azurerm_key_vault_access_policy cost estimation
A Key Vault access policy is free. Granting a principal permissions on a vault costs nothing. It is authorization, not a billed resource.
An azurerm_key_vault_access_policy grants a security principal specific permissions (get, list, set, delete) on the secrets, keys, and certificates in a Key Vault. The access policy is free. Azure does not charge for defining a policy, for the permissions it grants, or for the number of policies on a vault, which is capped by a subscription limit rather than a price.
An access policy has no meter. It is the older authorization model for Key Vault, an alternative to Azure RBAC role assignments, and it only controls who can perform operations on the vault. Those operations are what carry cost: secret and key operations are billed per block of transactions on the parent vault, and premium HSM-backed keys add their own charges. Granting a policy does not spend anything, but the reads and writes it enables count toward the vault's operation billing.
There is nothing to optimize on the policy itself. The useful practice is least privilege: grant only the permissions a principal needs, and prefer the newer RBAC model where you want consistent role management across resources. c3x prices the parent Key Vault and its operations and treats access policies as free authorization metadata.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "azurerm_resource_group" "main" {
name = "security-rg"
location = "eastus"
}
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "main" {
name = "app-kv-2026"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
tenant_id = data.azurerm_client_config.current.tenant_id
sku_name = "standard"
}
resource "azurerm_key_vault_access_policy" "app" {
key_vault_id = azurerm_key_vault.main.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
secret_permissions = ["Get", "List"]
}Pricing dimensions
What you actually pay for when you provision azurerm_key_vault_access_policy.
| Dimension | Unit | What's being charged |
|---|---|---|
| Access policy | free | The policy, the permissions it grants, and the number of policies have no charge. $0 |
| Operations it permits | per 10,000 operations (billed on the vault) | The secret, key, and certificate operations the policy allows are billed on the parent Key Vault, not the policy. |
Optimization tips
Common ways to reduce azurerm_key_vault_access_policy cost without changing the workload.
Grant least-privilege permissions
Give each principal only the operations it needs (often just Get and List on secrets). Narrow permissions reduce the risk of runaway operation counts against the vault.
Prefer RBAC for consistent management
Where you want one authorization model across resources, use Azure RBAC role assignments instead of access policies. Both are free, but RBAC scales better for large estates.
Cache secrets to limit vault operations
A policy that grants read access does not cost anything, but frequent reads count toward the vault's operation billing. Cache secrets in the application to cut metered operations.
FAQ
Does a Key Vault access policy cost money?
No. Access policies and the permissions they grant are free. You pay only for the secret, key, and certificate operations they enable, which are billed on the parent Key Vault.
Should I use access policies or RBAC?
Both are free. Access policies are the older per-vault model; Azure RBAC role assignments give consistent management across resources. Choose based on operational preference, not cost.
Why does my Key Vault bill grow if policies are free?
Because the operations the policies permit are billed. Every secret get, key sign, or certificate read counts toward the vault's per-10,000-operations charge, regardless of how access was granted.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including azurerm_key_vault_access_policy.