Azure Policy for governance - Time & Space Complexity

Time Complexity: Azure Policy for governance

O(n)

Understanding Time Complexity

We want to understand how the time to apply Azure Policy changes as we add more resources.

How does the number of resources affect the policy evaluation time?

Scenario Under Consideration

Analyze the time complexity of assigning a policy to a subscription and evaluating it.

# Assign a policy definition to a subscription
az policy assignment create \
  --name "enforce-tag" \
  --policy "require-tag" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# Azure evaluates the policy against all resources in the subscription
# and marks non-compliant resources

This sequence assigns a policy and triggers evaluation on all subscription resources.

Identify Repeating Operations

Look at what happens repeatedly when the policy runs.

• Primary operation: Policy evaluation on each resource.
• How many times: Once per resource in the subscription.

How Execution Grows With Input

As the number of resources grows, the policy evaluation runs on each one.

Input Size (n)	Approx. API Calls/Operations
10	10 evaluations
100	100 evaluations
1000	1000 evaluations

Pattern observation: The number of evaluations grows directly with the number of resources.

Final Time Complexity

Time Complexity: O(n)

This means the time to evaluate policies grows in direct proportion to the number of resources.

Common Mistake

[X] Wrong: "Policy evaluation time stays the same no matter how many resources there are."

[OK] Correct: Each resource must be checked, so more resources mean more work and longer evaluation time.

Interview Connect

Understanding how policy evaluation scales helps you design governance that stays efficient as your cloud grows.

Self-Check

"What if we assigned the policy at a resource group level instead of subscription? How would the time complexity change?"

Practice

1. What is the main purpose of Azure Policy in cloud governance?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To enforce rules and ensure resources comply with organizational standards

D. To backup data to external storage

Solution

1. Step 1: Understand Azure Policy's role

   Azure Policy is designed to enforce rules on resources to keep them compliant with company rules.

2. Step 2: Compare options to this role

   Only To enforce rules and ensure resources comply with organizational standards describes enforcing rules and compliance, which matches Azure Policy's purpose.

3. Final Answer:

   To enforce rules and ensure resources comply with organizational standards -> Option C

4. Quick Check:

   Azure Policy = Enforce rules [OK]

Hint: Azure Policy controls rules, not resource creation [OK]

Common Mistakes:

• Confusing Azure Policy with Azure Monitor
• Thinking Azure Policy creates resources
• Mixing Azure Policy with backup services

2. Which JSON element is required to specify the action Azure Policy should take when a rule is violated?

easy

A. "effect"

B. "then"

C. "if"

D. "condition"

Solution

1. Step 1: Identify the JSON structure of Azure Policy

   Azure Policy uses "if" to define conditions and "then" to specify what happens, but the specific action is defined by "effect".

2. Step 2: Confirm the element that defines the action

   The "effect" element tells Azure Policy what to do, like deny or audit, when the condition is met.

3. Final Answer:

   "effect" -> Option A

4. Quick Check:

   Action in Azure Policy = effect [OK]

Hint: "effect" defines the action in Azure Policy JSON [OK]

Common Mistakes:

• Confusing "then" with the action element
• Using "condition" instead of "if"
• Missing the "effect" element entirely

3. Given this Azure Policy snippet, what will happen if a storage account is created without encryption enabled?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": false
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The storage account creation will be allowed without encryption

B. The storage account creation will be denied

C. The policy will audit the storage account but allow creation

D. The policy will ignore the encryption setting

Solution

1. Step 1: Analyze the condition in the policy

   The policy checks if encryption.enabled is false (not enabled).

2. Step 2: Understand the effect when condition matches

   The effect is "deny", so if encryption is false, creation is blocked.

3. Final Answer:

   The storage account creation will be denied -> Option B

4. Quick Check:

   Condition false + effect deny = block creation [OK]

Hint: "deny" effect blocks resource creation if condition true [OK]

Common Mistakes:

• Thinking "deny" allows creation but logs it
• Confusing "deny" with "audit" effect
• Ignoring the condition check on encryption

4. You wrote this Azure Policy but it does not block unencrypted storage accounts as expected. What is the error?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": "false"
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The value "false" should be a boolean false, not a string

B. The "effect" should be "audit" instead of "deny"

C. The "field" name is incorrect for encryption

D. The policy is missing a "parameters" section

Solution

1. Step 1: Check the data type of the "equals" value

   The policy uses "equals": "false" which is a string, but encryption.enabled is a boolean.

2. Step 2: Correct the data type to boolean

   Changing "false" (string) to false (boolean) fixes the condition to match properly.

3. Final Answer:

   The value "false" should be a boolean false, not a string -> Option A

4. Quick Check:

   Boolean false, not string "false" fixes policy [OK]

Hint: Use boolean false, not string "false" in conditions [OK]

Common Mistakes:

• Using string "false" instead of boolean false
• Changing effect to audit instead of deny
• Assuming field name is wrong without checking

5. You want to create an Azure Policy that audits virtual machines which do not have a specific tag named "Environment". Which effect should you use to only report non-compliance without blocking resource creation?

hard

A. "deny"

B. "deployIfNotExists"

C. "append"

D. "audit"

Solution

1. Step 1: Understand the requirement to report but not block

   You want to find resources missing the tag but still allow creation.

2. Step 2: Identify the effect that audits without blocking

   The "audit" effect reports non-compliance but does not prevent resource creation.

3. Step 3: Compare other effects

   "deny" blocks creation, "append" adds properties, "deployIfNotExists" deploys resources, none just audit.

4. Final Answer:

   "audit" -> Option D

5. Quick Check:

   Audit effect reports without blocking [OK]

Hint: Use "audit" to report issues without blocking [OK]

Common Mistakes:

• Using "deny" which blocks resource creation
• Confusing "append" with audit
• Choosing "deployIfNotExists" which deploys resources