Design a Real-Time Cloud Configuration Drift Detector
Last updated: December 9, 2025
Quick Overview
Design a system that detects when cloud resource configurations drift from their desired secure state and alerts security teams in real time.
Wiz
December 9, 20258
8
1,918 solved
Design a system that detects when cloud resource configurations drift from their desired secure state and alerts security teams in real time.
Configuration drift is a major source of security incidents. A security group might be configured correctly today but someone adds an overly permissive rule tomorrow. The system must detect these changes in near real-time, compare against desired state or security baselines, and alert appropriately.
What the Interviewer Expects
- Design a change detection system using cloud provider event streams
- Define and manage desired-state security baselines
- Handle the difference between intentional changes and security drift
- Provide context-rich alerts that help security teams respond quickly
Key Topics to Cover
How to Approach This
- Start by clarifying functional and non-functional requirements with the interviewer.
- Estimate the scale: QPS, storage, bandwidth. This drives your design decisions.
- Draw a high-level architecture first, then deep dive into 1-2 critical components.
- Discuss trade-offs explicitly (e.g., consistency vs availability, SQL vs NoSQL).
- Address failure scenarios, monitoring, and how the system handles 10x traffic spikes.
Possible Follow-up Questions
- How do you distinguish between an authorized change and a security violation?
- How would you handle drift detection in environments using Infrastructure as Code?
- What is your rollback strategy for detected drift?
Sharpen Your Skills on Codemia
Practice similar problems with our interactive workspace, get AI feedback, and track your progress.
Practice System Design ProblemsSample Answer
Requirements
Functional Requirements
- Change Detection: Monitor cloud resources for configuration changes using APIs (e.g., AWS CloudTrail, Azure Activity Logs).
- **Desired-State Configuration Manageme...
Capacity Estimation
Assuming Wiz manages around 10,000 cloud resources across multiple accounts, with an estimated 10% of these resources changing configurations daily:
- Resource Changes: 10,000 resources * 10% = 1...
Submit Your Answer
