AWS Backint Agent for SAP ASE end of support

After careful consideration, we have decided to end support for AWS Backint Agent for SAP ASE, effective September 29, 2027. Beginning October 29, 2026, AWS Backint Agent for SAP ASE will no longer be available to download for new customers. As an existing customer, you can continue to use AWS Backint Agent for SAP ASE until September 29, 2027. After September 29, 2027, AWS Backint Agent for SAP ASE will no longer be available to download, existing installations will no longer be supported, and backup and restore operations that use the agent will no longer be supported and might not function as expected.

AWS Backint Agent for SAP HANA is not affected by this change and continues to be supported until further notice.

Key dates

What continues before the end of support date

Between September 29, 2026 and September 29, 2027, AWS continues to provide the following for AWS Backint Agent for SAP ASE:

No new features or enhancements are delivered during this period. We encourage you to begin migration planning promptly.

During the migration period (October 29, 2026 to September 29, 2027), fully migrate your backup strategy to one of the recommended alternatives and create new full backups with your chosen alternative. Do not rely on backups that were created with the agent for recovery after the end of support date. We strongly recommend that you complete your migration well before September 29, 2027, to avoid any risk of business disruption.

Alternatives and migration guidance

Consider migrating to one of the following alternatives well ahead of the end of support date.

Option 1: SAP ASE native Amazon S3 backup (recommended)

SAP ASE 16.1 natively supports syb_aws as an external API endpoint name with backup and recovery commands (dump and load). This allows you to use SAP ASE native commands and tools to control the flow of backups to Amazon S3, without requiring a separate agent.

Benefits:

Migration steps

SAP ASE 16.1 includes a native Amazon S3 backup capability that eliminates the need for the AWS Backint Agent.

Prerequisites:

Step 1 – Create an Amazon S3 bucket

Create the target bucket in any Region other than us-east-1. For example, with the AWS CLI:

aws s3api create-bucket --bucket my-ase-backup-bucket --region us-west-2 --create-bucket-configuration LocationConstraint=us-west-2

For bucket naming rules and best practices, see Bucket naming rules in the Amazon S3 User Guide.

Step 2 – Set up IAM credentials

Create an IAM user or role with a policy that grants access to the backup bucket. The following is a minimal policy example.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::my-ase-backup-bucket",
                "arn:aws:s3:::my-ase-backup-bucket/*"
            ]
        }
    ]
}

Generate an access key for the IAM user. The credentials are passed inline in the dump database command in Step 3. For more information about protecting credentials, see Security best practices in IAM.

Step 3 – Run a backup

Connect to the SAP ASE instance.

source /opt/sap/SYBASE.sh
isql -Usa -P<sa_password> -S<server_name>:<port> -w1024

Run the dump command.

dump database <database_name> to "syb_aws::<backup_object_name>"
with extlib_login_name='<ACCESS_KEY_ID>',
extlib_login_pwd='<SECRET_ACCESS_KEY>',
extlib_container_name='my-ase-backup-bucket'
go

Replace the placeholders: <database_name> (the SAP ASE database to back up), <backup_object_name> (the Amazon S3 object key), <ACCESS_KEY_ID> and <SECRET_ACCESS_KEY> (the IAM credentials), and my-ase-backup-bucket (the target S3 bucket name).

A successful backup prints the following.

Backup Server: 3.42.1.1: DUMP is complete (database <database_name>).

Step 4 – Restore a backup

load database <database_name> from "syb_aws::<backup_object_name>"
with extlib_login_name='<ACCESS_KEY_ID>',
extlib_login_pwd='<SECRET_ACCESS_KEY>',
extlib_container_name='my-ase-backup-bucket'
go

Step 5 – Update automation and validate

Known limitations

Amazon S3 buckets in the us-east-1 Region are not supported with the native SAP ASE Amazon S3 backup feature. Backup operations that target a bucket in us-east-1 fail with curlCode: 6, Could not resolve hostname. There is no parameter that bypasses this behavior.

Use an Amazon S3 bucket in any Region other than us-east-1, such as us-west-2, eu-west-1, or ap-southeast-1. To open a support case with SAP for this issue, reference ASE 16.1 EBF 31284.

Troubleshooting

For issues with the native Amazon S3 backup feature, raise an incident through the SAP support portal.

Option 2: AWS Storage Gateway (Amazon S3 File Gateway)

As an alternative, you can use AWS Storage Gateway (Amazon S3 File Gateway) to present an NFS file share that is backed by Amazon S3.

Benefits:

Migration steps

Considerations:

For a step-by-step walkthrough, see Integrate an SAP ASE database to Amazon S3 using AWS Storage Gateway.

Option 3: Third-party enterprise backup solutions

SAP-certified enterprise backup solutions can target Amazon S3 as a storage destination.

Benefits:

Considerations:

Migration steps

Agent downloads for existing customers

On October 29, 2026, access to the AWS Backint Agent for SAP ASE download changes from publicly available to restricted to existing customers only. After that date, downloads require an authenticated request from an allowlisted AWS account. This access allows existing customers to obtain the critical security patches and bug fixes that AWS continues to publish until September 29, 2027. Existing installations are not affected, and an agent that is already installed continues to operate without any changes. If you have already migrated to one of the alternatives on this page, you do not need to take any action.

Allowlisting

Existing customer accounts are allowlisted automatically. No request is needed. If a download fails with an access denied error after October 29, 2026, open a support case through the AWS Support Center and provide the AWS account ID that you use to download the agent.

Grant read access within the AWS account

Allowlisting permits an AWS account to read the download bucket. It does not by itself grant that permission to a user or role inside the account. An additional IAM policy is required. Attach a policy such as the following to the IAM principal that performs the download. In most cases, this is the IAM role that is attached to the Amazon EC2 instance that runs SAP ASE.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::awssap-backint-agent-ase/binary/*"
        }
    ]
}

Add s3:ListBucket on arn:aws:s3:::awssap-backint-agent-ase to list the available agent versions. No AWS KMS permissions are required. The access that is granted is read-only and limited to the binary/ prefix of the download bucket.

Use an authenticated download

Unauthenticated access to the download bucket ends on October 29, 2026. Downloads over a plain HTTPS URL, for example with a web browser, curl, or wget without credentials, fail with an access denied error. Use the AWS CLI or an AWS SDK instead.

aws s3 cp s3://awssap-backint-agent-ase/binary/<version>/<file> .

The download bucket for commercial Regions is s3://awssap-backint-agent-ase (us-east-1).

After September 29, 2027, download access to the agent is removed entirely. You will no longer be able to download AWS Backint Agent for SAP ASE.

Frequently asked questions

Additional resources and support

For additional questions about this end of support announcement or assistance with migration planning:

Related documentation: