AWS + SAP on CloudThe Complete Interview Guide

Every senior AWS interview starts here. Do not just name the concepts — show why they matter when you design for real workloads.

🗺️Region vs Availability Zone

A Region is a cluster of data centers; an AZ is an isolated facility (or set of facilities) inside a Region with independent power, cooling, and networking. Multi-AZ gives you high availability inside a Region; multi-Region gives you disaster recovery across geographic boundaries and regulatory zones.

🤝Shared Responsibility Model

AWS secures the cloud (hardware, software, networking, physical facilities). You secure what you put in the cloud — data, IAM, encryption choices, network config, OS patching on EC2, and applications. Responsibilities shift for fully-managed services like RDS or Lambda.

🧭Well-Architected Pillars

• Operational Excellence — run and observe systems effectively
• Security — protect data, systems, and assets
• Reliability — recover from failure, scale, meet business requirements
• Performance Efficiency — use resources efficiently
• Cost Optimization — avoid unnecessary cost

Networking-for-SAP is where the role gets specific. Plan the packet path from user to SAP dialogue, and be ready to diagnose hops, firewalls, and DNS.

🌐VPC Building Blocks

• CIDR, public/private subnets, route tables, and Internet Gateway
• NAT Gateway / NAT instance for private subnets to reach the internet
• Security Groups (stateful, allow-only) vs NACLs (stateless, order matters)
• VPC Peering, Transit Gateway, and VPC Endpoints (PrivateLink)

🔗On-prem to AWS connectivity

IAM answers reflect whether you actually operate systems. Show you tighten access, rotate secrets, and encrypt at rest and in transit by default.

• Users, groups, roles, policies — attach roles to instances, never keys
• Least privilege + short-lived credentials via STS / SSO
• KMS for key management, S3 SSE/KMS, EBS encryption by default
• Secrets Manager for DB credentials and API keys
• CloudTrail + CloudWatch + GuardDuty for audit and detection

Know when to choose which engine, and how to right-size. Senior signal: name the trade-off, then the number.

• EC2 — control, lift-and-shift, SAP app + HANA (certified instance types)
• EBS — persistent block; gp3/io2; snapshots for backups/DR
• S3 — object storage lifecycle tiers; EFS/NFS for shared app data
• RDS — managed relational, automated backups, Multi-AZ
• Aurora — open-source-compatible clusters, 3 replicas, storage

This section is where an AWS and SAP candidate separates from a generalist. Talk real instances such as r8i.32xlarge (1TB HANA) and the certified configuration catalog.

📏SAP HANA sizing in one line

Measure your database size, project the in-memory need, double it for HANA's memory footprint, add OS and SAP overhead, then select the smallest certified instance that covers the load. Factor in SAPS and IOPS per vCPU and throughput per instance class — that gives you the right instance family (r8i / x-series) and the AZ.

If you are interviewing for a networking-for-SAP role, this section can close the deal. It is the classic 'design this' grid.

🔄HA — inside a Region

• HANA system replication (HSR) across two AZs
• Pacemaker cluster — SUSE SLES HA for SAP HANA
• Failover: primary → sync secondary with no data loss
• Split-brain prevention: fencing via replay / SBD with delayed wake time

🌍DR — across Regions

• Asynchronous HSR into a second Region
• Point-in-time restores from S3 (Backint)
• DNS / Global Acceleration for failover migration routing
• RPO ~5 min with async replication, RTO measured and tested — never assumed

• Tell me about yourself — 90-second arc: what, why, the outcome, the numbers.
• Tell me a migration you owned — pre-work, cutover, rollback, downtime number, post-go-live.
• What changed when a firewall silently dropped a SAP packet? — trace path, security group / ACL, rule order, log check.
• How do you handle a crisis at 2 AM? — calm, own it, communicate, rollback first, fix later.