Add Azure Backup functionality for SAP HANA database restoration

Author: devanshjainms

README.md

@@ -31,6 +31,14 @@ In the SAP Testing Automation Framework, thorough validation of high availabilit
 - **Functional Testing:** The framework executes series of real-world scenarios based on the SAP HANA and SAP Central Services high availability setup to identify potential issues, whether during a new system deployment or before implementing cluster changes in a production environment. The test cases are based on what is documented in how-to guides for SAP HANA and SAP Central Services configuration.
 - **Offline configuration validation:** Offline validation is a mode of the framework that validates SAP HANA and SAP Central Services high availability cluster configurations without establishing a live SSH connection to the production cluster. Instead, it analyzes captured cluster information base (CIB) XML files exported from each cluster node.
 
+### Azure Backup Testing
+
+The framework validates Azure Backup operations for SAP HANA databases, covering the full backup-restore lifecycle. It supports both HA (two-node cluster) and non-HA (single-node) deployments.
+
+- **Backup Setup Verification:** Discovers protected HANA databases in the Recovery Services vault, verifies backup configuration health, and checks that recent restore points exist.
+- **Restore Operations:** Tests restore-to-database (in-place and cross-VM) and restore-to-filesystem workflows via the Azure Backup Python SDK, monitoring restore jobs to completion.
+- **Database Recovery Validation:** Validates native HANA recovery using database commands (`RECOVER DATA`), and confirms the database is consistent and operational after each restore.
+
 ### Configuration Checks (Preview)
 
 The framework performs comprehensive configuration checks to ensure that the SAP system and its components are set up according to [SAP on Azure best practice](https://learn.microsoft.com/azure/sap/). This includes validating infrastructure settings, operating system parameter configurations, and network settings, in addition to the cluster configuration, to identify any deviations that could impact system performance or reliability.
@@ -65,6 +73,7 @@ For users focused solely on validating SAP functionality and configurations, the
 
 - Configure management server following the document [Setup Guide for SAP Testing Automation Framework](https://github.com/Azure/sap-automation-qa/blob/main/docs/SETUP.MD).
   - For high availability testing scenarios, see [High Availability documentation](./docs/HIGH_AVAILABILITY.md).
+  - For Azure Backup testing scenarios, see [Azure Backup Testing documentation](./docs/AZURE_BACKUP.md).
   - For Configuration Checks and Testing details, see the [Configuration Checks documentation](./docs/CONFIGURATION_CHECKS.md).
 
 ### Option 2: Integration with SAP Deployment Automation Framework (SDAF)
@@ -81,6 +90,7 @@ For support and questions, please:
 ## 📚 Additional Resources
 
 - [Azure SAP Documentation](https://docs.microsoft.com/azure/sap)
+- [Azure Backup Testing Guide](./docs/AZURE_BACKUP.md)
 - [Configuration Checks Guide](./docs/CONFIGURATION_CHECKS.md)
 - [High Availability Testing Guide](./docs/HIGH_AVAILABILITY.md)
 

WORKSPACES/SYSTEM/DEV-WEEU-SAP01-X00/sap-parameters.yaml

@@ -50,3 +50,25 @@ user_assigned_identity_client_id: "00000000-0000-0000-0000-000000000000"
 #############################################################################
 ANF_account_rg:                "ANF-RESOURCE-GROUP"
 ANF_account_name:              "ANF-ACCOUNT-NAME"
+
+#############################################################################
+#                  Azure Backup Parameters (optional)                       #
+#  Required when SAP_FUNCTIONAL_TEST_TYPE is AzureBackupDatabase            #
+#############################################################################
+
+# Recovery Services vault resource ID (required)
+backup_vault_resource_id:      "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.RecoveryServices/vaults/<vault-name>"
+
+# Protected item identifiers (required for restore test cases 2-5)
+backup_container_name:         "VMAppContainer;Compute;<resource-group>;<vm-name>"
+backup_item_name:              "saphanadatabase;<sid>;<database-name>"
+
+# Filesystem restore target path (required for test case 3)
+backup_target_filesystem_path: "/hana/backup/restore"
+
+# Cross-VM restore parameters (required for test case 5)
+backup_target_container_name:  "VMAppContainer;Compute;<resource-group>;<target-vm-name>"
+backup_target_database_name:   "SYSTEMDB"
+
+# Point-in-time restore (ISO 8601 UTC, optional)
+backup_restore_point_time:     ""

docs/AZURE_BACKUP.md

@@ -0,0 +1,121 @@
+# Azure Backup Functional Testing for SAP HANA
+
+The SAP Testing Automation Framework includes an Azure Backup testing component that validates backup and restore operations for SAP HANA databases deployed on Azure. It exercises the [Azure Backup for SAP HANA](https://learn.microsoft.com/azure/backup/sap-hana-database-about) service through the Python SDK (`azure-mgmt-recoveryservicesbackup`) and native HANA recovery commands.
+
+## Supported Scenarios
+
+The framework supports both **HA (two-node cluster)** and **Non-HA (single-node)** HANA deployments. Five test cases cover the end-to-end backup-restore lifecycle:
+
+| # | Test Case | Task Name | Description |
+|---|-----------|-----------|-------------|
+| 1 | Azure Backup Setup Verification | `backup-setup-verification` | Discovers all protected HANA databases in the Recovery Services vault, verifies backup configuration health, and checks that recent restore points exist. |
+| 2 | Restore Backup to HANA DB | `restore-to-db` | Triggers a full or point-in-time restore to the original HANA database via Azure Backup, monitors the restore job, then validates HANA is running. |
+| 3 | Restore Backup to FileSystem | `restore-to-filesystem` | Restores the HANA backup as files to a filesystem path, verifies the files are present, then recovers the HANA DB from those files and validates it is operational. |
+| 4 | Recover DB using Database Commands | `recover-db-commands` | Tests native HANA recovery using `recoverSys.py` / `RECOVER DATA`. Queries the backup catalog, stops HANA, performs recovery, restarts, and validates consistency. |
+| 5 | Cross-VM Restore | `restore-cross-vm` | Restores a HANA backup from VM-1 to VM-2 (AlternateWorkloadRestore). Validates the target HANA instance starts and the database is consistent. Requires ≥ 2 HANA nodes. |
+
+## Prerequisites
+
+### 1. Azure Backup Configuration
+
+- A **Recovery Services vault** must exist with SAP HANA backup configured.
+- At least one HANA database must be **registered and protected** with a backup policy.
+- A recent backup (full or incremental) must have completed successfully so restore points are available.
+
+For setup guidance, see [Back up SAP HANA databases in Azure VMs](https://learn.microsoft.com/azure/backup/sap-hana-database-instances-backup).
+
+### 2. Managed Identity Permissions
+
+The management server's managed identity (system- or user-assigned) requires:
+
+| Role | Scope | Purpose |
+|------|-------|---------|
+| **Backup Operator** | Recovery Services vault | Discover protected items, list restore points, trigger restore operations, monitor restore jobs |
+| **Reader** | HANA VM resource group | Resolve target VM ARM IDs for cross-VM and filesystem restores |
+
+For identity setup, see [Setup Guide — Identity and Authorization](./SETUP.MD#4-identity-and-authorization).
+
+### 3. HANA Node Access
+
+- The management server must have SSH connectivity to all HANA DB hosts.
+- The `<sid>adm` user must be able to run `HDB stop`, `HDB start`, `sapcontrol`, and `hdbsql` commands.
+- For test case 3 (restore-to-filesystem), the target filesystem path must be writable.
+- For test case 5 (cross-VM restore), at least 2 HANA nodes must be in the inventory.
+
+## Configuration
+
+### 1. Update `vars.yaml`
+
+Set the test type to `AzureBackupDatabase`:
+
+```yaml
+TEST_TYPE:                  SAPFunctionalTests
+SAP_FUNCTIONAL_TEST_TYPE:   AzureBackupDatabase
+```
+
+### 2. Configure Backup Parameters
+
+Add the following variables to your system's `sap-parameters.yaml` file (under `WORKSPACES/SYSTEM/<SYSTEM_CONFIG_NAME>/`):
+
+```yaml
+# Required: Recovery Services vault resource ID
+backup_vault_resource_id:         "/subscriptions/xxxx/resourceGroups/my-backup-rg/providers/Microsoft.RecoveryServices/vaults/my-rsv-vault"
+
+# Required for restore test cases (2-5)
+backup_container_name:            "VMAppContainer;Compute;my-rg;hanavm01"
+backup_item_name:                 "saphanadatabase;h05;systemdb"
+
+# Required for filesystem restore (test case 3)
+backup_target_filesystem_path:    "/hana/backup/restore"
+
+# Required for cross-VM restore (test case 5)
+backup_target_container_name:     "VMAppContainer;Compute;my-rg;hanavm02"
+backup_target_database_name:      "SYSTEMDB"
+
+# Optional: point-in-time restore (ISO 8601 UTC timestamp)
+backup_restore_point_time:        ""
+```
+
+### 3. User-Assigned Managed Identity (Optional)
+
+If your management server uses a user-assigned managed identity, set the client ID in `vars.yaml`:
+
+```yaml
+user_assigned_identity_client_id: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+```
+
+If omitted or set to `null`, the framework uses system-assigned managed identity.
+
+## Test Execution
+
+Run the tests using the `sap_automation_qa.sh` script:
+
+```bash
+# Run all Azure Backup test cases
+./scripts/sap_automation_qa.sh --test_groups=BACKUP_DB_HANA
+
+# Run specific test cases
+./scripts/sap_automation_qa.sh --test_groups=BACKUP_DB_HANA --test_cases=[backup-setup-verification]
+./scripts/sap_automation_qa.sh --test_groups=BACKUP_DB_HANA --test_cases=[restore-to-db,restore-to-filesystem]
+./scripts/sap_automation_qa.sh --test_groups=BACKUP_DB_HANA --test_cases=[restore-cross-vm]
+
+# Run with verbose output
+./scripts/sap_automation_qa.sh --test_groups=BACKUP_DB_HANA -vv
+```
+
+### Via SAP QA Service API
+
+```bash
+# Create a job through the API
+./scripts/sap_automation_qa.sh job create --workspace DEV-WEEU-SAP01-X00 --test-group AzureBackupDatabase
+```
+
+## Viewing Test Results
+
+Test results are generated the same way as HA tests. Navigate to your workspace directory:
+
+```bash
+cd WORKSPACES/SYSTEM/<SYSTEM_CONFIG_NAME>/quality_assurance/
+```
+
+The HTML report summarises each test case with PASS/FAIL/SKIPPED status. For details on the report format, see [High Availability — Viewing Test Results](./HIGH_AVAILABILITY.md#viewing-test-results).

requirements.in

@@ -11,6 +11,7 @@ azure-kusto-ingest
 azure-mgmt-compute
 azure-mgmt-loganalytics
 azure-mgmt-network
+azure-mgmt-recoveryservicesbackup
 azure-storage-blob
 azure-storage-queue
 

requirements.txt

@@ -58,10 +58,13 @@ azure-mgmt-core==1.6.0
     #   azure-mgmt-compute
     #   azure-mgmt-loganalytics
     #   azure-mgmt-network
+    #   azure-mgmt-recoveryservicesbackup
 azure-mgmt-loganalytics==13.1.1
     # via -r requirements.in
 azure-mgmt-network==30.2.0
     # via -r requirements.in
+azure-mgmt-recoveryservicesbackup==10.0.0
+    # via -r requirements.in
 azure-storage-blob==12.26.0
     # via
     #   -r requirements.in

scripts/sap_automation_qa.sh

@@ -50,6 +50,11 @@ Examples:
   $0 --test_groups=HA_DB_HANA --test_cases=[ha-config,primary-node-crash] --extra-vars='{"key":"value"}'
   $0 --test_groups=HA_DB_HANA --test_cases=[ha-config] --offline
 
+  # Azure Backup Tests (set SAP_FUNCTIONAL_TEST_TYPE: AzureBackupDatabase in vars.yaml)
+  $0 --test_groups=BACKUP_DB_HANA --test_cases=[backup-setup-verification]
+  $0 --test_groups=BACKUP_DB_HANA --test_cases=[restore-to-db,restore-to-filesystem]
+  $0 --test_groups=BACKUP_DB_HANA -vv
+
   # Configuration Checks (requires TEST_TYPE: ConfigurationChecks in vars.yaml)
   $0 --extra-vars='{"configuration_test_type":"all"}'
   $0 --extra-vars='{"configuration_test_type":"high_availability"}'
@@ -82,6 +87,12 @@ Available Test Cases for groups:
 				kill-sapstartsrv-process => Kill SAP Start Service Process
 				manual-restart => Manual Restart
 				ha-failover-to-node => HA Failover to Secondary Node
+	$0 --test_groups=BACKUP_DB_HANA
+				backup-setup-verification => Azure Backup Setup Verification
+				restore-to-db => Restore Backup to HANA DB
+				restore-to-filesystem => Restore Backup to FileSystem
+				recover-db-commands => Recover DB using Database Commands
+				restore-cross-vm => Cross-VM Restore
 
 Configuration Checks (set TEST_TYPE: ConfigurationChecks in vars.yaml):
 	configuration_test_type options (use with --extra-vars):
@@ -270,6 +281,9 @@ get_playbook_name() {
                     echo "playbook_00_ha_scs_functional_tests"
                 fi
                 ;;
+            "AzureBackupDatabase")
+                echo "playbook_00_backup_db_functional_tests"
+                ;;
             "ConfigurationChecks")
                 echo "playbook_00_configuration_checks"
                 ;;