BTP & Integrationadvanced

BTP HANA Cloud Part 3: Connectivity, Security and User Management

Key takeaway

Secure HANA Cloud in depth: database users vs HDI container users, roles and privileges, avoiding DBADMIN for daily work, TLS connections, connecting to on-premise data via remote sources and Cloud Connector, auditing, and troubleshooting access errors.

Explanation

📌 KEY POINTS
✅ DBADMIN is for initial setup only; create admin users with specific roles and personal accountability.
✅ Apps use HDI container technical users from bindings — never personal database users.
✅ Grant access via roles (and HDI grantor services for cross-container access).
✅ Connections are TLS-encrypted; on-premise sources can be reached via remote sources and Cloud Connector.
⚠️ "Insufficient privilege" errors should be fixed with targeted roles, not by granting broad admin privileges.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 2 provisioned HANA Cloud. Now security.

━━━━━━━━━━━━━━━━━━━━
▶ 1. ADMIN USERS

DBADMIN restricted; named admins.

━━━━━━━━━━━━━━━━━━━━
▶ 2. APP ACCESS

HDI users from bindings.

━━━━━━━━━━━━━━━━━━━━
▶ 3. ROLES & GRANTS

Database roles; cross-container grants.

━━━━━━━━━━━━━━━━━━━━
▶ 4. CONNECTIVITY

TLS; remote sources via Cloud Connector.

━━━━━━━━━━━━━━━━━━━━
▶ 5. AUDITING

Audit policies for sensitive actions.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Create a named admin user with roles.
Check app access via HDI binding.
Configure an audit policy.

✅ CHECKPOINT: no daily work runs as DBADMIN.

Code example

ABAP Code

===== USERS =====CREATE USER ops_admin PASSWORD "..." NO FORCE_FIRST_PASSWORD_CHANGE;GRANT <admin role> TO ops_admin;   -- named, least privilegeApp: HDI container runtime user (from binding) — no manual user ===== AUDIT =====CREATE AUDIT POLICY sensitive_reads AUDITING SUCCESSFUL SELECT ON sales.customers LEVEL INFO;ALTER AUDIT POLICY sensitive_reads ENABLE;

Real project scenario

An integration team deployed an app that used DBADMIN credentials in a destination. An audit flagged it. Replacing it with HDI bindings and named admin users closed the finding.

Common mistakes

DBADMIN in apps.
Broad grants.
No audit.
Personal users in apps.
Unencrypted connections.

Best practices

Named admins.
HDI bindings.
Targeted roles.
Audit policies.
TLS always.

Interview angle

Questions: "How should apps access HANA Cloud?", "What do you do with DBADMIN?", "How do you connect on-premise data?"
Strong answer: admin users, HDI access, roles, connectivity, auditing.

Practice this lesson

Quick check

1. How should applications access HANA Cloud data?

2. An app used DBADMIN credentials in a destination. What is the correct remediation?

3. Users get "insufficient privilege" errors in HANA Cloud. What is the right approach?

Interview questions

1. A production issue is reported in HANA Cloud. What would you check first, and how would you troubleshoot it systematically?

Answer it in your own words first, then compare.

2. Suppose you inherit an existing HANA Cloud solution. How would you review it before making a change?