View a markdown version of this page

Configuring Connections to your ERP - Amazon Connect Decisions
Configure the Credentials in Secrets ManagerConfigure permissions on the KMS KeyUpdate the Secrets Manager resource policy for your SecretConfigure the Amazon Connect Decisions Connection

Configuring Connections to your ERP

To enable Amazon Connect Decisions to perform operations on your behalf in your Enterprise Resource Planning (ERP) system, you must configure a Connection that specifies the necessary connection parameters and the credentials Amazon Connect Decisions should use during the operation.

Supported ERP systems:

  • SAP S/4HANA

Configure the Credentials in Secrets Manager

  1. Using your account, use Secrets Manager to Create an Secrets Manager secret

    • When entering the credentials in Secrets Manager, replace the placeholder values below (<username> and <password>) with the actual username and password that Amazon Connect Decisions should use

    • If using the console, choose Other type of secret for the Secret Type

    • If entering the details through the Key/value pairs tab in the console, enter 2 pairs:

      • Key: username; Value: <username>

      • Key: password; Value: <password>

    • If using the Plaintext tab to enter the secret in the console, enter a JSON object with the two pairs: 

      {
  "Username": "<username>",
  "Password": "<password>"
}

  2. Encrypt your secret with an AWS KMS Key, take note of the Key's id, as you will need it in subsequent steps

  3. Once your secret is created, take note of its Amazon Resource Name (ARN), as you will need it in subsequent steps

    • e.g.: arn:aws:secretsmanager:<Region>:<AccountId>:secret:<SecretName>-<SixRandomCharacters>

Configure permissions on the KMS Key

You need to provide the permissions necessary for Amazon Connect Decisions to access and use it.

  1. Update your KMS policy to allow Amazon Connect Decisions to access your key through the instance role

    • Note: Replace <YourAccountNumber> and <YourInstanceID> with your AWS account and Amazon Connect Decisions Instance ID. 

    {
    "Sid": "Allow Amazon Connect Decisions to access the AWS KMS Key",
    "Effect": "Allow",
    "Principal": {
       "Service": "scn.amazonaws.com",
        "AWS": "arn:aws:iam::YourAccountNumber:role/service-role/scn-instance-role-YourInstanceID"
    },
    "Action": [
       "kms:DescribeKey",
       "kms:CreateGrant",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey",
       "kms:GenerateDataKeyWithoutPlaintext"
    ],
    "Resource": "*"
}

  2. Update the inline policy for your instance role to grant permission on the key

    • Note: Replace <YourSecretArn>, <YourAccountNumber> and <YourInstanceID> with your Secret ARN, AWS account and AWS Supply Chain Instance ID. 

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": "secretsmanager:*",
            "Resource": "YourSecretArn"
        },
        {
            "Sid": "AllowKmsForSecretsManager",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:YourAccountNumber:key/YourKeyId"
        }
    ]
}

Update the Secrets Manager resource policy for your Secret

  1. Update the Secrets Manager resource Policy for your Secret

    • Note: Replace <YourSecretArn> with the ARN of your Secret 

    {
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Principal":{
            "Service":"scn.amazonaws.com"
         },
         "Action":[
            "secretsmanager:GetSecretValue",
            "secretsmanager:DescribeSecret"
         ],
         "Resource":"YourSecretArn"
      }
   ]
}

Configure the Amazon Connect Decisions Connection

  1. In your instance of Amazon Connect Decisions, navigate to the Data Management page

  2. Select the Connections tab

  3. Click the Create Connection button

  4. In the Create Connector page, click the Select button on the row for SAP S/4HANA connector type

  5. In the Configure SAP S/4HANA API Connector page enter the necessary information:

    • Connection Name: unique connection name

    • API Endpoint URL: the OData API endpoint URL of your SAP S/4HANA instance (e.g.: https://<hostname>:<port>)

    • Client Number: the 3-digit SAP client number (e.g.: 100)

    • Secret ARN: the Amazon Resource Name (ARN) of the secret in Secrets Manager where the credentials to be used by Amazon Connect Decisions are stored

  6. Click on the Create Connector button