> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ACM Certificate costs

> Compare ACM Certificate backend choices using explicit service-adapter planning assumptions.

Tensor9 BYOC planning comparisons for `aws::1.0.0::acm`, with backend choices shown together. Read [how Tensor9 estimates service-adapter costs](/byoc/costs/overview.md) for price scope and capacity qualification, or return to [additional services](/byoc/costs/additional-services.md).

## AWS ACM public certificates → Certificate Manager

Origin API: `aws::1.0.0::acm`. Target backend: `google::1.0.0::certificate-manager`.

### AWS ACM public certificates · Active public certificates

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/4be31681c309b5b9a49375f9c9424c74fc8e38d955812f85422c84d41ae8c1e5-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/2cca4d1cd598bd403cc653d39a4648cc7bacfc2cd085cbe8c1ac0328f39d5de7-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Active public certificates (certificates) | ACM Certificate | Target scenario | Certificate Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | Certificate Manager (one staging copy) | 298.178 | 298.178 |
| 1000 | 0 | Certificate Manager (two staging copies) | 416.356 | 416.356 |
| 10000 | 0 | Certificate Manager (one staging copy) | 1298.178 | 1298.178 |
| 10000 | 0 | Certificate Manager (two staging copies) | 1416.356 | 1416.356 |
| 100000 | 0 | Certificate Manager (one staging copy) | 10298.178 | 10298.178 |
| 100000 | 0 | Certificate Manager (two staging copies) | 10416.356 | 10416.356 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 certificates / Certificate Manager (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 certificates / Certificate Manager (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / Certificate Manager (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / Certificate Manager (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / Certificate Manager (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / Certificate Manager (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / Certificate Manager (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / Certificate Manager (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / Certificate Manager (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / Certificate Manager (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / Certificate Manager (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / Certificate Manager (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Certificate Manager (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Certificate Manager (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Certificate Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Certificate Manager (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Certificate Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Certificate Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Certificate Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Certificate Manager (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Certificate Manager (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Certificate Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Certificate Manager (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Certificate Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Certificate Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Certificate Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate Manager bills deployed certificates per project: the first 100 a month are free, then USD 0.20 per certificate-month to 2,000 and 0.10 above. RSA-3072/4096 TLS and mTLS connections (0.45 per million) are not modeled; DNS challenges, hosting and durable adapter state remain separately allocated.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Certificate Manager pricing: [https://cloud.google.com/certificate-manager/pricing](https://cloud.google.com/certificate-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-168d6137ea51de31531b7d13e78d3b865c15f0df` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Certificate Manager pricing](https://cloud.google.com/certificate-manager/pricing).

### AWS ACM public certificates · Certificate issuances and renewals

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/85d806476946f1da3a054f77304c5c6a968e33ba2ad44bb6abb4529c8b972104-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/73be1017c291628bbf99a83b372b6260385cb4db6b0455373667607292505a76-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | Certificate Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 10000 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |
| 100000 | 0 | Certificate Manager (one staging copy) | 118.178 | 118.178 |
| 100000 | 0 | Certificate Manager (two staging copies) | 236.356 | 236.356 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 issuances/month / Certificate Manager (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 issuances/month / Certificate Manager (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / Certificate Manager (one staging copy) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / Certificate Manager (two staging copies) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / Certificate Manager (one staging copy) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / Certificate Manager (two staging copies) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / Certificate Manager (one staging copy) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / Certificate Manager (two staging copies) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / Certificate Manager (one staging copy) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / Certificate Manager (two staging copies) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / Certificate Manager (one staging copy) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / Certificate Manager (two staging copies) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Certificate Manager (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Certificate Manager (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Certificate Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Certificate Manager (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Certificate Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Certificate Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Certificate Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Certificate Manager (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Certificate Manager (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Certificate Manager (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Certificate Manager (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Certificate Manager (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Certificate Manager (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Certificate Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Certificate Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Certificate Manager (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Certificate Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Certificate Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Certificate Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Certificate Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Certificate Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Certificate Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Certificate Manager (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| Certificate Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Certificate Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Certificate Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Certificate Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Certificate Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Certificate Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Certificate Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Certificate Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Certificate Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Certificate Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Certificate Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Certificate Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Certificate Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Certificate Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Certificate Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Certificate Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Certificate Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Certificate Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Certificate Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate Manager bills deployed certificates per project: the first 100 a month are free, then USD 0.20 per certificate-month to 2,000 and 0.10 above. RSA-3072/4096 TLS and mTLS connections (0.45 per million) are not modeled; DNS challenges, hosting and durable adapter state remain separately allocated.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Certificate Manager pricing: [https://cloud.google.com/certificate-manager/pricing](https://cloud.google.com/certificate-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-168d6137ea51de31531b7d13e78d3b865c15f0df` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Certificate Manager pricing](https://cloud.google.com/certificate-manager/pricing).

## AWS ACM public certificates → Key Vault

Origin API: `aws::1.0.0::acm`. Target backend: `azure::1.0.0::keyvault`.

### AWS ACM public certificates · Active public certificates

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/4305b4f54375716e133f8c880c58b880bbb85d83dfe6dcb13bbe3370d22a1b0b-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/e01a03da0d0a16165160cbfcf1ce13a39f470ffc7035e14a877fb09e7c425627-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Active public certificates (certificates) | ACM Certificate | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | Key Vault (one staging copy) | 118.180178 | 118.180178 |
| 0 | 0 | Key Vault (two staging copies) | 236.358178 | 236.358178 |
| 10 | 0 | Key Vault (one staging copy) | 118.180178 | 118.180178 |
| 10 | 0 | Key Vault (two staging copies) | 236.358178 | 236.358178 |
| 100 | 0 | Key Vault (one staging copy) | 118.180178 | 118.180178 |
| 100 | 0 | Key Vault (two staging copies) | 236.358178 | 236.358178 |
| 1000 | 0 | Key Vault (one staging copy) | 118.180178 | 118.180178 |
| 1000 | 0 | Key Vault (two staging copies) | 236.358178 | 236.358178 |
| 10000 | 0 | Key Vault (one staging copy) | 118.180178 | 118.180178 |
| 10000 | 0 | Key Vault (two staging copies) | 236.358178 | 236.358178 |
| 100000 | 0 | Key Vault (one staging copy) | 118.180178 | 118.180178 |
| 100000 | 0 | Key Vault (two staging copies) | 236.358178 | 236.358178 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 certificates / Key Vault (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 certificates / Key Vault (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / Key Vault (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / Key Vault (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / Key Vault (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / Key Vault (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / Key Vault (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / Key Vault (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / Key Vault (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / Key Vault (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / Key Vault (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / Key Vault (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Key Vault (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Key Vault (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate operations bill as vault operations; a certificate renewal request through an integrated CA lists USD 3 and is not modeled. ACME DNS challenges, hosting and durable state require separate allocation.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-21c50979198015a1fe8b833ea00c654bdcb9a531` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

### AWS ACM public certificates · Certificate issuances and renewals

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/b1ee1f13eeb367e1cbb328a1c6c73556442d42cc9cc9216c536dbb3451b46b1f-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/8e07e85b2702334101ee679a21281f79cd91bc7ad7f23b36c83f788aee602ec8-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | Key Vault (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | Key Vault (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | Key Vault (one staging copy) | 118.17866 | 118.17866 |
| 10 | 0 | Key Vault (two staging copies) | 236.35666 | 236.35666 |
| 100 | 0 | Key Vault (one staging copy) | 118.1846 | 118.1846 |
| 100 | 0 | Key Vault (two staging copies) | 236.3626 | 236.3626 |
| 1000 | 0 | Key Vault (one staging copy) | 118.244 | 118.244 |
| 1000 | 0 | Key Vault (two staging copies) | 236.422 | 236.422 |
| 10000 | 0 | Key Vault (one staging copy) | 118.838 | 118.838 |
| 10000 | 0 | Key Vault (two staging copies) | 237.016 | 237.016 |
| 100000 | 0 | Key Vault (one staging copy) | 124.778 | 124.778 |
| 100000 | 0 | Key Vault (two staging copies) | 242.956 | 242.956 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 issuances/month / Key Vault (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 issuances/month / Key Vault (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / Key Vault (one staging copy) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / Key Vault (two staging copies) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / Key Vault (one staging copy) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / Key Vault (two staging copies) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / Key Vault (one staging copy) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / Key Vault (two staging copies) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / Key Vault (one staging copy) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / Key Vault (two staging copies) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / Key Vault (one staging copy) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / Key Vault (two staging copies) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Key Vault (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| Key Vault (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| Key Vault (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| Key Vault (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| Key Vault (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| Key Vault (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* Certificate operations bill as vault operations; a certificate renewal request through an integrated CA lists USD 3 and is not modeled. ACME DNS challenges, hosting and durable state require separate allocation.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-21c50979198015a1fe8b833ea00c654bdcb9a531` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## AWS ACM public certificates → OCI Certificate

Origin API: `aws::1.0.0::acm`. Target backend: `oci::1.0.0::certificate`.

### AWS ACM public certificates · Active public certificates

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/a10f6609549a1bd50144a01794e04f3c9d4efd0809a64fb28def3f6f01ba8765-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/b96ef9dc78df2bbce98d9ba57f3904e6630af8955a206bca3d0dcc10f8493dfe-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Active public certificates (certificates) | ACM Certificate | Target scenario | OCI Certificate | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 10000 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 100000 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 100000 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 certificates / OCI Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 certificates / OCI Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / OCI Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / OCI Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / OCI Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / OCI Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / OCI Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / OCI Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / OCI Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / OCI Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / OCI Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / OCI Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI Certificate (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| OCI Certificate (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| OCI Certificate (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| OCI Certificate (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| OCI Certificate (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| OCI Certificate (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| OCI Certificate (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI Certificate (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI Certificate (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| OCI Certificate (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Certificate (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Certificate (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Certificate (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Certificate (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Certificate (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Certificate (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Certificate (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Certificate (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Certificate (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI Certificate (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI Certificate (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI Certificate (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI Certificate (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI Certificate (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI Certificate (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI Certificate (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI Certificate (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI Certificate (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Certificate (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI Certificate (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Certificate (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Certificate (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI Certificate (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI Certificate (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Certificate (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Certificate (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Certificate (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Certificate (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI Certificate (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| OCI Certificate (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| OCI Certificate (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| OCI Certificate (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| OCI Certificate (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| OCI Certificate (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| OCI Certificate (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI Certificate (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI Certificate (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| OCI Certificate (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Certificate (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Certificate (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Certificate (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Certificate (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Certificate (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Certificate (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Certificate (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Certificate (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Certificate (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI Certificate (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI Certificate (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI Certificate (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI Certificate (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI Certificate (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI Certificate (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI Certificate (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI Certificate (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI Certificate (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Certificate (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI Certificate (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Certificate (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Certificate (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI Certificate (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI Certificate (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Certificate (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Certificate (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Certificate (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Certificate (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* OCI Certificates is free; DNS challenges, certificate hosting and durable adapter state remain separately allocated.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-fb98730445fbfc8c952a6f723c42107c8ee29aef` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [OCI price list](https://www.oracle.com/cloud/price-list/).

### AWS ACM public certificates · Certificate issuances and renewals

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/b619e8a5c5fb7b69f4d9fcf0610da3d7398d180a455c7b478f224ab5c9e0857d-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/324f80d72c805edb50480cbb0987d58e97f5fd172f2248c6d9664755550077a8-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | OCI Certificate | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 10000 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |
| 100000 | 0 | OCI Certificate (one staging copy) | 118.178 | 118.178 |
| 100000 | 0 | OCI Certificate (two staging copies) | 236.356 | 236.356 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 issuances/month / OCI Certificate (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 issuances/month / OCI Certificate (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / OCI Certificate (one staging copy) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / OCI Certificate (two staging copies) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / OCI Certificate (one staging copy) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / OCI Certificate (two staging copies) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / OCI Certificate (one staging copy) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / OCI Certificate (two staging copies) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / OCI Certificate (one staging copy) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / OCI Certificate (two staging copies) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / OCI Certificate (one staging copy) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / OCI Certificate (two staging copies) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI Certificate (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| OCI Certificate (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| OCI Certificate (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| OCI Certificate (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| OCI Certificate (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| OCI Certificate (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| OCI Certificate (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI Certificate (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI Certificate (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| OCI Certificate (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Certificate (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Certificate (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Certificate (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Certificate (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Certificate (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Certificate (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Certificate (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Certificate (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Certificate (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI Certificate (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI Certificate (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI Certificate (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI Certificate (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI Certificate (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI Certificate (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI Certificate (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI Certificate (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI Certificate (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Certificate (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI Certificate (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Certificate (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Certificate (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI Certificate (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI Certificate (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Certificate (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Certificate (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Certificate (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Certificate (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI Certificate (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| OCI Certificate (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| OCI Certificate (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| OCI Certificate (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| OCI Certificate (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| OCI Certificate (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| OCI Certificate (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI Certificate (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI Certificate (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| OCI Certificate (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Certificate (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Certificate (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Certificate (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Certificate (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Certificate (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Certificate (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Certificate (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Certificate (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Certificate (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI Certificate (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI Certificate (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI Certificate (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI Certificate (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI Certificate (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI Certificate (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI Certificate (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI Certificate (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI Certificate (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Certificate (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI Certificate (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Certificate (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Certificate (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI Certificate (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI Certificate (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Certificate (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Certificate (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Certificate (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Certificate (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* OCI Certificates is free; DNS challenges, certificate hosting and durable adapter state remain separately allocated.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-fb98730445fbfc8c952a6f723c42107c8ee29aef` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [OCI price list](https://www.oracle.com/cloud/price-list/).

## AWS ACM public certificates → cert-manager Certificate

Origin API: `aws::1.0.0::acm`. Target backend: `cert-manager::1.0.0::certificate`.

### AWS ACM public certificates · Active public certificates

Estimated monthly service charges by Active public certificates. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: in-cluster; currency: USD.

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/a185ab6c539abf8dee9b461b451d3545b10bbe96e2738938be1db72830776f0c-light.svg)

![AWS ACM public certificates · Active public certificates: monthly service charges by Active public certificates. Exact values are in the following table.](/images/diagrams/service-cost/cc18cc7b08303089f529ddef9a9f3183c00c55a90aaa7b28d4846af635f04966-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Active public certificates (certificates) | ACM Certificate | Target scenario | cert-manager Certificate | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 10000 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 100000 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 100000 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 certificates / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 certificates / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 certificates / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.00030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 certificates / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 certificates / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 certificates / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 0.30517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 certificates / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003817732115677321156773211567732116 / 0.007635464231354642313546423135464232 | 0.000007271870696528230774806117271870697 | 2 | 8 | 100 | 3.0517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| cert-manager Certificate (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| cert-manager Certificate (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (one staging copy) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (one staging copy) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (one staging copy) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (one staging copy) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (one staging copy) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (one staging copy) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (one staging copy) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| cert-manager Certificate (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| cert-manager Certificate (one staging copy) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (one staging copy) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| cert-manager Certificate (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| cert-manager Certificate (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (two staging copies) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (two staging copies) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (two staging copies) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (two staging copies) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (two staging copies) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (two staging copies) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (two staging copies) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| cert-manager Certificate (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| cert-manager Certificate (two staging copies) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (two staging copies) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → in-cluster, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* cert-manager (Apache-2.0) with an ACME issuer has no vendor tariff and Let's Encrypt issuance is free; the controller's pods use node capacity, and DNS-01 challenge records bill under the DNS provider.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* cert-manager license: [https://github.com/cert-manager/cert-manager/blob/master/LICENSE](https://github.com/cert-manager/cert-manager/blob/master/LICENSE)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-b9997b072d064101c5df2449030afac695fbe44e` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [cert-manager license](https://github.com/cert-manager/cert-manager/blob/master/LICENSE).

### AWS ACM public certificates · Certificate issuances and renewals

Estimated monthly service charges by Certificate issuances and renewals. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: in-cluster; currency: USD.

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/8a59252a72f4f4da2faf6431fc3640a47f5ce0e1ebe3a3633576a560b4602757-light.svg)

![AWS ACM public certificates · Certificate issuances and renewals: monthly service charges by Certificate issuances and renewals. Exact values are in the following table.](/images/diagrams/service-cost/461b4ca271a42442dfd24e4d5314f8eb3d85fa7fe60228169c403e6895cc1a6d-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Certificate issuances and renewals (issuances/month) | ACM Certificate | Target scenario | cert-manager Certificate | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 10000 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |
| 100000 | 0 | cert-manager Certificate (one staging copy) | 118.178 | 118.178 |
| 100000 | 0 | cert-manager Certificate (two staging copies) | 236.356 | 236.356 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 issuances/month / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 issuances/month / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 issuances/month / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003808980213089802130898021308980213 / 0.007617960426179604261796042617960426 | 0.000007255200405885337392186707255200406 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 issuances/month / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.003843226788432267884322678843226788 / 0.007686453576864535768645357686453576 | 0.000007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 issuances/month / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.004185692541856925418569254185692542 / 0.008371385083713850837138508371385084 | 0.000007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 issuances/month / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.007610350076103500761035007610350076 / 0.015220700152207001522070015220700152 | 0.00001449590490686381097340001449590491 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / cert-manager Certificate (one staging copy) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 issuances/month / cert-manager Certificate (two staging copies) | PlanningAssumption | 0.04185692541856925418569254185692542 / 0.08371385083713850837138508371385084 | 0.00007972747698775096035370007972747699 | 2 | 8 | 100 | 0.0030517578125 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| cert-manager Certificate (one staging copy) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (one staging copy) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (one staging copy) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (one staging copy) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| cert-manager Certificate (one staging copy) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (one staging copy) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (one staging copy) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (one staging copy) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (one staging copy) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (one staging copy) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (one staging copy) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (one staging copy) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (one staging copy) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (one staging copy) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| cert-manager Certificate (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| cert-manager Certificate (one staging copy) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (one staging copy) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| cert-manager Certificate (two staging copies) | Origin list price · Public non-exportable certificate inventory | 0 | USD/certificate-month |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate issues and renewals | 0 | USD/issuances |
| cert-manager Certificate (two staging copies) | Origin list price · Certificate management reads | 0 | USD/requests |
| cert-manager Certificate (two staging copies) | Provider operations per issuance | 20 | operations/issuance |
| cert-manager Certificate (two staging copies) | Physical certificate and lifecycle state | 32768 | bytes/certificate |
| cert-manager Certificate (two staging copies) | Issuance retry multiplier | 1.1 | multiplier |
| cert-manager Certificate (two staging copies) | Target price guess · read | 0 | USD/read |
| cert-manager Certificate (two staging copies) | Target price guess · write | 0 | USD/write |
| cert-manager Certificate (two staging copies) | Target price guess · provider operation | 0 | USD/provider operation |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| cert-manager Certificate (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| cert-manager Certificate (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| cert-manager Certificate (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| cert-manager Certificate (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| cert-manager Certificate (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| cert-manager Certificate (two staging copies) | Target price guess · input token | 0 | USD/input token |
| cert-manager Certificate (two staging copies) | Target price guess · output token | 0 | USD/output token |
| cert-manager Certificate (two staging copies) | Target monthly base charge | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Approximate target service minimum | 0 | USD/month |
| cert-manager Certificate (two staging copies) | Minimum primary CPU | 2 | vCPU |
| cert-manager Certificate (two staging copies) | Minimum primary RAM | 8 | GiB |
| cert-manager Certificate (two staging copies) | Minimum primary disk | 100 | GiB |
| cert-manager Certificate (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| cert-manager Certificate (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| cert-manager Certificate (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| cert-manager Certificate (two staging copies) | Planning peak / mean work | 2 | multiplier |
| cert-manager Certificate (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| cert-manager Certificate (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| cert-manager Certificate (two staging copies) | Planning disk utilization | 0.8 | fraction |
| cert-manager Certificate (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| cert-manager Certificate (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| cert-manager Certificate (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| cert-manager Certificate (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| cert-manager Certificate (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory remains at its authored default; issuance and renewal traffic varies independently. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → in-cluster, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Public non-exportable source certificates have a zero authored source tariff. Exportable certificates and private-CA certificates require different models.
* Certificate storage, issuance polling, DNS challenges and adapter state differ from load-balancer traffic. Certificate trust and issuer availability remain backend-specific.
* The Azure native-provisioning Key Vault profile can use self-signed certificates; it must not be presented as the same public-trust workflow as the separate ACME backend.
* cert-manager (Apache-2.0) with an ACME issuer has no vendor tariff and Let's Encrypt issuance is free; the controller's pods use node capacity, and DNS-01 challenge records bill under the DNS provider.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Certificate Manager pricing: [https://aws.amazon.com/certificate-manager/pricing/](https://aws.amazon.com/certificate-manager/pricing/)
* AWS Price List API, ACM offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json)
* cert-manager license: [https://github.com/cert-manager/cert-manager/blob/master/LICENSE](https://github.com/cert-manager/cert-manager/blob/master/LICENSE)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* ACM Private CA, exportable public certificates, paid external CA fees, authoritative DNS zones/queries and load-balancer/data-transfer charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-b9997b072d064101c5df2449030afac695fbe44e` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Certificate Manager pricing](https://aws.amazon.com/certificate-manager/pricing/), [AWS Price List API, ACM offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/ACM/current/us-east-1/index.json), [cert-manager license](https://github.com/cert-manager/cert-manager/blob/master/LICENSE).

See the [service catalog](/byoc/service-adapters/catalog.md) for operation coverage, supported directions and backend limitations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.