Role-based access control in Microservices - Scalability & System Analysis

Scalability Analysis - Role-based access control

Growth Table: Role-based Access Control (RBAC) in Microservices

Users	Roles	Permissions	Access Checks per Second	System Changes
100	10	50	200	Simple centralized auth service; direct DB queries for access checks
10,000	100	500	20,000	Introduce caching for permissions; use token-based auth (JWT); microservices query cache
1,000,000	1,000	5,000	2,000,000	Distributed cache (e.g., Redis); auth service scaled horizontally; async permission updates; token introspection service
100,000,000	10,000	50,000	200,000,000	Sharded permission storage; global CDN for token validation; edge caching; fine-grained permission microservices; event-driven updates

First Bottleneck

The first bottleneck is the authorization service database that stores roles and permissions. As user count and access checks grow, frequent permission lookups cause high read load and latency. Direct DB queries for each access check become too slow and resource-heavy.

Scaling Solutions

• Caching: Use in-memory caches (e.g., Redis) to store user roles and permissions for fast access.
• Token-based Auth: Use JWT tokens embedding roles/permissions to reduce calls to auth service.
• Horizontal Scaling: Run multiple instances of the auth service behind a load balancer.
• Sharding: Partition role and permission data by user groups or regions to distribute load.
• Event-driven Updates: Use message queues to update caches asynchronously when roles or permissions change.
• Edge Caching and CDN: For global scale, cache tokens and permission data closer to users.

Back-of-Envelope Cost Analysis

• At 1M users with 2M access checks/sec, assuming 1KB per permission cache entry, Redis needs ~2GB RAM for hot data.
• Network bandwidth for 2M requests/sec with 1KB payload = ~2GB/s (~16Gbps), requiring high network capacity.
• Auth service instances: each handles ~5,000 QPS, so ~400 instances needed at peak.
• Storage for roles/permissions: tens of GBs, depending on complexity and history retention.

Interview Tip

Start by explaining the RBAC components: users, roles, permissions, and access checks. Then discuss how load grows with users and requests. Identify the database as the first bottleneck. Propose caching and token-based auth to reduce load. Finally, mention horizontal scaling and sharding for very large scale. Keep answers structured and focused on bottlenecks and solutions.

Self Check

Your database handles 1000 QPS. Traffic grows 10x to 10,000 QPS. What do you do first?

Answer: Introduce caching for roles and permissions to reduce direct database queries. This lowers DB load and improves response time before scaling DB or services.

Key Result

The database storing roles and permissions is the first bottleneck as user and request volume grows; caching and token-based authorization are key to scaling RBAC in microservices.