Cloud Connector creates a controlled outbound connection from the internal network to SAP BTP. Its value is not merely making a call work; it prevents an integration need from unnecessarily expanding the attack surface.
1) Define the contract before exposing a resource
Document the system, host, port, path and operation the integration needs. “SAP access” is not a scope: an iFlow should depend only on the specific resource it needs, with both technical and business ownership.
2) Expose the minimum required
Virtual mapping lets teams publish selected internal resources to the subaccount. Avoid broad ranges, wildcard paths and access created “temporarily”. Every exposure should answer which interface uses it, with which identity and when it was last reviewed.
| Decision | Minimum control |
|---|---|
| Internal resource | Specific host, port and path |
| Subaccount | Clear environment separation |
| Authentication | Least-privilege technical account |
| Change | Owner, evidence and rollback documented |
3) Keep connectivity, authorization and credentials separate
Cloud Connector reaching a resource does not mean CPI is authorized to use it. Network connectivity, the technical user, certificates and SAP permissions are distinct controls; treating them as one makes incidents difficult to explain.
4) Design production diagnostics
When an iFlow cannot reach a backend, teams should verify in order: connector availability, correct subaccount and region, permitted virtual resource, CPI destination and target authentication. Logs should retain a correlation ID without exposing sensitive data.
- Alert on persistent disconnects, not every failed attempt.
- Include the Cloud Connector dependency in every critical interface runbook.
- Test connectivity and permissions with a representative transaction before go-live.
5) Treat network changes as integration changes
A proxy, certificate, route or network update can break an interface even when the iFlow is unchanged. Include Cloud Connector in change windows, regression tests and rollback plans; otherwise the dependency remains invisible until an incident.
Production checklist
- Resource, consumer and owner documented.
- Exposure restricted to the necessary host, port and path.
- Environments and credentials separated.
- Connectivity, authorization and controlled-error tests passed.
- Monitoring and a runbook with escalation path in place.
With this discipline, Cloud Connector serves its purpose: enabling hybrid integration without turning connectivity into a broad, hard-to-govern permission.