This repository is a configuration and workflow template for deploying SAP on Azure with the SAP Deployment Automation Framework (SDAF). SDAF uses Terraform to deploy infrastructure and Ansible to configure operating systems and install SAP software.
Azure/sap-automationis the central SDAF documentation hub. It owns the core Terraform, Ansible, deployment scripts, runner implementation, and theSDAF-GitHub-Actionssetup utility.Azure/sap-automation-gh-bootstrap(this repository) is the customer configuration template. It owns the.cfg_templatefiles, generatedWORKSPACESconfiguration, and GitHub Actions workflows.Azure/sap-automation-bootstrapowns the Azure DevOps customer configuration and wrapper pipelines.Azure/SAP-automation-samplesowns shared Terraform samples and SAP Bill of Materials (BoM) definitions consumed by the execution models.
Use the central SDAF hub to compare GitHub Actions, Azure DevOps, and local or scripted execution. This repository documents only the GitHub Actions-specific procedure.
The deployment consists of:
- A control plane containing the deployer virtual machine, SAP library, Terraform state, credentials, and self-hosted GitHub Actions runner.
- An SAP application plane containing workload zones and SAP systems managed by the control plane.
Warning
The sample configuration creates billable Azure resources. Review architecture, networking, sizing, quota, security, and cost before applying a Terraform plan.
Follow the guides in order:
- Prerequisites and planning
- Bootstrap GitHub and Azure
- Create and deploy the control plane
- Create and deploy a workload zone
- Create and deploy an SAP system
- Download software and install SAP
- Operations, troubleshooting, and removal
Do not start with workflow 01. The bootstrap process and workflow 00 create the GitHub environment, secrets, variables, and Terraform configuration required by later workflows.
| Order | Workflow | Outcome |
|---|---|---|
| 00 | Create Control Plane Environment | Control-plane GitHub environment and configuration |
| 01 | Deploy Control Plane | Deployer, SAP library, and self-hosted runner |
| 02 | Create workload environment | Workload-zone environment and configuration |
| 03 | Deploy SAP Workload Zone | Shared workload-zone infrastructure |
| 04 | Create SYSTEM environment | SAP system configuration committed to WORKSPACES; no GitHub environment is created |
| 05 | SAP SID Infrastructure deployment | SAP virtual machines and infrastructure |
| 06 or 06.5 | Download SAP software | SAP installation media |
| 07 | Operating System Configuration and Installation | Configured and installed SAP system |
Wait for each workflow to succeed and review its output before starting the next one.
Workflows 00, 02, and 04 provide GitHub-specific configuration generation. Workflow
00 creates the control-plane GitHub environment, and workflow 02 creates the
workload-zone GitHub environment. Despite its display name, workflow 04 only generates
and commits SAP-system configuration. Workflow 05 uses the selected workload-zone
environment for credentials and variables.
Files under .cfg_template are source templates. Creation workflows substitute their
@@...@@ placeholders and generate the Terraform deployment inputs under WORKSPACES:
| Source template | Creation workflow | Generated configuration |
|---|---|---|
deployer.tfvars |
00 - Create Control Plane Environment |
WORKSPACES/DEPLOYER/.../*.tfvars |
library.tfvars |
00 - Create Control Plane Environment |
WORKSPACES/LIBRARY/.../*.tfvars |
landscape.tfvars |
02 - Create workload environment |
WORKSPACES/LANDSCAPE/.../*.tfvars |
system.tfvars |
04 - Create SYSTEM environment |
WORKSPACES/SYSTEM/.../*.tfvars |
The generated WORKSPACES files, not .cfg_template directly, are the deployment inputs.
Review and customize generated files after creation, then commit approved changes before
running the corresponding deployment workflow. Template changes affect future generation;
they do not update existing WORKSPACES files. Apply approved changes to both locations
when a setting must remain consistent for current and future environments.
In each template, non-commented assignments are mandatory workflow values or deliberate generated configuration. Commented assignments are optional and show the current Terraform default unless explicitly labeled as an example or cloud-specific override; comments also identify required values that SDAF scripts inject at deployment time.
Each template contains one commented dns_zone_names block with Azure Government values.
For Public Azure, leave it commented because Terraform already supplies the Public Azure DNS
zone names by default. Do not add a redundant Public Azure assignment or enable multiple
blocks.
Set the repository variables ARM_ENVIRONMENT, AZURE_ENVIRONMENT, and AZURE_AUDIENCE
before creating environments. Workflow 00 copies them to the control-plane environment,
and workflow 02 propagates them to workload environments. Public Azure defaults are
public, AzureCloud, and api://AzureADTokenExchange. For Azure Government, use
usgovernment, AzureUSGovernment, and api://AzureADTokenExchangeUSGov, then uncomment
the Government dns_zone_names block in each applicable generated configuration.
Deployment is intentionally staged. Later workflows consume the approved WORKSPACES
configuration and Terraform state persisted by the SAP library, so complete and validate
each stage before starting a dependent stage.
This repository is an evolving template. Review these limitations before using it for deployment:
| Area | Status | Required action |
|---|---|---|
Workflow 01 dry run |
Not operational | The test input is not forwarded to the deployment scripts. Do not use workflow 01 to obtain a plan-only run. |
Workflow 07 installation |
Blocked | The workflow currently contains invalid YAML indentation and an inconsistent inventory path. Correct and validate the workflow before running it. |
Workflow 10 removal |
Destructive, no plan mode | The workflow has no test input and defaults to removing the SAP system. Review every input before dispatch. |
| Azure Government login | Not implemented | azure/login uses Public Azure defaults and the setup utility does not create cloud-selection variables. Add and validate cloud-specific login inputs before using the workflows with Azure Government. |
The detailed guides identify these limitations at the affected steps.
.cfg_template: Terraform variable templates used by creation workflows..github/workflows: GitHub Actions workflows for deployment and removal.WORKSPACES: generated and customized deployment configuration.docs: detailed setup, deployment, and operations guides.
For symptom-based diagnostics, see Troubleshoot GitHub Actions deployments.