Pricing for Key Protect on Satellite

Unlike the pricing for Key Protect on IBM Cloud, the pricing for Key Protect on Satellite is not based on key versions. Instead, reflecting the different use cases and infrastructure maintenance requirements for Satellite-based deployments, users are charged a flat rate for each location where they want Key Protect installed and then an additional rate depending on the quota of keys they select at deployment time.

Because of the way Key Protect structures its billing system, you cannot delete the first instance you deploy unless you plan to uninstall Key Protect from your Satellite location completely.

Details

Pricing is for Key Protect on Satellite only and does not include the price of a Satellite location or the price to install IBM Cloud Database (ICD) creation in your location.

Pricing for Key Protect on Satellite is based on two metrics:

Base price: a monthly base price charged for the installation of Key Protect into a Satellite location. Check out Key Protect in the IBM Cloud catalog for the latest price. Note that there is no additional charge for creating multiple instances in a location.
Key quota: the maximum number of non-deleted keys which is defined when Key Protect is deployed in the Satellite location. This quota covers the number of keys per location, not per instance. If you choose to create a second instance, it is bound by the quota selected for the location. You do not need to increase your quota. Keys have a fixed cost (check out Key Protect in the IBM Cloud catalog for the latest prices), while quotas can be requested in batches of 100 keys. The minimum quota that can be selected is 100. Additional quotas can be requested in batches of 100. This quota of keys can be changed later by opening a service ticket. If you attempt to exceed your key quota, you get an error.

If you change quotas in the middle of a billing cycle (for example, going from 100 keys to 200 keys) you are charged whichever quota is larger. This charge is not prorated by the amount of time a particular quota was selected and is based on the maximum quota during a particular billing cycle.

If you navigate to the catalog page for Key Protect on Satellite, click on the Satellite card under Select a location, and cannot see the specific plan information for Key Protect on Satellite, this might be because you have not been allowlisted. Contact IBM to learn more.

What is a non-deleted key?

Recall from Monitoring the lifecycle of encryption keys that keys can be either in the active, deactivated, suspended, or destroyed state. The act of deleting a key moves it to the destroyed state.

In the context of your key quota, you are charged for every key that is a state other than the destroyed state.