azurerm_role_assignment cost estimation
A role assignment is free. Granting a principal a role over a scope costs nothing. It is access control, not a billed resource.
An azurerm_role_assignment grants a security principal (a user, group, service principal, or managed identity) a role such as Contributor or Storage Blob Data Reader over a scope like a subscription, resource group, or single resource. Role assignments are free. Azure does not charge for the assignment, for the built-in or custom role it references, or for the number of assignments in a subscription.
Role assignments have no direct cost, but they gate what a principal can do, which has an indirect relationship to spend. An overly broad assignment (Owner or Contributor at subscription scope) lets a principal create expensive resources, so tight scoping is a cost-control practice as much as a security one. Conversely, a role assignment is what lets a managed identity read secrets or write to storage without embedded credentials, replacing keys that would otherwise be a security liability. Neither the identity nor the assignment costs money; the resources they grant access to do.
There is nothing to optimize on the assignment itself. The useful review is scope hygiene: prefer least-privilege data-plane roles at the narrowest scope, and remove stale assignments. c3x prices the resources a principal can act on and treats role assignments as free access-control metadata.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "azurerm_resource_group" "main" {
name = "app-prod-rg"
location = "eastus"
}
resource "azurerm_user_assigned_identity" "app" {
name = "app-identity"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
}
resource "azurerm_role_assignment" "blob_reader" {
scope = azurerm_resource_group.main.id
role_definition_name = "Storage Blob Data Reader"
principal_id = azurerm_user_assigned_identity.app.principal_id
}Pricing dimensions
What you actually pay for when you provision azurerm_role_assignment.
| Dimension | Unit | What's being charged |
|---|---|---|
| Role assignment | free | The assignment, the role it references, and the number of assignments have no charge. $0 |
| Resources the principal can act on | varies (billed elsewhere) | The storage, compute, or databases a role grants access to are billed on their own meters. |
Optimization tips
Common ways to reduce azurerm_role_assignment cost without changing the workload.
Scope assignments tightly
A broad Contributor or Owner assignment at subscription scope lets a principal create costly resources anywhere. Assigning least-privilege roles at the narrowest scope limits both blast radius and accidental spend.
Use data-plane roles instead of access keys
Granting a managed identity a data role like Storage Blob Data Reader removes the need for stored account keys, a security win at no cost.
Remove stale assignments
Role assignments to departed users or retired service principals linger silently. Periodic cleanup tightens access without touching the bill.
FAQ
Does an Azure role assignment cost money?
No. Role assignments, the built-in and custom roles they reference, and the number of assignments are all free. You pay only for the resources a principal can act on.
Is there a charge for custom roles?
No. Defining and assigning custom RBAC roles is free. Only the resources the role grants access to are billed, on their own meters.
How do role assignments relate to cost control?
Indirectly. A broad assignment lets a principal create expensive resources, so least-privilege scoping limits accidental spend. The assignment itself never appears on the bill.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including azurerm_role_assignment.