Bird
Raised Fist0
GCPcloud~5 mins

Access control (IAM vs ACLs) in GCP - Performance Comparison

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Time Complexity: Access control (IAM vs ACLs)
O(n)
Understanding Time Complexity

When managing access in cloud systems, it is important to understand how the time to check permissions grows as more users or resources are added.

We want to know how the system handles many access checks efficiently.

Scenario Under Consideration

Analyze the time complexity of checking access permissions using IAM roles versus ACLs.

// Pseudocode for access check
function checkAccess(user, resource) {
  // IAM check
  roles = getUserRoles(user)
  permissions = getPermissionsFromRoles(roles, resource)
  if (permissions.allow) return true

  // ACL check
  aclEntries = getAclEntries(resource)
  for (entry in aclEntries) {
    if (entry.user == user && entry.permission == 'allow') {
      return true
    }
  }
  return false
}

This sequence checks if a user has access to a resource first by IAM roles, then by ACL entries.

Identify Repeating Operations

Identify the API calls, resource provisioning, data transfers that repeat.

  • Primary operation: Access permission checks per user-resource pair.
  • How many times: Once per access request, repeated for many users or resources.
  • Dominant operation: Iterating over ACL entries for the resource.
How Execution Grows With Input

As the number of users or resources grows, IAM checks stay efficient because roles are limited, but ACL checks grow with the number of entries.

Input Size (n)Approx. Api Calls/Operations
10IAM: ~10 role lookups, ACL: ~10 entry checks
100IAM: ~10 role lookups, ACL: ~100 entry checks
1000IAM: ~10 role lookups, ACL: ~1000 entry checks

Pattern observation: IAM role checks remain small due to limited roles; ACL checks grow linearly with the number of entries, which can be large.

Final Time Complexity

Time Complexity: O(n)

This means the time to check access grows linearly with the number of users or ACL entries involved.

Common Mistake

[X] Wrong: "Access checks always take the same time regardless of the number of users or entries."

[OK] Correct: ACL checks require scanning entries, so more entries mean more time. IAM roles limit this growth, making checks faster.

Interview Connect

Understanding how access control scales helps you design secure and efficient cloud systems, a valuable skill in real-world projects.

Self-Check

"What if we replaced ACLs with a database index for entries? How would the time complexity change?"

Practice

(1/5)
1. What is the main difference between IAM and ACLs in Google Cloud Platform?
easy
A. IAM and ACLs are exactly the same in functionality.
B. IAM controls network traffic, and ACLs control user passwords.
C. IAM is only for virtual machines, ACLs are for storage only.
D. IAM manages access at resource levels using roles, while ACLs manage access at object or bucket levels.

Solution

  1. Step 1: Understand IAM scope

    IAM controls access broadly by assigning roles to users or groups at resource levels like projects or services.

  2. Step 2: Understand ACL scope

    ACLs control access more narrowly, typically at the object or bucket level in storage services.

  3. Final Answer:

    IAM manages access at resource levels using roles, while ACLs manage access at object or bucket levels. -> Option D

  4. Quick Check:

    IAM = broad roles, ACLs = fine-grained object permissions [OK]
Hint: IAM is broad roles; ACLs are fine-grained permissions [OK]
Common Mistakes:
  • Confusing IAM with network controls
  • Thinking ACLs control passwords
  • Assuming IAM and ACLs are identical
2. Which of the following is the correct way to grant a user the role of 'Storage Object Viewer' using IAM in GCP?
easy
A. Edit the user's password in the IAM console.
B. Add the user to the ACL of the bucket with read permission.
C. Use the command: gcloud projects add-iam-policy-binding my-project --member='user:email@example.com' --role='roles/storage.objectViewer'
D. Create a firewall rule allowing the user access.

Solution

  1. Step 1: Identify IAM command syntax

    The correct gcloud command to grant IAM roles uses 'add-iam-policy-binding' with member and role flags.

  2. Step 2: Verify role and member format

    The role 'roles/storage.objectViewer' and member format 'user:email@example.com' are correct for granting read access to storage objects.

  3. Final Answer:

    Use the command: gcloud projects add-iam-policy-binding my-project --member='user:email@example.com' --role='roles/storage.objectViewer' -> Option C

  4. Quick Check:

    IAM role grant uses gcloud add-iam-policy-binding [OK]
Hint: Use gcloud add-iam-policy-binding with correct role and member [OK]
Common Mistakes:
  • Confusing ACL changes with IAM commands
  • Editing passwords instead of roles
  • Using firewall rules for access control
3. Given the following IAM policy snippet for a bucket, what access does the user 'user:alice@example.com' have?
{
  "bindings": [
    {
      "role": "roles/storage.objectAdmin",
      "members": ["user:alice@example.com"]
    }
  ]
}
medium
A. Alice can only read objects in the bucket.
B. Alice can create, delete, and update objects in the bucket.
C. Alice has no access to the bucket.
D. Alice can manage IAM policies but not objects.

Solution

  1. Step 1: Identify the role assigned

    The role 'roles/storage.objectAdmin' allows full control over objects in the bucket, including create, delete, and update.

  2. Step 2: Confirm member access

    The member 'user:alice@example.com' is assigned this role, so Alice has these permissions.

  3. Final Answer:

    Alice can create, delete, and update objects in the bucket. -> Option B

  4. Quick Check:

    roles/storage.objectAdmin = full object control [OK]
Hint: objectAdmin role means full object permissions [OK]
Common Mistakes:
  • Confusing objectAdmin with read-only roles
  • Assuming no access without explicit bucket ACL
  • Mixing IAM roles with IAM policy management
4. You tried to grant a user access to a Cloud Storage bucket by adding them to the bucket's ACL, but they still cannot access the objects. What is the likely issue?
medium
A. The bucket has uniform bucket-level access enabled, which disables ACLs.
B. The user needs to restart their computer.
C. The user's email address was misspelled in the ACL.
D. The user was not granted an IAM role at the project level.

Solution

  1. Step 1: Understand uniform bucket-level access

    When uniform bucket-level access is enabled, ACLs are disabled and only IAM controls access.

  2. Step 2: Check ACL effect

    Adding users to ACLs has no effect if uniform bucket-level access is on, so the user cannot access objects despite ACL changes.

  3. Final Answer:

    The bucket has uniform bucket-level access enabled, which disables ACLs. -> Option A

  4. Quick Check:

    Uniform bucket-level access disables ACLs [OK]
Hint: Uniform bucket-level access disables ACLs [OK]
Common Mistakes:
  • Assuming ACLs always work regardless of bucket settings
  • Blaming user typos without verification
  • Thinking user restart affects cloud permissions
5. You want to allow a third-party service to read specific objects in your Cloud Storage bucket without giving it full project access. Which approach is best?
hard
A. Add the service account to the bucket's ACL with READER permission on specific objects.
B. Enable uniform bucket-level access and grant the service account the storage.admin role.
C. Grant the service an IAM role at the project level with storage.objectViewer permission.
D. Create a firewall rule to allow the service IP to access the bucket.

Solution

  1. Step 1: Understand access scope needs

    The third-party service needs access only to specific objects, not the whole project.

  2. Step 2: Choose fine-grained control method

    ACLs allow granting permissions on specific objects or buckets, ideal for limited access.

  3. Step 3: Evaluate other options

    IAM roles at project level are too broad; storage.admin is too powerful; firewall rules do not control storage access.

  4. Final Answer:

    Add the service account to the bucket's ACL with READER permission on specific objects. -> Option A

  5. Quick Check:

    Use ACLs for fine-grained object access [OK]
Hint: Use ACLs for specific object access, IAM for broad access [OK]
Common Mistakes:
  • Granting overly broad IAM roles
  • Confusing firewall rules with access control
  • Using storage.admin role unnecessarily