azurerm_network_security_group cost estimation

An azurerm_network_security_group (NSG) is a stateful packet filter you associate with a subnet or a network interface to allow or deny traffic by port, protocol, and address. The NSG and all of its security rules are free. Azure does not charge for the group, the number of rules, or the traffic those rules permit or block.

Because they are free, NSGs are usually left out of cost reviews, but two indirect effects matter. First, an NSG gates the traffic that generates data transfer charges on other resources: an outbound rule allowing internet access does not cost anything by itself, but the egress it permits is metered per GB. Second, if you turn on NSG flow logs, the logs are written to a storage account and, with traffic analytics, processed through Log Analytics, both of which are billed. That logging is a deliberate opt-in, not part of the NSG price.

There is no optimization to do on the group itself. The useful move is to read NSG rules as documentation of your traffic paths: a rule allowing heavy traffic between two subnets in different zones is a signal to colocate them and cut cross-zone transfer. c3x prices the VMs, load balancers, and endpoints an NSG protects, plus any flow log storage and analytics you configure, and treats the NSG and its rules as free.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_resource_group" "main" {
  name     = "network-rg"
  location = "eastus"
}

resource "azurerm_network_security_group" "web" {
  name                = "web-nsg"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location

  security_rule {
    name                       = "allow-https"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

Pricing dimensions

What you actually pay for when you provision azurerm_network_security_group.

Dimension	Unit	What's being charged
Network security group	free	The group and all of its inbound and outbound security rules have no charge. $0
Traffic it permits	per GB (billed elsewhere)	The egress and cross-zone data the rules allow is billed on the resources and paths involved, not on the NSG.
Flow logs (optional)	per GB stored + analyzed	If enabled, NSG flow logs write to a storage account and, with traffic analytics, process through Log Analytics.

Optimization tips

Common ways to reduce azurerm_network_security_group cost without changing the workload.

Use NSG rules to spot expensive traffic paths

A rule allowing heavy traffic between subnets in different zones is a hint to colocate those workloads and cut cross-zone data transfer, which is metered per GB.

Prefer service endpoints over broad outbound rules

If an NSG allows wide outbound access so a VM can reach Storage or SQL, a service endpoint keeps that traffic on the Azure backbone and off metered egress.

Scope flow logging deliberately

NSG flow logs and traffic analytics are billed on storage and Log Analytics. Enable them where you need visibility, not blanket across every NSG.

FAQ

Do Azure network security groups cost money?

No. NSGs, their security rules, and the number you create are free. You pay only for the resources they protect and the data transfer the rules permit, which is billed elsewhere.

Is there a charge per NSG rule?

No. There is no per-rule charge. Subscription limits cap how many rules and groups you can create, but there is no price attached to them.

Why might an NSG show up on my bill?

Only if you enable NSG flow logs or traffic analytics. Those write to a storage account and Log Analytics, which are billed. The NSG and its rules themselves remain free.