Azure DDoS Protection Plan Cost Review
What does ZopNight detect here?
Azure DDoS Protection plans protecting zero VNets are flagged for deletion, with the plan's full monthly cost as savings. Plans covering more than 5 VNets are treated as justified and skipped, and plans with 1 or more protected VNets abstain because no protected-public-IP count signal exists yet.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1366 |
| Category | rightsizing |
| Severity | high |
| Metric | none — pure configuration read |
| Source | ddos_standard.go |
Where it applies
Counting the VNets attached to the plan
- metadata: protected_vnets (authoritative ARG summarize count() by planId of VNets referencing the DDoS plan, stamped by applyDDoSLookupSets). Read fail-closed: it abstains when absent or non-numeric. (The former getTagFloat(Tags,“protected_vnets”) had no producer, returned −1, and fired the “absent” branch on every plan, which is FAILS_OPEN.) Plans protecting > ddosManyVNetsThreshold = 5 VNets are skipped (the fixed plan is justified).
- pricing (SetPricing) for the per-resource monthly cost.
Why only the zero-VNet case gets a number
Only the 0-VNets branch fires: savings = cost (delete the pure-waste plan). Plans protecting 1+ VNets abstain unconditionally. The rule previously computed a per-IP downgrade delta as cost − (ddosIPProtectionMonthlyPerIP × nVNets), treating the VNet count as a stand-in for Azure’s real billing axis (protected public IP count, break-even 15 IPs). A VNet routinely fronts several public IPs (LB, App Gateway, VPN Gateway, Bastion, public-IP VMs), so that always understated the true per-IP cost, over-claimed the saving, and could even invert its sign (real per-IP cost exceeding the fixed plan) while still reporting a positive $ figure. No protected-public-IP-count signal is produced today, so the per-IP branch abstains (concrete-or-abstain) rather than ship that fabricated delta. ddosIPProtectionMonthlyPerIP ($199/mo/IP) is retained in code only for the future rec once that signal exists.
Deleting a plan nothing references
- Review which VNets are protected by this DDoS plan
- If none reference it, delete the plan to eliminate the fixed charge
- DDoS IP Protection (~$199/mo/IP) may be cheaper for plans protecting few public IPs, but requires manual verification of the actual protected public IP count (not yet available as a signal)