Title

Description

Prerequisites

You have completed the previous tutorial on how to encrypt your SAP ASE database to migrate from on-premise to SAP HANA Cloud.

You will learn

How to create an SAP HANA Cloud, SAP ASE database instance
How to copy the encrypted backup to MS Azure using azcopy
How to load the encrypted backup

Intro

Migrating an SAP ASE database from on-premise to the cloud requires a bit of preparation and a few important steps. You can look at each of them in more detail, but these are the high-level steps required:

Pre-requisites for migration
Pre-Migration - Encrypt the on-premise SAP ASE database
Migration - Create the SAP HANA Cloud, SAP ASE database
Migration - Copy the Encrypted Backup to MS Azure
Migration - Load the Encrypted Backup

This tutorial will cover the steps (3 to 5) involving the migration. You can learn about the first and the second step by referring to the previous tutorials.

Step 1 - Create the SAP HANA Cloud, SAP ASE database instance

Picture:

Above should be bordered.

Now it's time to make sure your SAP ASE database in SAP HANA Cloud is ready to receive the data from your on-premise SAP ASE database. To ensure this, follow these steps:

Provision an SAP HANA Cloud, SAP ASE database instance. The database in SAP HANA Cloud should be at least the same size as the on-premise one, but you might find that you need to increase the size as you go through the migration and performance test. Find more information on our technical documentation.
Configure your SAP ASE database in SAP HANA Cloud. You can find details of the various operational steps to back up the database, SAP ASE configuration or list out the login accounts, roles, and database cache bindings on the SAP HANA Cloud, SAP ASE Migration Guide.
Make sure the SAP HANA Cloud, SAP ASE master database is encrypted with a password and not using an external HSM.
```
sp_encryption helpkey, sybencrmasterkey
```
If it was not encrypted with a password, then add a password for the master key.
```
alter encryption key master with external key
modify encryption with passwd "<PASSWORD>"
```
Extract the database-encryption-key from the on-premise SAP ASE database. There is a dek_mig_gen.py key migration script to automatically build the create encrypt key command. Here is the syntax to use with this script in order to get the database-encryption-key:
```
export SYBROOT=/sap/ASE16sp04GA/sap/python_client/testcode/dek_mig_gen.py -U sa -P <PASSWORD> -S <OnPremiseASE> -K <KEY_NAME> -M <PASSWORD>
```
Optionally, you can manually build the database-encryption-key from the on-premise SAP ASE database using ddlgen. Instructions for building out the database-encryption-key using ddlgen can be found in the SAP HANA Cloud, SAP ASE Migration Guide.
```
ddlgen -Usa -P<PASSWORD> -SASE16sp04GA -Dmaster -TEK -XOD -N %
```
Create the encrypted database in the SAP HANA Cloud, SAP ASE. Execute the command previously created as part of the previous step (step 3) to create the database encryption key in the SAP HANA Cloud, SAP ASE.
Create the database using the migrated DEK.

Caution

It is very important to create the database with the encrypted key. If you don't, the database will still be created but you won't be able to load the database later.
```
create database <DATABASE_NAME> on datadev11="1G" log on logdev11="50M" for load encrypt with <KEY_NAME>
```
Important

It is very important to create the database with the encrypted key. If you don't, the database will still be created but you won't be able to load the database later.
```
create database <DATABASE_NAME> on datadev11="1G" log on logdev11="50M" for load encrypt with <KEY_NAME>
```
IMPORTANT:

It is very important to create the database with the encrypted key. If you don't, the database will still be created but you won't be able to load the database later.
```
create database <DATABASE_NAME> on datadev11="1G" log on logdev11="50M" for load encrypt with <KEY_NAME>
```

Step 2 - Copy the encrypted backup to MS Azure using azcopy

You can see a migration demo video here, and then check out the detailed steps:

If you don't already have an Azure account, you can go to this website and create one. Once you have logged into the Azure portal, proceed to create an Azure Storage Account of type blogstorage.
Install the azcopy tool using the help of this link.

Then run this command:
```
rpm --import https://packages.microsoft.com/keys/microsoft.asc
```
Once you have azcopy loaded on your system, you will need to log in into your azure account with azcopy. Below is the command that you use to do this:
```
/docker/toolkit/microsoft/azcopy_linux_amd64_10.9.0/azcopy login --tenant-id "XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
```
Replace the tenant-id above with the tenant-id of your MS Azure account. After you have executed the azcopy login command above, you will be asked to open a browser and type in a code that was provided to allow the access.

Next, create a container using the azcopy tool.

/docker/toolkit/microsoft/azcopy_linux_amd64_10.9.0/azcopy make "https://salsestorage01.blob.core.windows.net/<DATABASE_NAME>container"

Using the MS Azure portal, generate a shared access signature (SAS) and assign to signing key 1 (access key).

Finally, upload the on-premise encrypted backup to the azure storage account using azcopy. Be sure to select the database directory name as the root of the directory tree that you want uploaded.

/docker/toolkit/microsoft/azcopy_linux_amd64_10.9.0/azcopy copy '<DATABASE_NAME>_dumpdir/<DATABASE_NAME>'   'https://salsestorage01.blob.core.windows.net/<DATABASE_NAME>container?sp=racwdl&st=2021-02-28T14:19:34Z&se=2022-03-01T22:19:34Z&spr=https&sv=2020-02-10&sr=c&sig=yKCnItSYnfkIb%2BqFzTu7iiP3Saso2zPqY%2F1QtgiEpH8%3D' --recursive

Replace the full https parameter in the azcopy command above with your shared access signature (SAS) created in step 5.

thecodester/my-first-action