Resilience: HA, DR & Service Levels for SAP

Your SAP stack has an app server at 99.5% and a HANA DB across AZs at 99.99%. A colleague says the composite SLA is 99.5% (the weakest link). Why is that wrong, and which way does the real number move?

The business signed for 99.95% S/4HANA uptime. Your AWS infrastructure SLAs all clear that bar. Why can you still breach the business-uptime SLA, and what closes the gap?

Name the four single-region HA/DR patterns for SAP and the one property that separates the 99.5% pair from the 99.99% / ~0-RPO pair.

If a single AWS transit center inside a region fails, do instances in one AZ lose connectivity to another AZ? Why or why not, and what does the answer let you trust?

An auditor asks who is accountable when S/4HANA is unavailable: AWS's service SLA or the MSP's SLA. How do the two differ in scope, and which one covers a misconfiguration outage?

You have a tightly integrated SAP system group (ERP, BW, CRM, SRM, GTS). Every per-system RPO is met on failover, yet finance reports cross-system data is inconsistent. Which objective did you miss, and what does it demand?

An architect quotes the EC2 99.99% region SLA to justify running SAP Central Services on one instance. Why is that a misread of what the 99.99% covers, and what SLA does the lone instance actually carry?

A holiday outage costs $1,000/hour in lost revenue on a service that bills $100/month. How much does the AWS SLA credit return, and what's the lesson about using credits as a risk hedge?

If you declare a single landscape RTO of 2 hours, what does that commit you to for every production system — and why might tiering RPO/RTO instead (e.g. Solution Manager at RTO 6h) be the smarter call?

You replicate SAP backups cross-region for ransomware protection but keep them in the same AWS account with normal delete permissions. Why is that still exposed, and what must you add?

You're pinning a primary and DR account to different physical AZs. Why is matching on AZ name (us-east-1a) unsafe across accounts, and what do you use instead?

99.5%, 99.95%, 99.99% — match each to its monthly downtime budget, and say what the number does and does NOT promise.

A stakeholder says they'll 'increase the system's reliability' next quarter. Why can't you engineer reliability directly, and what do you actually build instead?

Two questions decide single- vs multi-region for an SAP landscape. What are they, and when does a 'yes' on either force multi-region?

Order the three multi-region DR patterns for SAP cheapest to most resilient, and name the one property that drops RTO into the sub-2-hour range.

A vendor markets an SAP HA cluster as 'fault tolerant.' Which single property would prove it's actually only highly available, not fault tolerant?

What availability SLAs do the core AWS services for SAP provide, single-AZ vs multi-AZ?

When data residency keeps you in one region with a small DR-distance requirement, what replication mode does that unlock, and what's the resulting RPO advantage over multi-region?

You've built a second region for SAP DR. Is it now safe to run the primary region single-AZ since DR covers failures? Why or why not?

Most SAP SPOFs are protected by adding EC2 instances. For shared storage and load balancers specifically, why is 'add another EC2' the wrong answer, and what do you use instead?

What fault-tolerant behaviors do SAP systems provide out of the box, and where do these stop — i.e. what do they NOT cover?

A plan sets MTD = RTO exactly. Why is that a mistake, and what is MTD supposed to contain that RTO doesn't?

Your SAP DR mandates a large minimum distance (e.g. > 500 mi). What does that distance force about replication mode, and what RPO must you then accept?

Pacemaker guards your SAP HANA cluster, yet a stalled HANA instance never triggered a failover. What blind spot does Pacemaker have, and how do you remediate a 'stalled-but-not-failed' state?

Your multi-AZ HA setup evenly spreads SAP app servers across two AZs and one AZ fails over cleanly. Why can users still see degraded service, and what automation fixes it?

Can you just point standard AWS autoscaling at SAP application servers to handle load spikes? Why or why not, and what's the better approach?

Explain how EC2 auto-recovery actually recovers an SAP instance: at what layer, what stays the same about the instance, what is lost, and what pairs with it to make real HA?

Before committing SAP HANA to synchronous cross-AZ replication, what latency precondition must hold, and how do you verify which AZs qualify?

Name the single points of failure in an SAP system you must protect on AWS. Which one, if omitted, silently leaves lock management a SPOF even when DB and app servers are HA?

Under the shared-responsibility split, platform availability is the part you control least. What are the main mechanisms AWS uses behind the scenes to raise it?

A teammate dismisses SLAs as 'just a financial construct — penalties are money, so don't architect around them.' What is an SLA actually specifying, and what should you look at beyond the published number?

Why is 'we accidentally shut down the wrong SAP server for a few minutes — no big deal' a dangerous attitude for a production landscape on AWS?

When you split ownership of SAP reliability on AWS, which of the three building blocks is the provider's job and which two are yours — and why does that boundary matter?

Two Well-Architected reliability principles are easy to confuse: one makes recovery efficient, the other proves it works. Name both, and give the caveat each carries for SAP.

Your country mandates that SAP data never leave its borders, but AWS has no region there. What AWS option remains, and what's the critical catch for SAP specifically?

A colleague argues that co-locating SAP HA nodes in one region is risky because 'a region is just one big data center that can fail as a unit.' What is wrong about how AWS actually builds a region, and what design principle backs it up?

Your CIO wants to 'match AWS's reliability numbers' before choosing a cloud region for SAP. Why is comparing provider metrics the wrong first step, and what actually makes up reliability?

A stakeholder says 'we need the SAP system highly available — an RTO of 1 hour and RPO of 15 minutes.' Why is that sentence self-contradictory, and how do HA and DR metrics actually split?

During a DR failover you try to launch your standby SAP EC2 instances in the recovery AZ and some fail to start for lack of capacity. What did the DR design forget, and what guarantees a launch?

You built SAP HA with a Pacemaker cluster on EC2, but during a node failure both the cluster and AWS try to bring the instance back and the failover behaves erratically. What default EC2 behavior collided with your cluster, and what should you do?

Subnets are scoped to a single AZ, so when your SAP HA pair spans two AZs, how do end users keep reaching whichever node is currently active without changing their connection?

For a multi-region SAP DR setup, why does AWS recommend a different replication tool for the database EC2 instances than for the application-tier EC2 instances?

Beyond the headline 99.5% / 99.99% numbers, what fine print in the EC2 SLA surprises people — on account scope, how credits trigger, what's excluded, and what does NOT raise the number?

Your SAP frontend and app tier are fully HA, but the team saved money by mounting a 99.9% NFS instead of a four-nines shared file system. Why does that one choice cap the whole system, and what rule does it violate?

Why can't you reach 99.99% application uptime for SAP just by selecting AWS services that individually carry high SLAs?

You manage dozens of SAP-related AWS accounts and want one consistent backup definition across EC2, EBS, EFS, S3, and SAP HANA. Which AWS Organizations capability gives you that, and what's its scope?

In the shared-responsibility model for an SAP system on AWS, where exactly does AWS's ownership stop and yours begin?

During a full region failure, your DR runbook depends on calling APIs to create new resources in the recovery region. Why is that a fragile assumption, and what should DR failover rely on instead?

A manager frames SAP DR as 'making sure our infrastructure survives an earthquake.' Why is that framing off, and what is DR really protecting?

How does a familiar on-premises SAP HA/DR layout — two halls in one site plus a distant DR site — translate into AWS constructs?

For Tier 0 core services like DNS, AD, and LDAP, how does the deployment footprint differ between a single-region and a multi-region SAP pattern?

You're standing up the AWS foundation for an SAP landscape that needs aggressive MTTR/RPO/RTO/RCO. What does that resiliency ambition imply for the landing zone itself, and which service configures it?

You picked a pilot-light DR strategy for SAP a year ago; now the business wants faster recovery. On AWS, how locked-in is that original choice?

In a single-region SAP design on AWS, which classes of failure recover automatically versus which force a human into the recovery path? Give the dividing line.

You want to build your own HA orchestration for SAP on AWS instead of buying a cluster product. What does SAP actually give you to do this, and who owns support for what you build?

For a fully-supported SAP HA cluster on AWS, whose certification and whose support desk do you actually need? Name the recommended vendors.

You're lifting an SAP landscape to AWS that runs its HA on HPE Serviceguard (and one system on Oracle RAC). Why can't you keep that design, and what must you do?

What is AWS Elastic Disaster Recovery (DRS) doing under the hood for SAP, does it need SAP certification, and why would you still pair it with database-native replication?

A team proposes a single-host 'standard' SAP deployment for production to save money. What does the standard pattern actually buy you, why is distributed only marginally safer, and where does either belong?

SAP Central Services holds the enqueue (lock) server as a SPOF. In a multi-AZ HA design on AWS, what specific component removes that SPOF and where does it live?

In a multi-AZ HA layout for a NetWeaver system, work processes inside the PAS are already fault tolerant. So why is a single PAS still a SPOF, and what removes it — plus which two extra components appear once SAP Fiori is in play?

After spreading SAP app servers across AZs for HA, batch jobs suddenly run longer. What's the mechanism, and what SAP feature keeps critical jobs fast?

For ASCS failover on AWS, contrast the 'manual failover with automated alerts' option against the fully automated one. What triggers each, and what does automation actually replace?

On-prem SAP clusters use a floating/VIP address that moves between nodes. Why does that not work across AZs on AWS, and what mechanism replaces it?

You configured an overlay IP for HA ASCS, but on-prem users over Direct Connect can't reach it. Why, and how do you make the overlay IP reachable from outside the VPC?

Planning overlay IPs for a landscape of clustered SAP systems, how many private IPs does one system consume, and how should you keep track across many systems?

In a Linux SAP cluster, the overlay IP is repointed to the active node by an EC2 API call to the route table. What's the security risk in that, and how is it mitigated?

SAP Web Dispatcher is a SPOF in a Fiori landscape. What are the three ways to make it HA, and which does SAP recommend and why?

Does SAP Cloud Connector need an external clustering product for HA on AWS? Explain what it does on its own and what the unsupported alternative is.

SAP Content Server ships as a single-instance component. Why is that a problem for an archiving-critical landscape, and how do you make it HA on AWS?

For SAP application-server DR on AWS, compare AMI-copy (cold) against warm/hot provisioning. What does each keep running, and what's the trick to shrink cold-DR RTO?

Rank cold, warm/hot, and AWS DRS DR for SAP application servers by cost and by RPO/RTO. Which one is the cost-vs-recovery sweet spot?

An architect wants to rely on EC2 auto-recovery as the HA story for a production SAP database. List the hard limits that make that unsafe on its own.

Your production SAP HANA database already runs under a Pacemaker cluster. Why is turning on EC2 auto-recovery 'for extra safety' a mistake, and where is it appropriate?

Someone plans to protect an SAP database by restoring EBS snapshots. What consistency guarantee do raw EBS snapshots give, and what must you do to make them safe for a database?

Why is a snapshot-based strategy uncommon for HA (as opposed to DR), and what two costs does it impose if you push it there anyway?

For a low-cost SAP HANA backup/restore HA-DR design on AWS, what is provisioned in the standby AZ, where do backups land, and what determines the RPO?

SAP HANA has huge disks and a high change rate. What does that force you to validate before trusting AWS DRS for it, and what testing and failback tooling does DRS give you?

Rank the SAP HANA multi-AZ HA options from cost-optimized to downtime-optimized (Table 5.4), and say what you trade at each rung.

You need out-of-region DR for SAP HANA on top of multi-AZ HA. Which two HANA patterns extend across regions, and how do their DR RPO/RTO differ?

AWS recommends multi-AZ for SAP HANA HA, but a team wants both primary and secondary in a single AZ. What do they gain, what do they gamble, and what's the non-negotiable fallback?

You chose a cost-optimized SAP HANA HA design with a smaller secondary. What availability risk hides in that choice for a large database, and how can an MCOS setup neutralize it?

A team with limited HA skills wants to deploy Pacemaker clustering for their SAP databases 'because it's the gold standard.' Why might that reduce availability, and what are the simpler alternatives?

EC2 host auto-recovery replaced your impaired SAP instance on new hardware, but the SAP application is still down. Why, and what automation closes the gap?