AzureAzure Key VaultSecurity

`azurerm_key_vault_certificate` cost estimation

Storing a certificate is effectively free at rest; the charges are certificate renewals and the key operations behind it. Key Vault bills these per operation on the parent vault.

An azurerm_key_vault_certificate stores and manages an X.509 certificate together with its private key inside a Key Vault. There is no monthly storage fee for holding a certificate. As with secrets, Key Vault bills by operations rather than by the number of objects stored, so the certificate at rest is effectively free.

The cost has two parts. First, certificate operations: each renewal and certificate operation is billed on the parent azurerm_key_vault, at a rate distinct from ordinary secret operations. Automatic renewal through an integrated CA generates a renewal operation on each cycle, and self-signed or manually managed certificates generate operations when created or updated. Second, the underlying key: a certificate is backed by a key, and cryptographic operations on that key (sign, verify) count toward the vault's key operation billing. If the certificate uses an HSM-protected key on the Premium tier, those key operations are billed at the higher HSM rate and, for some key types, an additional per-key monthly charge applies.

The optimization is about renewal cadence and key protection choice: do not over-rotate, and use software-protected keys unless a compliance requirement demands HSM. Note that Key Vault does not sell the certificate itself; a certificate issued by an integrated public CA is purchased from that CA separately. c3x prices the parent Key Vault, its certificate and key operations, and any HSM key charge, treating the stored certificate as free at rest.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_resource_group" "main" {
  name     = "security-rg"
  location = "eastus"
}

data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "main" {
  name                = "app-kv-2026"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
}

resource "azurerm_key_vault_certificate" "tls" {
  name         = "app-tls"
  key_vault_id = azurerm_key_vault.main.id

  certificate_policy {
    issuer_parameters {
      name = "Self"
    }

    key_properties {
      exportable = true
      key_type   = "RSA"
      key_size   = 2048
      reuse_key  = true
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      subject            = "CN=app.example.com"
      validity_in_months = 12

      key_usage = [
        "digitalSignature",
        "keyEncipherment",
      ]
    }
  }
}

Pricing dimensions

What you actually pay for when you provision azurerm_key_vault_certificate.

Dimension	Unit	What's being charged
Certificate storage at rest	free	Key Vault does not bill for the number of certificates stored or a per-certificate monthly fee. $0
Certificate operations and renewals	per operation	Certificate creation, updates, and automatic renewals are billed on the parent vault at the certificate operation rate. ~$3 per renewal request (Standard tier)
Underlying key operations	per 10,000 operations or per HSM key	Cryptographic operations on the backing key are billed as key operations; HSM-protected keys use the higher Premium rate.

Optimization tips

Common ways to reduce azurerm_key_vault_certificate cost without changing the workload.

Do not over-rotate certificates

Each renewal is a billed certificate operation. A sensible validity period and renewal threshold avoids paying for rotations more frequent than your security policy requires.

Use software-protected keys unless HSM is required

A certificate backed by an HSM key on the Premium tier is billed at the higher key rate plus a possible per-key monthly charge. Use software protection unless compliance mandates HSM.

Reuse the key across renewals where policy allows

Setting reuse_key avoids generating a new key on every renewal, reducing key operations against the vault.

FAQ

Does storing a certificate in Key Vault cost money?

There is no per-certificate storage fee. Key Vault bills by operations, so the certificate at rest is effectively free. You pay for renewals and the key operations behind it.

Does Key Vault charge for the certificate itself?

No. Key Vault charges for the operations to store and renew it. A certificate issued by an integrated public CA is purchased from that CA separately, outside the vault's operation billing.

Why do HSM-backed certificates cost more?

Because the backing key runs on an HSM. On the Premium tier, key operations are billed at the higher HSM rate, and some key types add a per-key monthly charge. Software-protected keys avoid that.