Infrastructure architecture
DefaultFILE-first extraction architecture
Classic ABAP extraction with approved logical paths, SFTP/ADF pickup, and zero Azure credentials on S/4 by default.
Architecture diagram
Default route: 1 → 4 → 7 → 8 → 5 → 3 → 6 → 9
Callout 1
Approved extractors
Released APIs / reviewed code
Allowlisted extraction catalog with object owner, purpose, approved fields, lawful basis, and delta strategy. No RODPS_REPL_*.
Need this architecture for your internal review?
Request an editable .drawio source stencil for internal architecture validation.
Detail
Default FoolproofDefault Path B: SAP initiates extract; cloud credentials stay in CPI/ADF/Managed Identity — not in SAP Secure Store.
Selection uses a high watermark at run start and a closed interval. Advance extracted watermark only after durable local publication; advance delivered watermark after validated lake landing.
- ECC 6.0 EhP5+ / BASIS 702+ or S/4HANA 1909+
- No ODP RFC replication APIs (RODPS_REPL_*)
- PII classify-before-write where catalog requires it
- No Azure token on SAP. SHIR and relay placement require customer or RISE approval
ABAP account: extraction + logical-file permissions only (including S_DATASET as applicable).
SFTP: restricted account, pinned host key, dedicated transfer directory, TCP 22.
SHIR: private DNS to ADLS on 443; certificate trust and outbound for the ADF control plane maintained.
Status labels follow the Design Authority legend on the hub.
| Scenario | Status | Note |
|---|---|---|
| ECC or S/4 classic ABAP | Conditional | Validate release, authorizations, add-on install, upgrade testing. |
| RISE private edition FILE path | Conditional | Logical directories, transfer route, and custom code require SAP service approvals. |
| SFTP on SAP application host | Excluded | Do not assume OS install rights on RISE-managed hosts. |
| Direct ABAP → ADLS from S/4 | Excluded | Optional Mode A only when ICM outbound already approved — not default. |
- Complete run: chunks + manifest + .ok; incomplete run never copied
- Duplicate / out-of-order delivery does not double-advance watermark
- SHIR or SFTP outage: extract still completes locally; backlog drains later
- RISE gate checklist signed before first transport of /SKYN/ objects