SAP Automation Pilot
SAP Automation Pilot is a hosted, event-triggerable command runner - it can drive a Jenkins server and run operational scripts - that stores reusable secrets as input keys and can reach on-prem via Cloud Connector. In effect it is a CI/CD-runner attack surface living inside BTP.
Automation Pilot concentrates stored secrets (input keys) and execution capability (commands, event triggers), and it can pivot to on-prem through Cloud Connector. A leaked service-account credential or an over-privileged Execute-holding role collection converts into command execution and secret access inside the tenant.
Automation Pilot stores reusable secrets as input keys - values flagged sensitive are stored encrypted and masked. Event-triggered execution (via SAP Alert Notification) runs under a dedicated service account holding the Execute permission and calling the command’s Event Trigger URL with Basic auth - the same role/permission model as direct execution, not a bypass of it. The abuse is therefore:
- Obtaining or leaking that service-account credential, or an over-privileged
Execute-holding role collection; - Reaching secrets stored in input keys.
Tests:
- Inventory input keys and review command definitions for embedded targets/credentials.
- Enumerate which service accounts / role collections hold
Execute. - Check for Event-Trigger-URL credentials in reachable config (iFlows, service keys, repos).
- Least-privilege role collections; do not grant
Executebroadly. - Store secrets only in (sensitive) input keys and rotate them.
- Restrict which events can trigger privileged commands.
- Threat-model Automation Pilot as CI/CD infrastructure with on-prem reach.
- Audit Automation Pilot command executions and input-key changes.
- Alert on privileged commands triggered by events.
- Subject to the BTP Audit Log’s coverage limits - see BTP Audit Blind Spots.