Azure Terraform Resources

A managed tabular analytics engine billed per hour by tier. An S0 is ~$591/month if left running, but it can be paused, which stops the charge entirely.

Managed ETL/ELT and data integration. Pipeline orchestration ($1/1K runs), data flow execution ($0.193-$0.34/vCore-hour for General Purpose), and Integration Runtime hours. Data movement billed separately ($0.25/DIU-hour Azure-hosted).

Managed Spark and Delta Lake. Bills DBU (Databricks Units) at $0.15-$0.55/DBU-hour depending on workload type plus underlying VM costs. Photon engine adds ~30% to DBU rate for ~2-3x performance.

An individual event hub (partitioned log) inside an Event Hubs namespace. The hub itself is free. Cost lives on the parent namespace: throughput units, processing units, or dedicated capacity, plus ingress events and Capture.

A single-tenant dedicated Event Hubs cluster billed per Capacity Unit-hour. One CU is ~$6,847/month, only worth it at very high, sustained throughput.

A managed Hadoop/Hive cluster on HDInsight, billed per node-hour for head and worker VMs. A 2-head + 3-worker cluster is ~$1,894/month, and it doesn't auto-pause.

A managed Apache HBase (NoSQL wide-column) cluster on HDInsight, billed per node-hour for head and worker (region server) VMs. A 2-head + 3-worker cluster is ~$1,894/month.

A managed Hive LLAP (Interactive Query) cluster on HDInsight, billed per node-hour for head and worker VMs. A 2-head + 3-worker cluster is ~$1,894/month.

A managed Apache Kafka cluster on HDInsight, billed per node-hour for head and worker (broker) VMs. A 2-head + 3-broker cluster is ~$1,894/month, running continuously.

A managed Apache Spark cluster billed per node-hour for head and worker VMs. A 2-head + 3-worker cluster is ~$1,894/month, running continuously.

A managed analytics engine (Kusto) for fast queries over telemetry and logs. Priced on the underlying VM instances plus an Azure Data Explorer markup per vCPU-hour.

Dedicated Power BI capacity for embedding analytics in apps, billed per hour by A-SKU. An A1 is ~$736/month, but it can be paused when not in use.

A data-governance and catalog account billed per always-on Data Map capacity unit, plus scanning. One capacity unit is ~$300/month before scans.

Managed full-text and vector search. Free tier for development. Basic at $75/month, Standard from $250/month per Search Unit. Semantic ranking and vector search included on Standard+.

A real-time stream-processing job billed per Streaming Unit-hour. Three streaming units run ~$241/month, and the job bills while it's running whether or not events flow.

An Apache Spark pool in Synapse billed per vCore-hour of active nodes. Three Small nodes running full-time are ~$1,253/month, but auto-pause makes the real cost usage-driven.

A dedicated, provisioned data-warehouse pool. Priced per cDWU-hour by performance level, plus separately-billed storage, and pausable to stop compute charges.

Unified data warehouse + Spark + serverless SQL + Data Factory pipelines. Dedicated SQL pool from $1.20/DWU-hour. Spark pool $0.143/vCore-hour. Serverless SQL $5/TB scanned. Workspace itself is free.

A managed event-routing topic. Priced per million operations, with a generous free tier and no always-on cost.

Managed real-time messaging over WebSockets. Priced per unit per day by tier, with included connections and messages per unit.

Managed real-time messaging over WebSockets with a pub/sub model. Priced per unit per day by tier, with included connections and messages per unit.

A pool of compute nodes for batch/HPC jobs, billed the underlying VM rate per node. Two Standard_D2s_v5 dedicated nodes are ~$140/month, but autoscale and Spot make it usage-driven.

A physical server dedicated to your VMs for isolation and licensing. Priced per host-hour by host SKU, independent of how many VMs you place on it.

A single Linux VM. Billed per hour for the chosen size plus a separate managed OS disk. A Standard_D2s_v5 runs ~$70/month before the disk.

A group of identical Linux VMs that scales as a unit. Priced per instance-hour by VM size times the instance count, plus per-instance managed OS disks.

An autoscaling cluster for ML training and batch jobs. Priced on the underlying VM rate per node-hour, scaling between min and max nodes with the workload.

A Flexible-orchestration VM scale set, billed per instance-hour at the VM rate. Two Standard_D2s_v5 instances are ~$140/month, scaling with the instance count.

The compute plan that hosts Web Apps and Function Apps, billed per instance-hour by tier × worker count. A B1 plan with one worker is ~$12/month.

A managed platform for Spring Boot apps. The Standard tier carries a per-hour base fee (~$578/month) on top of per-app vCPU/memory usage.

Managed hosting for static sites with serverless API backends. Priced as a flat monthly plan fee, with a genuinely free tier for small projects.

A single Windows VM. Bills per hour for the size, including a Windows license surcharge, plus a managed OS disk. A Standard_D2s_v5 runs ~$137/month before the disk.

A fleet of identical Windows VMs that scales as a unit, billed per instance-hour (Windows rate). Three Standard_D2s_v5 instances are ~$412/month.

Serverless containers billed by active vCPU-seconds and GiB-seconds. An always-on 0.5 vCPU / 1 GiB replica is ~$39/month; scale-to-zero apps cost far less.

Serverless containers billed per vCPU-second and GB-second, only while running. 1 vCPU + 1.5 GB run 24/7 is ~$28/month; scale-to-zero workloads cost far less.

A managed Docker container registry. Three tiers (Basic, Standard, Premium) with different per-day rates and included storage.

A managed Kubernetes cluster on AKS. Control plane is free in Standard tier; you pay for the underlying node VMs and disks.

An additional node pool for an AKS cluster, billed as the underlying VMs it runs. Two Standard_D2s_v5 nodes are ~$140/month.

A globally-distributed multi-model database. Priced by Request Units (RU/s) and storage, with provisioned and serverless options.

A managed Apache Cassandra cluster billed per node-hour by VM SKU. Three Standard_DS14_v2 nodes run ~$4,419/month, node count and SKU drive the whole bill.

A managed FHIR (healthcare data) service billed by structured storage plus optional provisioned throughput. 100 GB of storage is ~$25/month.

A managed MariaDB server billed per vCore plus storage. A 2-vCore server with 50 GB is ~$182/month, but the service is retiring, so plan a migration.

Managed SQL Server in Azure. DTU model from $4.90/month (Basic 5 DTU) or vCore model from $0.18/vCore-hour (General Purpose Serverless). Hyperscale tier scales beyond 4 TB. License-included or BYOL via Hybrid Benefit.

A shared pool of resources for many Azure SQL databases. Priced per pool vCore-hour (or DTU) plus pool storage, amortizing capacity across databases.

A fully managed SQL Server instance with near-100% engine compatibility. Priced per vCore-hour by service tier and hardware generation, plus included and overage storage.

The logical SQL server that hosts Azure SQL databases and elastic pools. The server is free. Cost lives on the databases and pools it contains: DTU or vCore compute, storage, and backup.

Managed MySQL with vCPU-based pricing. Burstable B1ms at $13.87/month, General Purpose D2ds_v4 at ~$140/month. Storage $0.115/GB-month. HA doubles compute cost; zone-redundant adds 25% on top.

The legacy MySQL Single Server, billed per vCore plus storage. A 2-vCore GP server with 50 GB is ~$70/month, but Single Server is retired, so migrate to Flexible Server.

A managed PostgreSQL server. Priced by compute SKU, storage size, and high-availability mode.

A logical database inside a PostgreSQL Flexible Server. The database is free. Cost lives on the parent server: compute vCores, provisioned storage, IOPS, and backup beyond the free allowance.

The legacy PostgreSQL Single Server, billed per vCore plus storage. A 2-vCore GP server with 50 GB is ~$70/month, but Single Server is retired, so migrate to Flexible Server.

A managed Redis cache. Priced per hour by tier (Basic, Standard, Premium, Enterprise) and cache size.

The Enterprise tier of Azure Cache for Redis, billed a flat hourly rate by SKU. An Enterprise_E10-2 runs ~$609/month, the capacity (E-number) drives the cost.

Runbook automation billed per job-run minute beyond a free monthly allowance, plus watcher hours. 10,500 job-minutes is ~$20.

A managed load-testing service billed per virtual user hour beyond a free monthly allowance. 1,050 VUH (1,000 billable) is ~$150/month.

A multi-tenant event routing domain billed per million operations. The first 100K/month are free, then ~$0.60/million, 10M operations is ~$6.

A subscription that routes filtered events from a topic or Azure source to a handler. The subscription is free to define. Cost lives in Event Grid operations and in the downstream handler it invokes.

A Standard-plan Logic App running on dedicated compute, billed per hour for the workflow plan. A WS1 plan is ~$143/month, regardless of how many workflows run on it.

A Consumption-plan Logic App billed per action executed, no standing fee. 1M built-in actions is ~$25; it scales to zero when idle.

A namespace for Hybrid Connections / WCF Relay, billed per listener plus message volume. One Hybrid Connection listener is ~$9.78/month.

A managed IoT digital-twin graph, billed purely by usage, operations, messages, and query units, each per 1,000. 1M operations is ~$2.50; no standing fee.

A managed IoT message broker billed per provisioned unit by tier. An S1 unit is $25/month and includes a daily message quota; you scale by adding units.

Zero-touch device provisioning for IoT Hub, billed per provisioning operation. 100K operations is ~$12, it's a low, usage-based cost.

Managed AI APIs: OpenAI, Vision, Speech, Language, Translation. Pay-per-call (varies by service). OpenAI GPT-4o: $5/M input tokens, $15/M output. Vision: $1-$5/1K transactions. Speech-to-Text: $1/audio-hour.

A managed dev VM for Azure ML, billed the underlying VM rate per hour while running. A Standard_DS3_v2 is ~$214/month if left on, and idle instances are the classic waste.

A managed store for application settings and feature flags. Priced as a flat daily fee on the Standard tier, with a genuinely free tier.

A managed Grafana instance for dashboards and observability. Priced on a per-instance hourly node fee plus a per-active-user charge.

A management solution (such as ContainerInsights or VMInsights) enabled on a Log Analytics workspace. The solution is free to add. Cost lives in the data it causes the workspace to ingest and retain.

A resource group is free. It is a logical container for resources, not a billed service. The cost is the sum of everything you place inside it.

A Kafka-compatible event streaming platform. Tier-based pricing (Basic, Standard, Premium, Dedicated) with throughput units or processing units.

Enterprise messaging with queues and topics. Basic ($0.05/M operations), Standard ($0.0135/hour + $0.80/M operations), Premium ($0.99/hour per Messaging Unit). Premium for VNet isolation, predictable performance.

A Service Bus queue is free to declare; its cost is billed on the parent namespace. The namespace tier (Basic, Standard, or Premium) sets whether you pay per operation or per messaging unit.

A Service Bus subscription is free to declare; its cost is billed on the parent namespace. Each subscription receives a copy of topic messages, and those deliveries are metered operations.

A Service Bus topic is free to declare; its cost is billed on the parent namespace. Publish-subscribe fan-out means each subscription that receives a message adds a metered operation.

Full API gateway with developer portal, rate limiting, transformations. Consumption ($3.50/M calls), Developer ($48/month, no SLA), Basic ($147/month), Standard ($686/month), Premium ($2,795/month per unit).

A Layer 7 load balancer with WAF support. Priced by gateway hours, capacity units, and optional WAF tier.

Managed, browser-based RDP/SSH access to VMs without public IPs. Priced per gateway-hour by SKU, plus outbound data transfer and scale-unit hours.

A CDN endpoint that caches and serves content from an origin, billed per GB of egress by zone. 1 TB of Zone 1 egress is ~$81/month.

Global CDN + WAF + load balancer. Standard at $35/month base + $0.17/GB outbound. Premium at $165/month base + $0.225/GB outbound. WAF rules and Private Link add fees. Anycast routing across 192+ POPs.

A network DDoS protection plan billed a flat ~$2,944/month, but it covers up to 100 public IPs across all your VNets, so the cost is meant to be shared.

A public DNS zone hosted on Azure's name servers. Priced per zone per month plus per-million queries, both at low flat rates.

A private, dedicated connection between on-premises and Azure. Priced as a monthly circuit fee by bandwidth and billing model, plus outbound data on the metered plan.

Layer-4 (TCP/UDP) load balancer. Standard SKU at $0.025/hour + $0.005 per processed GB. Basic SKU is free but deprecated for production (retiring 2025). Outbound rules and inbound NAT count toward the rule limit.

A load-balancing rule that maps a frontend port to a backend pool. The rule is free to define. Cost lives on the parent Standard Load Balancer: a base rule charge, per-rule overage, data processed, and the public IP.

Managed outbound SNAT for a subnet. Priced per gateway-hour plus per-GB of data processed, with the attached public IP billed separately.

A network interface is free. The NIC and its private IP cost nothing. The cost comes from the VM it attaches to, any public IP bound to it, and the traffic it carries.

A network security group is free. The group, its rules, and the traffic it filters cost nothing. The cost sits in the resources it protects and, if enabled, in flow logging.

A user (point-to-site) VPN gateway in a Virtual WAN hub, billed per scale unit-hour plus per connected user. One scale unit is ~$264/month.

A private DNS A record is free to declare; the cost lives on the Private DNS zone. The zone bills a small monthly hosting fee plus a per-million-queries charge that record lookups drive.

A managed DNS resolver for hybrid name resolution between Azure and on-prem, billed per inbound/outbound endpoint-hour. Two endpoints are ~$365/month.

A private DNS zone for name resolution within VNets, billed a flat ~$0.50/zone/month plus per-million queries. 1M queries is ~$0.90.

A private IP into a PaaS service over Private Link. ~$0.01/hour per endpoint (~$7.30/month) plus $0.01/GB processed, small individually, large in aggregate.

Public IPv4 or IPv6 address. Standard SKU at $0.005/hour ($3.65/month). Basic SKU is deprecated and retiring. Per-IP charges apply whether the IP is attached or unattached.

A route is free. A single user-defined route in a route table costs nothing. The cost is whatever paid next hop the route directs traffic toward.

A route table is free. User-defined routes and their association to subnets cost nothing. The cost sits in whatever the routes point traffic at.

A subnet is free. Carving an address range out of a virtual network costs nothing. The cost lives in the resources you place inside the subnet and the traffic they generate.

DNS-based global load balancing billed per million DNS queries plus per monitored endpoint. 10M queries with 2 endpoints is ~$6/month.

The central hub of an Azure Virtual WAN, billed per hour for the hub plus per GB of data processed. The hub base is ~$182.50/month before data and gateways.

A virtual network is free. The address space, subnets, and the network itself cost nothing. The bill comes from the paid resources you run inside it and the traffic it carries.

A VPN (or ExpressRoute) gateway billed per hour by SKU. A VpnGw1 runs ~$139/month just to exist, before any data processing.

A scalable VPN gateway in a Virtual WAN hub, billed per scale unit-hour. One scale unit is ~$264/month, plus data processed through the hub.

Application performance monitoring. Bills through a linked Log Analytics workspace by GB ingested. Free tier covers 5 GB/month.

A dedicated Log Analytics cluster requiring a daily-ingestion commitment. The minimum 100 GB/day commitment tier is ~$5,880/month, only for very high ingestion.

A workspace for ingesting, storing, and querying logs. Pay-As-You-Go by GB ingested, with optional Commitment Tiers for discounts.

A metric alert rule billed per monitored time series. A standard (static-threshold) rule is ~$0.10/month; dynamic-threshold rules are ~$0.50.

Location and mapping APIs billed per transaction (tiles, routing, search). The account itself is free; usage drives cost, 100K tile transactions is ~$500 on S1.

Managed network firewall. Standard SKU at $1.25/hour ($912/month) plus $0.016/GB processed. Premium SKU at $1.75/hour adds TLS inspection and IDPS. Often the most expensive single resource in a subscription.

A managed secret, key, and certificate store. Two tiers: Standard (pay-per-operation) and Premium (HSM-backed keys, higher rate).

A Key Vault access policy is free. Granting a principal permissions on a vault costs nothing. It is authorization, not a billed resource.

Storing a certificate is effectively free at rest; the charges are certificate renewals and the key operations behind it. Key Vault bills these per operation on the parent vault.

Storing a secret is effectively free; the charge is the operations against it. Key Vault bills per 10,000 operations on the parent vault, so reads and writes are the real cost.

A role assignment is free. Granting a principal a role over a scope costs nothing. It is access control, not a billed resource.

A user-assigned managed identity is free. Creating a standalone identity and attaching it to resources costs nothing. It removes credentials, not charges.

Onboards a Log Analytics workspace to Microsoft Sentinel (SIEM), adding a per-GB analysis charge on top of Log Analytics ingestion. 100 GB/month is ~$430.

A serverless function app. Three hosting plans with different cost models: Consumption (per-execution), Premium (always-warm), or App Service Plan (fixed).

A VM enrolled in Azure Backup, billed a per-instance protection fee by VM size plus backup storage. A ≤500 GB VM with 100 GB of backups is ~$12/month.

A vault for backups of disks, blobs, databases, and AKS, billed per GB of backup storage. 500 GB of vaulted LRS backup is ~$50/month, retention drives the bill.

A custom VM image stored as managed-disk snapshots, billed per GB-month. A 127 GB image is ~$6.35/month.

A block storage disk for Azure VMs. Priced by disk type and tier (per-disk for Premium SSD, per-GB for Standard).

A high-performance Lustre file system for HPC/ML, billed per GiB of provisioned capacity by throughput tier. 4 TB at the 250 MB/s/TiB tier is ~$696/month.

A provisioned capacity pool for high-performance NFS/SMB file storage. Priced per provisioned TiB by service level, billed on allocated (not used) capacity.

The container for Azure Backup and Azure Site Recovery. The vault is free. Cost lives on what you protect: per-instance backup fees, backup storage, and Site Recovery per-instance replication.

A VM protected by Azure Site Recovery (DR replication), billed ~$25/protected instance/month plus the storage and egress the replica consumes.

A point-in-time copy of a managed disk, billed per GB-month. A 128 GB Standard LRS snapshot is ~$6.40/month.

A storage account for Blob, File, Queue, and Table services. Priced by service type, redundancy, access tier, and operations.

Declaring a blob is free; the data it holds is not. A blob drives capacity, transaction, and egress charges on the parent storage account by its size, access tier, and read volume.

A blob container is free. It is a namespace for blobs, not a billed resource. The cost is the blobs inside it and the transactions against them on the parent storage account.

A lifecycle management policy is free, and it usually lowers your bill. It tiers and expires blobs automatically on the parent storage account, cutting capacity cost.

A storage queue is free to declare. The cost is transactions and the small message capacity it holds, billed on the parent storage account by operation volume.

A managed SMB/NFS file share billed by tier and capacity. A 100 GiB standard share is ~$6/month; Premium provisions capacity at a higher rate.

A storage table is free to declare. The cost is capacity for the entities it holds and transactions against them, billed on the parent storage account by volume.