SAP

AWS gives its ERP agent deny-by-default rules and a separate identity