Access control (IAM vs ACLs) in GCP - Performance Comparison

Time Complexity: Access control (IAM vs ACLs)

O(n)

Understanding Time Complexity

When managing access in cloud systems, it is important to understand how the time to check permissions grows as more users or resources are added.

We want to know how the system handles many access checks efficiently.

Scenario Under Consideration

Analyze the time complexity of checking access permissions using IAM roles versus ACLs.

// Pseudocode for access check
function checkAccess(user, resource) {
  // IAM check
  roles = getUserRoles(user)
  permissions = getPermissionsFromRoles(roles, resource)
  if (permissions.allow) return true

  // ACL check
  aclEntries = getAclEntries(resource)
  for (entry in aclEntries) {
    if (entry.user == user && entry.permission == 'allow') {
      return true
    }
  }
  return false
}

This sequence checks if a user has access to a resource first by IAM roles, then by ACL entries.

Identify Repeating Operations

Identify the API calls, resource provisioning, data transfers that repeat.

• Primary operation: Access permission checks per user-resource pair.
• How many times: Once per access request, repeated for many users or resources.
• Dominant operation: Iterating over ACL entries for the resource.

How Execution Grows With Input

As the number of users or resources grows, IAM checks stay efficient because roles are limited, but ACL checks grow with the number of entries.

Input Size (n)	Approx. Api Calls/Operations
10	IAM: ~10 role lookups, ACL: ~10 entry checks
100	IAM: ~10 role lookups, ACL: ~100 entry checks
1000	IAM: ~10 role lookups, ACL: ~1000 entry checks

Pattern observation: IAM role checks remain small due to limited roles; ACL checks grow linearly with the number of entries, which can be large.

Final Time Complexity

Time Complexity: O(n)

This means the time to check access grows linearly with the number of users or ACL entries involved.

Common Mistake

[X] Wrong: "Access checks always take the same time regardless of the number of users or entries."

[OK] Correct: ACL checks require scanning entries, so more entries mean more time. IAM roles limit this growth, making checks faster.

Interview Connect

Understanding how access control scales helps you design secure and efficient cloud systems, a valuable skill in real-world projects.

Self-Check

"What if we replaced ACLs with a database index for entries? How would the time complexity change?"