Repository navigation
Add idle Azure Managed HSM check #14
Description
Reserved for the SKILL.SCH open source community.\n\nAzure Managed HSM (Hardware Security Module) bills a fixed hourly rate (~$3.30/hr, real, current Retail Prices API) per pool regardless of key operation volume. A Managed HSM with zero real key vault operations over the lookback window is a significant, real recurring cost — this is one of the most expensive single always-on services in Azure, so even a single idle instance is a high-impact finding.\n\nNote: Managed HSM activation requires generating a security domain (multiple RSA key-pairs, a real multi-step process) before it's usable — this is more involved to provision for verification than most checks in this repo, so budget real time and read Microsoft's activation docs first.
Activity
raphgm commentedon Sep 22, 2026
Resolved in commit db56fa3. Note: an earlier PR (#24) attempted this but merged a non-functional, fabricated version — SQL policy + tests only, no source/extraction file, no runner.py registration, and a flat $10.00 price (real price is $3.20/hour = $2,336/month, off by ~233x — the Retail Prices API has no queryable meter for this product, so the real price came from Microsoft's own published Key Vault pricing page). That version was replaced with a real implementation. Also caught a second real bug during verification: the source read the wrong SKU field name, silently returning a $0 price until fixed. Verified against a real Standard_B1 HSM with 0 real key operations -> $2,336/month flagged correctly.