AWS Config for compliance - Time & Space Complexity
We want to understand how the time to check compliance using AWS Config changes as we add more resources.
Specifically, how does the number of compliance checks grow when the number of resources increases?
Analyze the time complexity of the following AWS Config rule evaluation process.
aws configservice put-config-rule --config-rule file://rule.json
aws configservice describe-compliance-by-config-rule --config-rule-name MyRule
aws configservice get-compliance-details-by-config-rule --config-rule-name MyRule
This sequence sets a compliance rule, then checks compliance status for all resources against that rule.
Identify the API calls, resource provisioning, data transfers that repeat.
- Primary operation: Compliance evaluation of each resource against the rule.
- How many times: Once per resource in the account.
As the number of resources grows, AWS Config must evaluate each resource against the compliance rule.
| Input Size (n) | Approx. Api Calls/Operations |
|---|---|
| 10 | 10 compliance evaluations |
| 100 | 100 compliance evaluations |
| 1000 | 1000 compliance evaluations |
Pattern observation: The number of compliance checks grows directly with the number of resources.
Time Complexity: O(n)
This means the time to check compliance grows in a straight line as you add more resources.
[X] Wrong: "Adding more resources won't affect compliance check time because AWS Config handles it instantly."
[OK] Correct: Each resource must be individually checked, so more resources mean more work and more time.
Understanding how compliance checks scale helps you design systems that stay efficient as they grow.
"What if we added multiple compliance rules instead of one? How would the time complexity change?"