CloudTrail for API auditing in AWS - Time & Space Complexity
When using CloudTrail to audit API calls, it's important to understand how the number of recorded events grows as more API activity happens.
We want to know how the work CloudTrail does changes when more API calls are made.
Analyze the time complexity of the following operation sequence.
aws cloudtrail create-trail --name MyTrail --s3-bucket-name my-bucket
aws cloudtrail start-logging --name MyTrail
# API calls happen in the account
# CloudTrail records each API call event
aws cloudtrail lookup-events --max-results 50
This sequence creates a trail, starts logging API calls, and then queries the recorded events.
- Primary operation: Recording each API call event by CloudTrail.
- How many times: Once per API call made in the account.
As the number of API calls increases, CloudTrail records more events, so the work grows with the number of calls.
| Input Size (n) | Approx. API Calls/Operations |
|---|---|
| 10 | 10 event records created |
| 100 | 100 event records created |
| 1000 | 1000 event records created |
Pattern observation: The number of recorded events grows directly with the number of API calls.
Time Complexity: O(n)
This means the work CloudTrail does grows linearly as more API calls happen.
[X] Wrong: "CloudTrail records all API calls instantly without extra work as calls increase."
[OK] Correct: Each API call generates a new event to record, so more calls mean more work for CloudTrail.
Understanding how logging scales with activity helps you design systems that monitor usage efficiently and predict costs.
"What if CloudTrail was configured to log only specific API calls? How would that affect the time complexity?"