Custom role definitions in Azure - Time & Space Complexity

Time Complexity: Custom role definitions

O(n)

Understanding Time Complexity

When creating custom role definitions in Azure, it's important to understand how the time to create or update roles changes as you add more permissions.

We want to know how the number of permissions affects the time it takes to manage these roles.

Scenario Under Consideration

Analyze the time complexity of defining a custom role with multiple permissions.

// Define a custom role with a list of permissions
az role definition create --role-definition '{
  "Name": "CustomRole",
  "Description": "Role with specific permissions",
  "Actions": ["Microsoft.Compute/virtualMachines/start/action", "Microsoft.Storage/storageAccounts/read", "..."],
  "AssignableScopes": ["/subscriptions/xxxx-xxxx-xxxx"]
}'
    

This sequence creates a custom role by specifying a list of allowed actions (permissions).

Identify Repeating Operations

Look at what happens repeatedly when creating or updating a role with many permissions.

• Primary operation: Processing each permission in the Actions list to validate and store it.
• How many times: Once per permission in the list.

How Execution Grows With Input

As you add more permissions, the system checks and stores each one individually.

Input Size (n)	Approx. API Calls/Operations
10	About 10 permission checks and stores
100	About 100 permission checks and stores
1000	About 1000 permission checks and stores

Pattern observation: The time grows roughly in direct proportion to the number of permissions.

Final Time Complexity

Time Complexity: O(n)

This means the time to create or update a custom role grows linearly with the number of permissions you include.

Common Mistake

[X] Wrong: "Adding more permissions won't affect the time much because it's just one role creation call."

[OK] Correct: Each permission must be processed individually, so more permissions mean more work behind the scenes.

Interview Connect

Understanding how the number of permissions affects role creation time helps you design efficient access controls and shows you can think about system behavior as it scales.

Self-Check

What if we batch multiple role definitions in one request? How would the time complexity change?