> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM costs

> Compare IAM backend choices using explicit service-adapter planning assumptions.

Tensor9 BYOC planning comparisons for `aws::1.0.0::iam`, with backend choices shown together. Read [how Tensor9 estimates service-adapter costs](/byoc/costs/overview.md) for price scope and capacity qualification, or return to [additional services](/byoc/costs/additional-services.md).

## AWS IAM and STS → Cedar

Origin API: `aws::1.0.0::iam`. Target backend: `cedar::1.0.0::policy`.

### AWS IAM and STS · Local authorization decisions

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/48183114ddfa45a2a205df8ec15f8dbad97ffa9c2dd0ded8ef88a96682c03b54-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/1390595cdd8d73b36a603a2be580f25775b57ae1edd695f7ebfbc993b3a740ae-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Local authorization decisions (operations/s) | IAM | Target scenario | Cedar | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 0 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 1 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 1 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 10 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 10 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 100 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 100 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 1000 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 1000 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 10000 | 0 | Cedar (one copy) | 1144.33824 | 1144.33824 |
| 10000 | 0 | Cedar (two copies) | 2288.67648 | 2288.67648 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Cedar (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Cedar (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Cedar (one copy) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Cedar (two copies) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Cedar (one copy) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Cedar (two copies) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Cedar (one copy) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Cedar (two copies) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Cedar (one copy) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Cedar (two copies) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Cedar (one copy) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Cedar (two copies) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cedar (one copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (one copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (one copy) | Principals and roles | 1000 | principals |
| Cedar (one copy) | Policies per principal | 2 | policies/principal |
| Cedar (one copy) | Mean policy document size | 4096 | bytes |
| Cedar (one copy) | Policy record expansion | 1.5 | multiplier |
| Cedar (one copy) | Management requests that mutate state | 0.1 | fraction |
| Cedar (one copy) | Target price guess · read | 0 | USD/read |
| Cedar (one copy) | Target price guess · write | 0 | USD/write |
| Cedar (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (one copy) | Target price guess · input token | 0 | USD/input token |
| Cedar (one copy) | Target price guess · output token | 0 | USD/output token |
| Cedar (one copy) | Target monthly base charge | 0 | USD/month |
| Cedar (one copy) | Approximate target service minimum | 0 | USD/month |
| Cedar (one copy) | Minimum primary CPU | 2 | vCPU |
| Cedar (one copy) | Minimum primary RAM | 8 | GiB |
| Cedar (one copy) | Minimum primary disk | 100 | GiB |
| Cedar (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cedar (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cedar (one copy) | Planning peak / mean work | 2 | multiplier |
| Cedar (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (one copy) | Planning disk utilization | 0.8 | fraction |
| Cedar (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cedar (two copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (two copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (two copies) | Principals and roles | 1000 | principals |
| Cedar (two copies) | Policies per principal | 2 | policies/principal |
| Cedar (two copies) | Mean policy document size | 4096 | bytes |
| Cedar (two copies) | Policy record expansion | 1.5 | multiplier |
| Cedar (two copies) | Management requests that mutate state | 0.1 | fraction |
| Cedar (two copies) | Target price guess · read | 0 | USD/read |
| Cedar (two copies) | Target price guess · write | 0 | USD/write |
| Cedar (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (two copies) | Target price guess · input token | 0 | USD/input token |
| Cedar (two copies) | Target price guess · output token | 0 | USD/output token |
| Cedar (two copies) | Target monthly base charge | 0 | USD/month |
| Cedar (two copies) | Approximate target service minimum | 0 | USD/month |
| Cedar (two copies) | Minimum primary CPU | 2 | vCPU |
| Cedar (two copies) | Minimum primary RAM | 8 | GiB |
| Cedar (two copies) | Minimum primary disk | 100 | GiB |
| Cedar (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cedar (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cedar (two copies) | Planning peak / mean work | 2 | multiplier |
| Cedar (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (two copies) | Planning disk utilization | 0.8 | fraction |
| Cedar (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Self-hosted target: Cedar (Apache-2.0, [https://github.com/cedar-policy/cedar/blob/main/LICENSE](https://github.com/cedar-policy/cedar/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-2337a2bb066032b30f6de3e2e31d3c204810929d` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

### AWS IAM and STS · IAM / STS management requests

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/6fd850dff4d486a488ae1466fb6111874f4c8202b20f4303f829def22b2e0a35-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/2407e204428d38e1aff256109796001b86afe4abd4eb0a07cb994357e90e13ca-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| IAM / STS management requests (operations/s) | IAM | Target scenario | Cedar | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 0 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 1 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 1 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 10 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 10 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 100 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 100 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 1000 | 0 | Cedar (one copy) | 80.89614 | 80.89614 |
| 1000 | 0 | Cedar (two copies) | 161.79228 | 161.79228 |
| 10000 | 0 | Cedar (one copy) | 1144.33824 | 1144.33824 |
| 10000 | 0 | Cedar (two copies) | 2288.67648 | 2288.67648 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Cedar (one copy) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Cedar (two copies) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Cedar (one copy) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Cedar (two copies) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Cedar (one copy) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Cedar (two copies) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Cedar (one copy) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Cedar (two copies) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Cedar (one copy) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Cedar (two copies) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Cedar (one copy) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Cedar (two copies) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cedar (one copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (one copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (one copy) | Principals and roles | 1000 | principals |
| Cedar (one copy) | Policies per principal | 2 | policies/principal |
| Cedar (one copy) | Mean policy document size | 4096 | bytes |
| Cedar (one copy) | Policy record expansion | 1.5 | multiplier |
| Cedar (one copy) | Management requests that mutate state | 0.1 | fraction |
| Cedar (one copy) | Target price guess · read | 0 | USD/read |
| Cedar (one copy) | Target price guess · write | 0 | USD/write |
| Cedar (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (one copy) | Target price guess · input token | 0 | USD/input token |
| Cedar (one copy) | Target price guess · output token | 0 | USD/output token |
| Cedar (one copy) | Target monthly base charge | 0 | USD/month |
| Cedar (one copy) | Approximate target service minimum | 0 | USD/month |
| Cedar (one copy) | Minimum primary CPU | 2 | vCPU |
| Cedar (one copy) | Minimum primary RAM | 8 | GiB |
| Cedar (one copy) | Minimum primary disk | 100 | GiB |
| Cedar (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cedar (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cedar (one copy) | Planning peak / mean work | 2 | multiplier |
| Cedar (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (one copy) | Planning disk utilization | 0.8 | fraction |
| Cedar (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cedar (two copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (two copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (two copies) | Principals and roles | 1000 | principals |
| Cedar (two copies) | Policies per principal | 2 | policies/principal |
| Cedar (two copies) | Mean policy document size | 4096 | bytes |
| Cedar (two copies) | Policy record expansion | 1.5 | multiplier |
| Cedar (two copies) | Management requests that mutate state | 0.1 | fraction |
| Cedar (two copies) | Target price guess · read | 0 | USD/read |
| Cedar (two copies) | Target price guess · write | 0 | USD/write |
| Cedar (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (two copies) | Target price guess · input token | 0 | USD/input token |
| Cedar (two copies) | Target price guess · output token | 0 | USD/output token |
| Cedar (two copies) | Target monthly base charge | 0 | USD/month |
| Cedar (two copies) | Approximate target service minimum | 0 | USD/month |
| Cedar (two copies) | Minimum primary CPU | 2 | vCPU |
| Cedar (two copies) | Minimum primary RAM | 8 | GiB |
| Cedar (two copies) | Minimum primary disk | 100 | GiB |
| Cedar (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cedar (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cedar (two copies) | Planning peak / mean work | 2 | multiplier |
| Cedar (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (two copies) | Planning disk utilization | 0.8 | fraction |
| Cedar (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Self-hosted target: Cedar (Apache-2.0, [https://github.com/cedar-policy/cedar/blob/main/LICENSE](https://github.com/cedar-policy/cedar/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-2337a2bb066032b30f6de3e2e31d3c204810929d` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## AWS IAM and STS → IAM

Origin API: `aws::1.0.0::iam`. Target backend: `azure::1.0.0::iam`.

**Native or deployment mapping.** This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels. Cost estimates describe the selected service resources; operation coverage remains separate.

### AWS IAM and STS · Local authorization decisions

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/dae4d2715031915032ec396fb618ce2a93f46b0966e4af8f39a340570f1a070e-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/e4de67187d7b6a1e77571aa3de0523e8404b08f5fc4e4eb02c4b868a34da3509-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Local authorization decisions (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | IAM (one staging copy) | 1635.848 | 1635.848 |
| 10000 | 0 | IAM (two staging copies) | 3271.696 | 3271.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / IAM (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / IAM (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (one staging copy) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (two staging copies) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (one staging copy) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (two staging copies) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (one staging copy) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (two staging copies) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (one staging copy) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (two staging copies) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (one staging copy) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (two staging copies) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* What is Azure role-based access control (Azure RBAC)?: [https://learn.microsoft.com/en-us/azure/role-based-access-control/overview](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-4aa30b86f1d9e528a7c4e3b167be549830f739b3` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [What is Azure role-based access control (Azure RBAC)?](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview).

### AWS IAM and STS · IAM / STS management requests

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/a0222a025e5717c894e66ecf580be3e24f5a04a51b04f6f564508a379a04c5b5-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/b31dc977fec65f328c0b356e3565a40635eb90b89bde6d21196dc6f293b6aaeb-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| IAM / STS management requests (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | IAM (one staging copy) | 1635.848 | 1635.848 |
| 10000 | 0 | IAM (two staging copies) | 3271.696 | 3271.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / IAM (one staging copy) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / IAM (two staging copies) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (one staging copy) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (two staging copies) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (one staging copy) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (two staging copies) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (one staging copy) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (two staging copies) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (one staging copy) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (two staging copies) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (one staging copy) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (two staging copies) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* What is Azure role-based access control (Azure RBAC)?: [https://learn.microsoft.com/en-us/azure/role-based-access-control/overview](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-4aa30b86f1d9e528a7c4e3b167be549830f739b3` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [What is Azure role-based access control (Azure RBAC)?](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview).

## AWS IAM and STS → IAM

Origin API: `aws::1.0.0::iam`. Target backend: `google::1.0.0::iam`.

**Native or deployment mapping.** This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels. Cost estimates describe the selected service resources; operation coverage remains separate.

### AWS IAM and STS · Local authorization decisions

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/2b227d2c072dd603054ab940d638c3d85694305cd6c35205dc9d0aae727773e2-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/1bcc0167f47451e9e7112388f4110a5358c7b0ccf052bace124be8427bf5506e-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Local authorization decisions (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | IAM (one staging copy) | 1635.848 | 1635.848 |
| 10000 | 0 | IAM (two staging copies) | 3271.696 | 3271.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / IAM (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / IAM (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (one staging copy) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (two staging copies) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (one staging copy) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (two staging copies) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (one staging copy) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (two staging copies) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (one staging copy) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (two staging copies) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (one staging copy) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (two staging copies) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* IAM pricing: [https://cloud.google.com/iam/pricing](https://cloud.google.com/iam/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9ae61cc2693ea509da57c8030bc42025f671c79b` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [IAM pricing](https://cloud.google.com/iam/pricing).

### AWS IAM and STS · IAM / STS management requests

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/85bb4b829b273570b344cd495d3c3a56e61d6dbb7166f9503ca4a76d351d5b2d-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/a123ce51ee99ec527348ebc429203cb73551d2edc1d6ef4c0eb2c352b151dc41-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| IAM / STS management requests (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | IAM (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | IAM (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | IAM (one staging copy) | 1635.848 | 1635.848 |
| 10000 | 0 | IAM (two staging copies) | 3271.696 | 3271.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / IAM (one staging copy) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / IAM (two staging copies) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (one staging copy) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / IAM (two staging copies) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (one staging copy) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / IAM (two staging copies) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (one staging copy) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / IAM (two staging copies) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (one staging copy) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / IAM (two staging copies) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (one staging copy) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / IAM (two staging copies) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* IAM pricing: [https://cloud.google.com/iam/pricing](https://cloud.google.com/iam/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9ae61cc2693ea509da57c8030bc42025f671c79b` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [IAM pricing](https://cloud.google.com/iam/pricing).

## AWS IAM and STS → OCI IAM

Origin API: `aws::1.0.0::iam`. Target backend: `oci::1.0.0::iam`.

**Native or deployment mapping.** This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels. Cost estimates describe the selected service resources; operation coverage remains separate.

### AWS IAM and STS · Local authorization decisions

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/cb389dcccef8a83347b7a4fd1fcd2dc5014919b832c307857abcf1a7a3fdcd6a-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](/images/diagrams/service-cost/20e08d8b1d55893ff08692986ced280274eafe205efdfa93249bd9a0610127ec-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Local authorization decisions (operations/s) | IAM | Target scenario | OCI IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 1 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 1 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | OCI IAM (one staging copy) | 1635.848 | 1635.848 |
| 10000 | 0 | OCI IAM (two staging copies) | 3271.696 | 3271.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 1.380517503805175038051750380517504 / 2.761035007610350076103500761035008 | 0.00262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 10.3805175038051750380517503805175 / 20.761035007610350076103500761035 | 0.01977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 100.3805175038051750380517503805175 / 200.761035007610350076103500761035 | 0.1912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 1000.380517503805175038051750380518 / 2000.761035007610350076103500761036 | 1.905486700007247952453431905486701 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 10000.38051750380517503805175038052 / 20000.76103500761035007610350076104 | 19.04834384286439080959628904834385 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (one staging copy) | Principals and roles | 1000 | principals |
| OCI IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| OCI IAM (one staging copy) | Mean policy document size | 4096 | bytes |
| OCI IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (two staging copies) | Principals and roles | 1000 | principals |
| OCI IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| OCI IAM (two staging copies) | Mean policy document size | 4096 | bytes |
| OCI IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs. OCI bills only identity-domain premium or external users, SMS and tokens above 10,000 a month, none of which this family uses.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9efbb4ad5b81bf0caeda01c49cfdf2dd9b017b71` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [OCI price list](https://www.oracle.com/cloud/price-list/).

### AWS IAM and STS · IAM / STS management requests

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/2bd130a0118141944fb85eeda65dc1d53012266959954f68f9d24210a779a4a7-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](/images/diagrams/service-cost/fe257c540af66bf16acfeac42bcb044c87d135f9cdd5ebb4e6fa2aadf1afc61c-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| IAM / STS management requests (operations/s) | IAM | Target scenario | OCI IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 0 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 1 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 1 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 10 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 10 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 100 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 100 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 1000 | 0 | OCI IAM (one staging copy) | 118.178 | 118.178 |
| 1000 | 0 | OCI IAM (two staging copies) | 236.356 | 236.356 |
| 10000 | 0 | OCI IAM (one staging copy) | 1635.848 | 1635.848 |
| 10000 | 0 | OCI IAM (two staging copies) | 3271.696 | 3271.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 3.805175038051750380517503805175038 / 7.610350076103500761035007610350076 | 0.007247952453431905486700007247952453 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 4.805175038051750380517503805175038 / 9.610350076103500761035007610350076 | 0.009152714358193810248604769152714358 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 13.80517503805175038051750380517504 / 27.61035007610350076103500761035008 | 0.0262955715010509531057476262955715 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 103.805175038051750380517503805175 / 207.61035007610350076103500761035 | 0.1977241429296223816771761977241429 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 1003.805175038051750380517503805175 / 2007.61035007610350076103500761035 | 1.912009857215336667391461912009857 | 2 | 8 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI IAM (one staging copy) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI IAM (two staging copies) | PlanningAssumption | 10003.80517503805175038051750380518 / 20007.61035007610350076103500761036 | 19.05486700007247952453431905486701 | 32 | 128 | 100 | 0.011444091796875 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (one staging copy) | Principals and roles | 1000 | principals |
| OCI IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| OCI IAM (one staging copy) | Mean policy document size | 4096 | bytes |
| OCI IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (two staging copies) | Principals and roles | 1000 | principals |
| OCI IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| OCI IAM (two staging copies) | Mean policy document size | 4096 | bytes |
| OCI IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs. OCI bills only identity-domain premium or external users, SMS and tokens above 10,000 a month, none of which this family uses.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9efbb4ad5b81bf0caeda01c49cfdf2dd9b017b71` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [OCI price list](https://www.oracle.com/cloud/price-list/).

See the [service catalog](/byoc/service-adapters/catalog.md) for operation coverage, supported directions and backend limitations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.