AzureAzure Key VaultSecurity

`azurerm_key_vault_secret` cost estimation

Storing a secret is effectively free; the charge is the operations against it. Key Vault bills per 10,000 operations on the parent vault, so reads and writes are the real cost.

An azurerm_key_vault_secret stores a single secret value (a password, connection string, or API key) inside a Key Vault. There is no monthly storage fee for holding a secret. Azure bills Key Vault by operations, not by the number of secrets stored, so a vault with one secret and a vault with a thousand cost the same at rest.

The cost is the operations against the vault. Every get, set, list, and delete on a secret counts as a Key Vault operation, billed per 10,000 operations on the parent azurerm_key_vault at the Standard or Premium tier rate. For most applications this is a trivial line on the bill, but a service that reads a secret on every request instead of caching it can generate millions of operations a month, turning a rounding error into a visible charge. Secret versions created by rotation also count as set operations. Software-protected secrets use the standard operation rate; the premium tier's higher rate applies to HSM-backed keys, not to plain secrets.

The optimization is entirely about operation volume: cache secrets in the application, read them at startup rather than per request, and let managed identities fetch them once. c3x prices the parent Key Vault and its operation profile and treats each stored secret as effectively free at rest.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_resource_group" "main" {
  name     = "security-rg"
  location = "eastus"
}

data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "main" {
  name                = "app-kv-2026"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
}

resource "azurerm_key_vault_secret" "db_password" {
  name         = "db-password"
  value        = var.db_password
  key_vault_id = azurerm_key_vault.main.id
}

Pricing dimensions

What you actually pay for when you provision azurerm_key_vault_secret.

Dimension	Unit	What's being charged
Secret storage at rest	free	Key Vault does not bill for the number of secrets stored or a per-secret monthly fee. $0
Secret operations	per 10,000 operations	Get, set, list, and delete on secrets are billed per block of operations on the parent vault at the Standard tier rate. ~$0.03 per 10,000 operations (Standard tier)
Rotation writes	per operation	Each new secret version created by rotation counts as a set operation toward the vault's operation billing.

Optimization tips

Common ways to reduce azurerm_key_vault_secret cost without changing the workload.

Cache secrets instead of reading per request

Cuts operation count by orders of magnitude

A service that fetches a secret on every request can generate millions of operations a month. Reading at startup and caching the value collapses that to a handful of operations.

Consolidate related values into fewer secrets

Storing a small config bundle as one secret rather than many individual reads reduces the number of get operations per application startup.

Fetch through a managed identity once

Let a managed identity read secrets at boot and inject them into the runtime, avoiding repeated data-plane calls that each count toward vault operation billing.

FAQ

Does storing a secret in Key Vault cost money?

There is no per-secret storage fee. Key Vault bills by operations, so holding a secret at rest is effectively free. You pay per 10,000 operations for the reads and writes against it.

Why is my Key Vault bill higher than expected?

Almost always operation volume. An application reading secrets on every request instead of caching them can generate millions of operations a month, which adds up per 10,000-operation block.

Does the premium tier charge more for secrets?

The premium tier's higher rate applies to HSM-backed keys, not plain secrets. Software-protected secrets use the standard operation rate on both tiers.