Stateless behavior of NACLs in AWS - Time & Space Complexity

Time Complexity: Stateless behavior of NACLs

O(n)

Understanding Time Complexity

We want to understand how the number of checks grows when network traffic passes through Network ACLs (NACLs).

Specifically, how many rule evaluations happen as more packets flow through.

Scenario Under Consideration

Analyze the time complexity of NACL rule evaluations for incoming and outgoing packets.

// Example NACL rules evaluation for each packet
for each packet in network_traffic:
  check inbound rules for packet
  if allowed:
    forward packet
  check outbound rules for response packet
  if allowed:
    forward response

This sequence shows how NACLs check rules for both incoming and outgoing packets separately because they are stateless.

Identify Repeating Operations

Each packet causes these repeated operations:

• Primary operation: Rule checks on inbound and outbound traffic.
• How many times: Twice per packet (once inbound, once outbound).

How Execution Grows With Input

As the number of packets increases, the number of rule checks grows proportionally.

Input Size (n packets)	Approx. Rule Checks
10	20
100	200
1000	2000

Pattern observation: The total checks double the number of packets because each packet is checked twice.

Final Time Complexity

Time Complexity: O(n)

This means the number of rule checks grows directly in proportion to the number of packets passing through.

Common Mistake

[X] Wrong: "NACLs only check rules once per connection, so rule checks stay constant regardless of traffic."

[OK] Correct: NACLs are stateless, so they check every packet separately, causing rule checks to grow with traffic volume.

Interview Connect

Understanding how stateless checks scale helps you explain network security behavior clearly and confidently in real-world cloud roles.

Self-Check

"What if NACLs were stateful and tracked connections? How would the time complexity of rule checks change?"