Skip to main content
resource · azure

Azure Key Vault

live rule families
1
schedulable
no
category
security-services

Does ZopNight manage Azure Key Vault?

Key Vault bills per operation, covering secret reads, key transactions, and certificate renewals, with the Premium SKU adding charges for HSM-backed keys. Spend is rarely the issue; ZopNight discovers every vault via Resource Graph with SKU detail, inventories secrets as child resources, and supports dependency mapping and hygiene review.

Rules that fire on Azure Key Vault

At a glance

Azure Key Vault coverage facts.
Field Value
Scheduling notesdiscovery only.

Key Vault safeguards secrets, keys, and certificates, billed per operation with Premium adding HSM-backed keys. Costs are small, but vault sprawl and stale secrets are governance liabilities.

Metered by the API call, not by existence

A vault itself is close to free: charges accrue per operation, whether a secret read, a key sign or wrap, or a certificate operation, priced per 10,000 transactions. The Premium SKU layers on monthly charges for HSM-protected keys, and certificate renewals bill per request. This shape means an idle vault costs almost nothing while a hot code path that fetches a secret on every request instead of caching it can generate a surprising transaction line. There is no capacity to rightsize and nothing to power off; cost follows call patterns, so the fix for an expensive vault is almost always in the application’s caching, not in Azure.

Inventory with child-resource depth

ZopNight discovers vaults via Azure Resource Graph with SKU detail and, distinctively for this type, enumerates the secrets inside each vault as child resources, giving the inventory a level of depth Resource Graph alone does not provide. That parent-child structure supports dependency mapping (which environments and workloads hang off which vault) and hygiene review. Nothing about a vault schedules; its value in the platform is as a governance surface rather than a savings lever.

The liabilities that grow inside quiet vaults

Vault problems are organizational before they are financial: per-team and per-experiment vaults multiplying until nobody can say which are load-bearing; secrets without expiry dates that outlive the people who created them; and Premium HSM keys provisioned for a compliance requirement that was later dropped, still billing monthly. Each stale vault also widens the access-policy surface an auditor has to reason about.

Walking the vault estate in the portal

Azure portal → Key vaults lists every vault with SKU and resource group. Within a vault, Objects → Secrets, Keys, and Certificates show the contents with activation and expiry attributes, the fastest read on whether a vault is an active dependency or a relic.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·