Azure Key Vault
Does ZopNight manage Azure Key Vault?
Key Vault bills per operation, covering secret reads, key transactions, and certificate renewals, with the Premium SKU adding charges for HSM-backed keys. Spend is rarely the issue; ZopNight discovers every vault via Resource Graph with SKU detail, inventories secrets as child resources, and supports dependency mapping and hygiene review.
Rules that fire on Azure Key Vault
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery only. |
Key Vault safeguards secrets, keys, and certificates, billed per operation with Premium adding HSM-backed keys. Costs are small, but vault sprawl and stale secrets are governance liabilities.
Metered by the API call, not by existence
A vault itself is close to free: charges accrue per operation, whether a secret read, a key sign or wrap, or a certificate operation, priced per 10,000 transactions. The Premium SKU layers on monthly charges for HSM-protected keys, and certificate renewals bill per request. This shape means an idle vault costs almost nothing while a hot code path that fetches a secret on every request instead of caching it can generate a surprising transaction line. There is no capacity to rightsize and nothing to power off; cost follows call patterns, so the fix for an expensive vault is almost always in the application’s caching, not in Azure.
Inventory with child-resource depth
ZopNight discovers vaults via Azure Resource Graph with SKU detail and, distinctively for this type, enumerates the secrets inside each vault as child resources, giving the inventory a level of depth Resource Graph alone does not provide. That parent-child structure supports dependency mapping (which environments and workloads hang off which vault) and hygiene review. Nothing about a vault schedules; its value in the platform is as a governance surface rather than a savings lever.
The liabilities that grow inside quiet vaults
Vault problems are organizational before they are financial: per-team and per-experiment vaults multiplying until nobody can say which are load-bearing; secrets without expiry dates that outlive the people who created them; and Premium HSM keys provisioned for a compliance requirement that was later dropped, still billing monthly. Each stale vault also widens the access-policy surface an auditor has to reason about.
Walking the vault estate in the portal
Azure portal → Key vaults lists every vault with SKU and resource group. Within a vault, Objects → Secrets, Keys, and Certificates show the contents with activation and expiry attributes, the fastest read on whether a vault is an active dependency or a relic.