How to query the Azure Rate Card API for cloud pricing

Most cloud providers offer an API to download pricing information, like the charges for virtual machine usage and cloud storage. Microsoft Azure calls this the Billing Rate Card API.

The documentation for this API is obscure, and it’s difficult to figure out exactly how to perform a query. Adding to this trouble, Microsoft’s own sample code is incomplete; it omits the critical steps of authentication and authorization.

Here are all the steps you need to access the Rate Card, starting from a fresh Azure account. (note: you’ll need to install the Azure CLI command line tools for one-time setup, but ongoing queries can be made with plain HTTP).

One-time Setup

Create an Azure account, if you don’t have one already.

Make note of your Tenant ID which is listed on the console under Azure Active Directory / Properties / Directory ID. This is similar to an AWS account ID or GCP project ID.

Also note your Subscription ID which is listed on the console under Cost Management + Billing.

Using the Azure CLI, first obtain your admin credentials:

az login

Next, enable some relevant APIs for your Azure account:

az provider register --namespace Microsoft.Compute
az provider register --namespace Microsoft.Resources
az provider register --namespace Microsoft.ContainerService
az provider register --namespace Microsoft.Commerce

Next, create an Azure role definition, which is like an AWS or GCP IAM role. To do this, start by creating a JSON file myrole.json with the following contents (replace YOUR_SUBSCRIPTION_ID with the Subscription ID of your account):

{
 “Name”: “MyRateCardRole”,
 “IsCustom”: true,
 “Description”: “Rate Card query role”,
 “Actions”: [
 “Microsoft.Compute/virtualMachines/vmSizes/read”,
 “Microsoft.Resources/subscriptions/locations/read”,
 “Microsoft.Resources/providers/read”,
 “Microsoft.ContainerService/containerServices/read”,
 “Microsoft.Commerce/RateCard/read”
 ],
 “AssignableScopes”: [
 “/subscriptions/YOUR_SUBSCRIPTION_ID”
 ]
}

Register this role definition with Azure:

az role definition create --verbose --role-definition @myrole.json

Finally, we will create an Azure Service Principal, which is like an AWS IAM user or GCP service account. Save the output of this command, because it includes access credentials you will need later.

az ad sp create-for-rbac --name "MyServicePrincipal" --role "MyRateCardRole" --sdk-auth true > my_credentials.json

In the Azure console, this will appear as a new “App” under Azure Active Directory / App Registrations (Preview). I don’t think the console GUI displays the role you just attached to the app. It does show the access credentials under Certificates & Secrets.

Authorization Note

Like the pricing APIs on AWS and GCP, Azure’s Rate Card must be accessed with valid credentials. Although the docs make it seem like any admin user credentials should work, the only way I’ve gotten this API to respond is by using a Service Principal attached with a custom role as above.

Querying the Rate Card API

Now we are finally able to make a query to the Rate Card API itself. This query is performed in two steps.

First, we use the Service Principal credentials to obtain a temporary access token. In the following Curl command, replace YOUR_TENANT_ID with your Azure account Tenant ID and YOUR_CLIENT_ID/YOUR_CLIENT_SECRET with the secret values saved in my_credentials.json from the last step above.

curl https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/token \  -F grant_type=client_credentials \
-F resource=https://management.core.windows.net/ \
-F client_id=YOUR_CLIENT_ID \
-F client_secret=YOUR_CLIENT_SECRET

This returns a JWT token that will expire in about one hour. The token itself is the long string inside "access_token":... in the returned JSON object.

Lastly, we can get the Rate Card itself. In the following Curl command, replace YOUR_SUBSCRIPTION_ID with the value from your Azure account, and YOUR_JWT_TOKEN with the access token you just obtained:

curl -L \ "https://management.azure.com/subscriptions/YOUR_SUBSCRIPTION_ID/providers/Microsoft.Commerce/RateCard?api-version=2016-08-31-preview&%24filter=OfferDurableId+eq+'MS-AZR-0003P'+and+Currency+eq+'USD'+and+Locale+eq+'en-US'+and+RegionInfo+eq+'US'" \
-H 'Authorization: Bearer YOUR_JWT_TOKEN'

We use the -L flag to tell Curl to follow redirects, since the initial response to this HTTP is a 302 redirect.

Note the filter parameter in the query above. The OfferDurableId identifies a pricing system. MS-AZR-0003P refers to a general, pay-as-you-go Azure account. Enterprise accounts or other special pricing plans might have a different offer ID. Currency, Locale, and RegionInfo can obviously vary depending on what geographic locations you are interested in.

If all goes well, Curl will present you with a giant JSON dump of the Azure Rate Card. Happy parsing!

Special Thanks

BanzaiCloud’s open-source cloudinfo project was a helpful resource in figuring out the Rate Card authorization steps.