Policy assignments and compliance in Azure - Time & Space Complexity
We want to understand how the time to check policy compliance changes as we assign policies to more resources.
How does the number of policy assignments affect the work Azure does to check compliance?
Analyze the time complexity of the following operation sequence.
// Assign a policy to multiple resources
for (let resource of resources) {
await client.policyAssignments.create({
scope: resource.id,
policyDefinitionId: policyId
});
}
// Check compliance state for each assignment
for (let assignment of policyAssignments) {
await client.policyStates.listQueryResultsForResource(assignment.scope);
}
This sequence assigns a policy to many resources and then checks compliance for each assignment.
Identify the API calls, resource provisioning, data transfers that repeat.
- Primary operation: Creating policy assignments and querying compliance states.
- How many times: Once per resource for assignment and once per assignment for compliance check.
As the number of resources grows, the number of API calls grows roughly the same way.
| Input Size (n) | Approx. Api Calls/Operations |
|---|---|
| 10 | About 20 calls (10 assignments + 10 compliance checks) |
| 100 | About 200 calls (100 assignments + 100 compliance checks) |
| 1000 | About 2000 calls (1000 assignments + 1000 compliance checks) |
Pattern observation: The total work grows linearly with the number of resources.
Time Complexity: O(n)
This means the time to assign policies and check compliance grows directly in proportion to the number of resources.
[X] Wrong: "Assigning one policy to many resources is a single operation and takes the same time regardless of resource count."
[OK] Correct: Each resource requires a separate assignment and compliance check, so time grows with the number of resources.
Understanding how policy assignments scale helps you design efficient governance in cloud environments and shows you can think about system behavior as it grows.
"What if we batch policy assignments instead of assigning one by one? How would the time complexity change?"