Custom role definitions in Azure - Time & Space Complexity

Time Complexity: Custom role definitions

O(n)

Understanding Time Complexity

When creating custom role definitions in Azure, it's important to understand how the time to create or update roles changes as you add more permissions.

We want to know how the number of permissions affects the time it takes to manage these roles.

Scenario Under Consideration

Analyze the time complexity of defining a custom role with multiple permissions.

// Define a custom role with a list of permissions
az role definition create --role-definition '{
  "Name": "CustomRole",
  "Description": "Role with specific permissions",
  "Actions": ["Microsoft.Compute/virtualMachines/start/action", "Microsoft.Storage/storageAccounts/read", "..."],
  "AssignableScopes": ["/subscriptions/xxxx-xxxx-xxxx"]
}'
    

This sequence creates a custom role by specifying a list of allowed actions (permissions).

Identify Repeating Operations

Look at what happens repeatedly when creating or updating a role with many permissions.

• Primary operation: Processing each permission in the Actions list to validate and store it.
• How many times: Once per permission in the list.

How Execution Grows With Input

As you add more permissions, the system checks and stores each one individually.

Input Size (n)	Approx. API Calls/Operations
10	About 10 permission checks and stores
100	About 100 permission checks and stores
1000	About 1000 permission checks and stores

Pattern observation: The time grows roughly in direct proportion to the number of permissions.

Final Time Complexity

Time Complexity: O(n)

This means the time to create or update a custom role grows linearly with the number of permissions you include.

Common Mistake

[X] Wrong: "Adding more permissions won't affect the time much because it's just one role creation call."

[OK] Correct: Each permission must be processed individually, so more permissions mean more work behind the scenes.

Interview Connect

Understanding how the number of permissions affects role creation time helps you design efficient access controls and shows you can think about system behavior as it scales.

Self-Check

What if we batch multiple role definitions in one request? How would the time complexity change?

Practice

1. What is the main purpose of creating a custom role definition in Azure?

easy

A. To tailor permissions exactly to specific needs

B. To delete all existing roles in Azure

C. To automatically assign roles to all users

D. To create virtual machines quickly

Solution

1. Step 1: Understand role customization

   Custom roles allow you to specify exactly which permissions are granted or denied, unlike built-in roles which are fixed.

2. Step 2: Identify the purpose of custom roles

   They help tailor permissions to fit specific needs, improving security and control.

3. Final Answer:

   To tailor permissions exactly to specific needs -> Option A

4. Quick Check:

   Custom roles = tailored permissions [OK]

Hint: Custom roles = tailor permissions to your needs [OK]

Common Mistakes:

• Thinking custom roles delete existing roles
• Assuming custom roles auto-assign to all users
• Confusing custom roles with VM creation

2. Which JSON property is required to specify the permissions allowed in a custom role definition?

easy

A. "NotActions"

B. "Actions"

C. "allowedActions"

D. "permissions"

Solution

1. Step 1: Review custom role JSON structure

   The property "Actions" lists the allowed operations in the role definition.

2. Step 2: Differentiate from other properties

   "NotActions" lists denied permissions, "permissions" is a container but not the direct property, and "allowedActions" is not a valid property.

3. Final Answer:

   "Actions" -> Option B

4. Quick Check:

   Allowed permissions = "Actions" [OK]

Hint: Allowed permissions are under "Actions" in JSON [OK]

Common Mistakes:

• Using "allowedActions" which is invalid
• Confusing "NotActions" with allowed permissions
• Mistaking "permissions" as direct actions list

3. Given this snippet of a custom role JSON:

{
  "Name": "Storage Reader",
  "Actions": ["Microsoft.Storage/storageAccounts/read"],
  "NotActions": []
}

What permission does this role grant?

medium

A. No permissions at all

B. Full control over storage accounts

C. Write access to storage accounts

D. Read access to storage accounts

Solution

1. Step 1: Analyze the "Actions" property

   The action "Microsoft.Storage/storageAccounts/read" grants read-only access to storage accounts.

2. Step 2: Check "NotActions" property

   It is empty, so no permissions are excluded.

3. Final Answer:

   Read access to storage accounts -> Option D

4. Quick Check:

   Action includes "read" = read access [OK]

Hint: Look for "read" in actions for read-only permission [OK]

Common Mistakes:

• Assuming full control from read action
• Confusing read with write permissions
• Ignoring empty NotActions meaning no exclusions

4. You created a custom role but users report they cannot perform allowed actions. Which is the most likely error in the role definition?

medium

A. Role description is missing

B. "Actions" property is missing or empty

C. "NotActions" includes the same actions as "Actions"

D. Role name is too long

Solution

1. Step 1: Understand "NotActions" effect

   "NotActions" excludes permissions even if listed in "Actions".

2. Step 2: Identify conflict in permissions

   If "NotActions" includes the same actions as "Actions", those permissions are denied, causing users to lack access.

3. Final Answer:

   "NotActions" includes the same actions as "Actions" -> Option C

4. Quick Check:

   Conflicting "NotActions" denies permissions [OK]

Hint: "NotActions" overrides "Actions" if overlapping [OK]

Common Mistakes:

• Ignoring "NotActions" effect
• Thinking role name or description affects permissions
• Assuming missing "Actions" is common

5. You want to create a custom role that allows users to start and stop virtual machines but denies deleting them. Which JSON snippet correctly defines this?

hard

A. { "Actions": ["Microsoft.Compute/virtualMachines/*"], "NotActions": ["Microsoft.Compute/virtualMachines/delete"] }

B. { "Actions": ["Microsoft.Compute/virtualMachines/start"], "NotActions": ["Microsoft.Compute/virtualMachines/delete"] }

C. { "Actions": ["Microsoft.Compute/virtualMachines/start", "Microsoft.Compute/virtualMachines/delete"], "NotActions": [] }

D. { "Actions": ["Microsoft.Compute/virtualMachines/delete"], "NotActions": ["Microsoft.Compute/virtualMachines/start"] }

Solution

1. Step 1: Identify required permissions

   Users need to start and stop VMs, so all VM actions except delete are allowed.

2. Step 2: Check each option

   { "Actions": ["Microsoft.Compute/virtualMachines/*"], "NotActions": ["Microsoft.Compute/virtualMachines/delete"] } allows all VM actions with "*" but denies delete explicitly, matching requirements perfectly.

3. Step 3: Eliminate incorrect options

   { "Actions": ["Microsoft.Compute/virtualMachines/start"], "NotActions": ["Microsoft.Compute/virtualMachines/delete"] } misses stop (deallocate) action; { "Actions": ["Microsoft.Compute/virtualMachines/start", "Microsoft.Compute/virtualMachines/delete"], "NotActions": [] } allows delete; { "Actions": ["Microsoft.Compute/virtualMachines/delete"], "NotActions": ["Microsoft.Compute/virtualMachines/start"] } denies start but allows delete.

4. Final Answer:

   { "Actions": ["Microsoft.Compute/virtualMachines/*"], "NotActions": ["Microsoft.Compute/virtualMachines/delete"] } -> Option A

5. Quick Check:

   Allow all except delete = Actions with * and NotActions delete [OK]

Hint: Use wildcard * in Actions and exclude delete in NotActions [OK]

Common Mistakes:

• Missing stop (deallocate) action
• Allowing delete action by mistake
• Denying start action instead of delete