORIGINS | No | * | CORS allowed origins |

Credential Provider Options

| Variable | Value | Description | |----------|-------|-------------| | CREDENTIAL_PROVIDER | interactive | Prompt for single SAP system at startup | | CREDENTIAL_PROVIDER | interactive-multi | Prompt for multiple systems from config file | | CREDENTIAL_PROVIDER | env | Use SAP_* environment variables | | CREDENTIAL_PROVIDER | aws_secrets | Use AWS Secrets Manager (production) |

SAP Connection (for env credential provider)

| Variable | Required | Description | |----------|----------|-------------| | SAP_HOST | Yes | SAP system hostname | | SAP_INSTANCE_NUMBER | Yes | SAP instance number (e.g., 00) | | SAP_CLIENT | Yes | SAP client number (e.g., 100) | | SAP_USERNAME | Yes | SAP username | | SAP_PASSWORD | Yes | SAP password | | SAP_LANGUAGE | No | SAP language (default: EN) | | SAP_SECURE | No | Use HTTPS (default: true) |

Enterprise Mode (ECS/Production)

| Variable | Required | Default | Description | |----------|----------|---------|-------------| | ENABLE_ENTERPRISE_MODE | Yes | false | Enable multi-tenancy and usage tracking | | ENABLE_PRINCIPAL_PROPAGATION | Yes | false | Enable X.509 certificate authentication | | DEFAULT_SAP_SYSTEM_ID | Recommended | - | Default SAP system when not specified | | DEFAULT_USER_ID | Recommended | - | Default user identity |

SSL/TLS Configuration

| Variable | Default | Description | |----------|---------|-------------| | SSL_VERIFY | true | Set to false to disable SSL verification (testing only) | | CUSTOM_CA_CERT_PATH | - | Path to custom CA certificate for corporate CAs |

OAuth Configuration (Optional)

| Variable | Required | Description | |----------|----------|-------------| | ENABLE_OAUTH_FLOW | No | Enable OAuth authentication flow | | OAUTH_ISSUER | If OAuth | OIDC issuer URL | | OAUTH_AUTH_ENDPOINT | If OAuth | Authorization endpoint | | OAUTH_TOKEN_ENDPOINT | If OAuth | Token endpoint | | OAUTH_CLIENT_ID | If OAuth | OAuth client ID | | OAUTH_CLIENT_SECRET | No | OAuth client secret (for confidential clients) | | OAUTH_REDIRECT_URI | No | OAuth callback URL | | SERVER_BASE_URL | If OAuth | MCP server public URL |

---

Q Developer Configuration

Local Docker Deployment

Add to your Q Developer MCP configuration (~/.aws/amazonq/mcp.json or workspace .amazonq/mcp.json):

Single System

{
  "mcpServers": {
    "abap-accelerator": {
      "url": "http://localhost:8000/mcp"
    }
  }
}

Multiple Systems

{
  "mcpServers": {
    "abap-dev": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-DEV"
      }
    },
    "abap-qas": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-QAS"
      }
    }
  }
}

ECS Fargate Deployment

{
  "mcpServers": {
    "abap-accelerator": {
      "url": "https://your-alb-endpoint.com/mcp",
      "headers": {
        "x-sap-system-id": "S4H-100"
      }
    }
  }
}

With OAuth Authentication

{
  "mcpServers": {
    "abap-accelerator": {
      "url": "https://your-mcp-server.com/mcp",
      "headers": {
        "x-sap-system-id": "S4H-100"
      }
    }
  }
}

No authentication headers needed - OAuth flow opens browser automatically.

---

Kiro Configuration

Add to your Kiro MCP configuration (.kiro/settings/mcp.json):

Local Deployment

{
  "mcpServers": {
    "abap-accelerator": {
      "url": "http://localhost:8000/mcp"
    }
  }
}

Multiple Systems

{
  "mcpServers": {
    "abap-dev": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-DEV"
      }
    },
    "abap-qas": {
      "url": "http://localhost:8000/mcp",
      "headers": {
        "x-sap-system-id": "S4H-QAS"
      }
    }
  }
}

ECS/Remote Deployment

{
  "mcpServers": {
    "abap-accelerator": {
      "url": "https://your-alb-endpoint.com/mcp",
      "headers": {
        "x-sap-system-id": "S4H-100"
      }
    }
  }
}

---

ECS Fargate Deployment

Credential Storage: Secrets Manager vs Parameter Store

When deploying on ECS Fargate, sensitive and non-sensitive configuration data are stored separately:

| Storage | What to Store | Why | |---------|---------------|-----| | AWS Secrets Manager | CA certificates, private keys, OAuth client secrets | Encrypted, access-controlled, audit logged | | AWS Parameter Store | SAP endpoints, user mappings, non-sensitive config | Cost-effective, easy to update, version controlled |

AWS Secrets Manager (Sensitive Data)

Store these secrets in AWS Secrets Manager:

1. CA Certificate (for Principal Propagation)

Secret Name: abap-accelerator/ca-certificate

# Create the secret
aws secretsmanager create-secret \
  --name abap-accelerator/ca-certificate \
  --description "CA certificate for ABAP Accelerator principal propagation" \
  --secret-string '{
    "ca_certificate": "",
    "ca_private_key": ""
  }' \
  --region us-east-1

JSON Structure:

{
  "ca_certificate": "",
  "ca_private_key": ""
}

2. OAuth Client Secret (for Principal Propagation with OAuth)

Secret Name: abap-accelerator/oauth-client-secret

aws secretsmanager create-secret \
  --name abap-accelerator/oauth-client-secret \
  --description "OAuth client secret for ABAP Accelerator principal propagation" \
  --secret-string '{"client_secret": "your-oauth-client-secret"}' \
  --region us-east-1

AWS Parameter Store (Non-Sensitive Configuration)

Store these configurations in AWS Systems Manager Parameter Store:

1. SAP Endpoints Configuration

Parameter Name: /abap-accelerator/sap-endpoints

aws ssm put-parameter \
  --name /abap-accelerator/sap-endpoints \
  --desc

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [aws-solutions-library-samples](https://github.com/aws-solutions-library-samples)
- **Source:** [aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer](https://github.com/aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer)
- **License:** MIT-0
- **Homepage:** https://aws.amazon.com/blogs/awsforsap/introducing-abap-accelerator-for-ai-assisted-development

Install and usage instructions live in the source repository linked above.