# Design a cloud IAM authorization service: system design interview question

> Cloud permission checks: inherited rules, consent between accounts, and a fixed deadline for permission revocation.

Source: https://sysround.com/questions/design-cloud-iam-authorization-service
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a cloud service that decides whether a principal can perform an action on a resource. It must support roles, inherited policies, cross-account access, and timely permission revocation."

## What to clarify first

- Principals and authentication
- Roles and policy statements
- Inheritance and rule precedence
- Access between accounts
- Stored scale
- Request volume and read-to-write mix
- Latency and availability
- Permission changes and consistency
- Durability and change records
- External responsibilities

## Scope of a strong answer

Core requirements:

- Evaluate a principal, action, and resource against the current permission rules
- Manage roles, role assignments, and inherited resource policies
- Require consent from both accounts for cross-account access
- Enforce permission changes within a fixed deadline

Usually out of scope:

- Authenticate users and workloads
- Issue credentials
- Execute arbitrary policy code
- Cancel operations that already started

## What interviewers probe

### Permission rules

Several rules can apply to one resource through different paths. The evaluator must produce the same result despite policy order and cache state.

### Access between accounts

Each account controls only its own permissions. A source administrator must not grant access that the resource owner never permits.

### Permission changes

A cached allow can remain dangerous after a revoke. The five-second deadline must hold across caches, replicas, missed changes, and partitions.

### Check latency and shared policies

Many requests can share one role or ancestor policy. A change to that policy can remove cache benefits across many principals and resources.

## Common mistakes

- Treat a credential or cached role name as proof of current permission.
- Combine cross-account allows with OR and permit access without the resource owner's consent.
- Refresh a cache entry from a stale replica and restart its expiry.
- Trust client-supplied principal IDs, account IDs, or resource parents.
- Invalidate every resource separately after an inherited policy change.
- Continue allow decisions after the five-second freshness limit expires.

## The bar by level

- **Senior:** Defines cross-account consent and deny precedence precisely. Designs regional checks with dependency versions and a complete five-second freshness budget. Handles retries, missed changes, and partitions.
- **Staff+:** Proves the revocation bound across clocks, caches, replicas, and response time. Defines trust boundaries and safe write authority failover. Limits shared-policy costs and explains availability tradeoffs.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=cloud-iam


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.