Hi, Based on the pricing for Key Vault, encryption/decryption operations via API are charged. My question is, does this also imply cost for PostgreSQL DBaaS using custom encryption keys stored in Azure Key Vault or the cost for encrypting/decrypting database blocks are already covered by the cost of the database instance itself? Thanks!

Hello José Luis Rando Calvo , Thanks for your question. It implies a seperate cost for the encryption/decryption operations happening through Azure Key Vault APIs. See below for detailed pricing: https://azure.microsoft.com/en-us/pricing/details/postgresql/server/ https://azure.microsoft.com/en-us/pricing/details/key-vault/ Please let me know if you have further questions You can mark it 'Accept Answer' if this helped.

Using key vault to customize the encryption keys at rest for Azure Database PostgreSQL imply any cost on for encrypt/decrypt operations?

Accepted answer

akinbade abiola 4,210 Reputation points

2024-05-20T09:19:29.5566667+00:00

Hello José Luis Rando Calvo,

Thanks for your question.

It implies a seperate cost for the encryption/decryption operations happening through Azure Key Vault APIs.
See below for detailed pricing:
https://azure.microsoft.com/en-us/pricing/details/postgresql/server/

https://azure.microsoft.com/en-us/pricing/details/key-vault/
Please let me know if you have further questions

You can mark it 'Accept Answer' if this helped.
Please sign in to rate this answer.
José Luis Rando Calvo 20 Reputation points

2024-05-20T11:41:33.3666667+00:00

Hi @akinbade abiola ,

Thanks for your quick reply. Appreciate it.

Still is not clear for me, and just for confirming:Using BYOK in Azure Database SQL via Azure Key Vault implies extra cost for encrypting/decrypting all data write/read into the database, based on the pricing from Azure Key Vault here https://azure.microsoft.com/en-us/pricing/details/key-vault/ . So on top of the cost of the DBaaS I have to also pay a plus for encryption/decryption for all data written and read from the database.Is above correct?

What is hard to understand for me is that if we enable BYOK for a database, we would have to pay for every single encryption/decryption operation over the database while it is free when using system-managed keys. At the end what makes the difference between using a customer-provided key compared to use one random key generated by the system. Thanks.

akinbade abiola 4,210 Reputation points

2024-05-20T11:52:51.94+00:00

Thank you for the follow-up

Yes, you are correct for the cost breakdown. The main difference between the two models is the resposibility for Key management

With system managed: No additional costs as it is an integrated service model and the decryption/encryption is managed internally by the service

With customer managed, you pay for the KV operations and storage abd management of the keys.

Please let me know if you have further questions

You can mark it 'Accept Answer' if this helped.

José Luis Rando Calvo 20 Reputation points

2024-05-20T13:53:55.42+00:00

Ok, now is clear. Thanks!
Sign in to comment

Share via

Using key vault to customize the encryption keys at rest for Azure Database PostgreSQL imply any cost on for encrypt/decrypt operations?

0 additional answers