Cloud Armor for DDoS and WAF in GCP - Time & Space Complexity

Time Complexity: Cloud Armor for DDoS and WAF

O(n)

Understanding Time Complexity

We want to understand how the work Cloud Armor does changes as more traffic comes in.

Specifically, how does the number of checks and protections grow when many requests arrive?

Scenario Under Consideration

Analyze the time complexity of the following operation sequence.

// Cloud Armor evaluates incoming requests
// against security policies and rules
for each incoming request {
  check IP against denylist
  check request headers and body for threats
  apply rate limiting if needed
  allow or block the request
}

This sequence shows how Cloud Armor processes each request to protect against attacks.

Identify Repeating Operations

Identify the API calls, resource provisioning, data transfers that repeat.

• Primary operation: Checking each incoming request against security rules.
• How many times: Once per request, for every request received.

How Execution Grows With Input

As the number of requests increases, the number of checks grows in the same way.

Input Size (n)	Approx. Api Calls/Operations
10	10 checks
100	100 checks
1000	1000 checks

Pattern observation: The work grows directly with the number of requests.

Final Time Complexity

Time Complexity: O(n)

This means the time to process requests grows linearly with how many requests arrive.

Common Mistake

[X] Wrong: "Cloud Armor processes all requests instantly, so time does not grow with more requests."

[OK] Correct: Each request needs to be checked, so more requests mean more work and more time overall.

Interview Connect

Understanding how security checks scale helps you design systems that stay safe even under heavy traffic.

Self-Check

"What if Cloud Armor used caching to remember safe IPs? How would the time complexity change?"