> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KMS Keys costs

> Compare KMS Keys backend choices using explicit service-adapter planning assumptions.

Tensor9 BYOC planning comparisons for `aws::1.0.0::kms`, with backend choices shown together. Read [how Tensor9 estimates service-adapter costs](/byoc/costs/overview.md) for price scope and capacity qualification, or return to [additional services](/byoc/costs/additional-services.md).

## AWS KMS → Cloud KMS

Origin API: `aws::1.0.0::kms`. Target backend: `google::1.0.0::kms`.

### AWS KMS · Crypto requests

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/91d91ee7769001de44bf1b89538395c5b0a9318ba8af948541402ddfeb3c6f4b-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/201164424b2ed2cd69ade5ddffdba38fb17b4c60f6c75b9900c4a33b7cfb1a15-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Crypto requests (operations/s) | KMS Keys | Target scenario | Cloud KMS | Difference |
| -: | -: | - | -: | -: |
| 0 | 100 | Cloud KMS (one staging copy) | 130.178 | 30.178 |
| 0 | 100 | Cloud KMS (two staging copies) | 248.356 | 148.356 |
| 1 | 107.884 | Cloud KMS (one staging copy) | 138.4562 | 30.5722 |
| 1 | 107.884 | Cloud KMS (two staging copies) | 256.6342 | 148.7502 |
| 10 | 178.84 | Cloud KMS (one staging copy) | 212.96 | 34.12 |
| 10 | 178.84 | Cloud KMS (two staging copies) | 331.138 | 152.298 |
| 100 | 888.4 | Cloud KMS (one staging copy) | 957.998 | 69.598 |
| 100 | 888.4 | Cloud KMS (two staging copies) | 1076.176 | 187.776 |
| 1000 | 7984 | Cloud KMS (one staging copy) | 8408.378 | 424.378 |
| 1000 | 7984 | Cloud KMS (two staging copies) | 8526.556 | 542.556 |
| 10000 | 78940 | Cloud KMS (one staging copy) | 84429.848 | 5489.848 |
| 10000 | 78940 | Cloud KMS (two staging copies) | 86065.696 | 7125.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Cloud KMS (one staging copy) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Cloud KMS (two staging copies) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Cloud KMS (one staging copy) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Cloud KMS (two staging copies) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Cloud KMS (one staging copy) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Cloud KMS (two staging copies) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Cloud KMS (one staging copy) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Cloud KMS (two staging copies) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Cloud KMS (one staging copy) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Cloud KMS (two staging copies) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Cloud KMS (one staging copy) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Cloud KMS (two staging copies) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cloud KMS (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| Cloud KMS (one staging copy) | Target price guess · read | 0 | USD/read |
| Cloud KMS (one staging copy) | Target price guess · write | 0 | USD/write |
| Cloud KMS (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (one staging copy) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (one staging copy) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (one staging copy) | Minimum primary disk | 100 | GiB |
| Cloud KMS (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cloud KMS (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cloud KMS (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cloud KMS (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| Cloud KMS (two staging copies) | Target price guess · read | 0 | USD/read |
| Cloud KMS (two staging copies) | Target price guess · write | 0 | USD/write |
| Cloud KMS (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (two staging copies) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (two staging copies) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (two staging copies) | Minimum primary disk | 100 | GiB |
| Cloud KMS (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cloud KMS (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cloud KMS (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Resource inventory is retained SOFTWARE key versions; symmetric crypto work prices managedOperations and admin operations are free. HSM versions list USD 1/month and EXTERNAL 3/month.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Cloud KMS pricing: [https://cloud.google.com/kms/pricing](https://cloud.google.com/kms/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-41eda65ede57a26b9cc517002df79c1d2a25e63d` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Cloud KMS pricing](https://cloud.google.com/kms/pricing).

### AWS KMS · Logical keys

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/a4aed8553932fe40333f7f32e426346fd38fdeb37ec69540d7ec01abb4a28c22-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/55691cf1d0e6938028ae038f883165da6897a4013b76a240a213abbeabb9de27-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Logical keys (keys) | KMS Keys | Target scenario | Cloud KMS | Difference |
| -: | -: | - | -: | -: |
| 0 | 3 | Cloud KMS (one staging copy) | 121.328 | 118.328 |
| 0 | 3 | Cloud KMS (two staging copies) | 239.506 | 236.506 |
| 10 | 13 | Cloud KMS (one staging copy) | 122.528 | 109.528 |
| 10 | 13 | Cloud KMS (two staging copies) | 240.706 | 227.706 |
| 100 | 103 | Cloud KMS (one staging copy) | 133.328 | 30.328 |
| 100 | 103 | Cloud KMS (two staging copies) | 251.506 | 148.506 |
| 1000 | 1003 | Cloud KMS (one staging copy) | 241.328 | -761.672 |
| 1000 | 1003 | Cloud KMS (two staging copies) | 359.506 | -643.494 |
| 10000 | 10003 | Cloud KMS (one staging copy) | 1321.328 | -8681.672 |
| 10000 | 10003 | Cloud KMS (two staging copies) | 1439.506 | -8563.494 |
| 100000 | 100003 | Cloud KMS (one staging copy) | 12121.328 | -87881.672 |
| 100000 | 100003 | Cloud KMS (two staging copies) | 12239.506 | -87763.494 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 keys / Cloud KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 keys / Cloud KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / Cloud KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / Cloud KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / Cloud KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / Cloud KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / Cloud KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / Cloud KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / Cloud KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / Cloud KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / Cloud KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / Cloud KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cloud KMS (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| Cloud KMS (one staging copy) | Target price guess · read | 0 | USD/read |
| Cloud KMS (one staging copy) | Target price guess · write | 0 | USD/write |
| Cloud KMS (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (one staging copy) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (one staging copy) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (one staging copy) | Minimum primary disk | 100 | GiB |
| Cloud KMS (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cloud KMS (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cloud KMS (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cloud KMS (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| Cloud KMS (two staging copies) | Target price guess · read | 0 | USD/read |
| Cloud KMS (two staging copies) | Target price guess · write | 0 | USD/write |
| Cloud KMS (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (two staging copies) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (two staging copies) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (two staging copies) | Minimum primary disk | 100 | GiB |
| Cloud KMS (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cloud KMS (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Cloud KMS (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Resource inventory is retained SOFTWARE key versions; symmetric crypto work prices managedOperations and admin operations are free. HSM versions list USD 1/month and EXTERNAL 3/month.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Cloud KMS pricing: [https://cloud.google.com/kms/pricing](https://cloud.google.com/kms/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-41eda65ede57a26b9cc517002df79c1d2a25e63d` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Cloud KMS pricing](https://cloud.google.com/kms/pricing).

## AWS KMS → HashiCorp Vault Transit

Origin API: `aws::1.0.0::kms`. Target backend: `vault::1.0.0::transit`.

### AWS KMS · Crypto requests

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/bc67aefeedea208968729ac8931e3b282c4326ff7bbba9896488a21a4a92445a-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/989bfeafb4839a420dc6ea9d7cf48889e20eb5c16986da81e2fdf54763893396-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Crypto requests (operations/s) | KMS Keys | Target scenario | HashiCorp Vault Transit | Difference |
| -: | -: | - | -: | -: |
| 0 | 100 | HashiCorp Vault Transit (one copy) | 80.89614 | -19.10386 |
| 0 | 100 | HashiCorp Vault Transit (two copies) | 161.79228 | 61.79228 |
| 1 | 107.884 | HashiCorp Vault Transit (one copy) | 80.89614 | -26.98786 |
| 1 | 107.884 | HashiCorp Vault Transit (two copies) | 161.79228 | 53.90828 |
| 10 | 178.84 | HashiCorp Vault Transit (one copy) | 80.89614 | -97.94386 |
| 10 | 178.84 | HashiCorp Vault Transit (two copies) | 161.79228 | -17.04772 |
| 100 | 888.4 | HashiCorp Vault Transit (one copy) | 80.89614 | -807.50386 |
| 100 | 888.4 | HashiCorp Vault Transit (two copies) | 161.79228 | -726.60772 |
| 1000 | 7984 | HashiCorp Vault Transit (one copy) | 80.89614 | -7903.10386 |
| 1000 | 7984 | HashiCorp Vault Transit (two copies) | 161.79228 | -7822.20772 |
| 10000 | 78940 | HashiCorp Vault Transit (one copy) | 1144.33824 | -77795.66176 |
| 10000 | 78940 | HashiCorp Vault Transit (two copies) | 2288.67648 | -76651.32352 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / HashiCorp Vault Transit (one copy) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / HashiCorp Vault Transit (two copies) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / HashiCorp Vault Transit (one copy) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / HashiCorp Vault Transit (two copies) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / HashiCorp Vault Transit (one copy) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / HashiCorp Vault Transit (two copies) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / HashiCorp Vault Transit (one copy) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / HashiCorp Vault Transit (two copies) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / HashiCorp Vault Transit (one copy) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / HashiCorp Vault Transit (two copies) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| HashiCorp Vault Transit (one copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| HashiCorp Vault Transit (one copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (one copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (one copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (one copy) | Target key versions per logical key | 2 | versions/key |
| HashiCorp Vault Transit (one copy) | Native crypto retry multiplier | 1.05 | multiplier |
| HashiCorp Vault Transit (one copy) | Durable key metadata and aliases | 16384 | bytes/key |
| HashiCorp Vault Transit (one copy) | Target price guess · read | 0 | USD/read |
| HashiCorp Vault Transit (one copy) | Target price guess · write | 0 | USD/write |
| HashiCorp Vault Transit (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| HashiCorp Vault Transit (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| HashiCorp Vault Transit (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| HashiCorp Vault Transit (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| HashiCorp Vault Transit (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| HashiCorp Vault Transit (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| HashiCorp Vault Transit (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| HashiCorp Vault Transit (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| HashiCorp Vault Transit (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| HashiCorp Vault Transit (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| HashiCorp Vault Transit (one copy) | Target price guess · input token | 0 | USD/input token |
| HashiCorp Vault Transit (one copy) | Target price guess · output token | 0 | USD/output token |
| HashiCorp Vault Transit (one copy) | Target monthly base charge | 0 | USD/month |
| HashiCorp Vault Transit (one copy) | Approximate target service minimum | 0 | USD/month |
| HashiCorp Vault Transit (one copy) | Minimum primary CPU | 2 | vCPU |
| HashiCorp Vault Transit (one copy) | Minimum primary RAM | 8 | GiB |
| HashiCorp Vault Transit (one copy) | Minimum primary disk | 100 | GiB |
| HashiCorp Vault Transit (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| HashiCorp Vault Transit (one copy) | Allocated share of provisioned cost | 1 | fraction |
| HashiCorp Vault Transit (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| HashiCorp Vault Transit (one copy) | Planning peak / mean work | 2 | multiplier |
| HashiCorp Vault Transit (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| HashiCorp Vault Transit (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| HashiCorp Vault Transit (one copy) | Planning disk utilization | 0.8 | fraction |
| HashiCorp Vault Transit (one copy) | Maintenance and log disk reserve | 20 | GiB |
| HashiCorp Vault Transit (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| HashiCorp Vault Transit (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| HashiCorp Vault Transit (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| HashiCorp Vault Transit (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| HashiCorp Vault Transit (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| HashiCorp Vault Transit (two copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| HashiCorp Vault Transit (two copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (two copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (two copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (two copies) | Target key versions per logical key | 2 | versions/key |
| HashiCorp Vault Transit (two copies) | Native crypto retry multiplier | 1.05 | multiplier |
| HashiCorp Vault Transit (two copies) | Durable key metadata and aliases | 16384 | bytes/key |
| HashiCorp Vault Transit (two copies) | Target price guess · read | 0 | USD/read |
| HashiCorp Vault Transit (two copies) | Target price guess · write | 0 | USD/write |
| HashiCorp Vault Transit (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| HashiCorp Vault Transit (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| HashiCorp Vault Transit (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| HashiCorp Vault Transit (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| HashiCorp Vault Transit (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| HashiCorp Vault Transit (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| HashiCorp Vault Transit (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| HashiCorp Vault Transit (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| HashiCorp Vault Transit (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| HashiCorp Vault Transit (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| HashiCorp Vault Transit (two copies) | Target price guess · input token | 0 | USD/input token |
| HashiCorp Vault Transit (two copies) | Target price guess · output token | 0 | USD/output token |
| HashiCorp Vault Transit (two copies) | Target monthly base charge | 0 | USD/month |
| HashiCorp Vault Transit (two copies) | Approximate target service minimum | 0 | USD/month |
| HashiCorp Vault Transit (two copies) | Minimum primary CPU | 2 | vCPU |
| HashiCorp Vault Transit (two copies) | Minimum primary RAM | 8 | GiB |
| HashiCorp Vault Transit (two copies) | Minimum primary disk | 100 | GiB |
| HashiCorp Vault Transit (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| HashiCorp Vault Transit (two copies) | Allocated share of provisioned cost | 1 | fraction |
| HashiCorp Vault Transit (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| HashiCorp Vault Transit (two copies) | Planning peak / mean work | 2 | multiplier |
| HashiCorp Vault Transit (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| HashiCorp Vault Transit (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| HashiCorp Vault Transit (two copies) | Planning disk utilization | 0.8 | fraction |
| HashiCorp Vault Transit (two copies) | Maintenance and log disk reserve | 20 | GiB |
| HashiCorp Vault Transit (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| HashiCorp Vault Transit (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| HashiCorp Vault Transit (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| HashiCorp Vault Transit (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| HashiCorp Vault Transit (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Self-hosted target: Vault community edition (Business Source License 1.1, [https://github.com/hashicorp/vault/blob/main/LICENSE](https://github.com/hashicorp/vault/blob/main/LICENSE), free to self-host); Vault Enterprise is quote-priced and not selected. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-fb56965b212a8c75b37e6365d7e717dfccb7185f` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

### AWS KMS · Logical keys

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/87300ae3b3fe147079d517a307e3b0713c4656a620e3b538504452f9866c4f52-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/fb30d1491c5ed70ddc53de62b0dc34026ab0d3400e062e7befa0561d6e85f98c-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Logical keys (keys) | KMS Keys | Target scenario | HashiCorp Vault Transit | Difference |
| -: | -: | - | -: | -: |
| 0 | 3 | HashiCorp Vault Transit (one copy) | 80.89614 | 77.89614 |
| 0 | 3 | HashiCorp Vault Transit (two copies) | 161.79228 | 158.79228 |
| 10 | 13 | HashiCorp Vault Transit (one copy) | 80.89614 | 67.89614 |
| 10 | 13 | HashiCorp Vault Transit (two copies) | 161.79228 | 148.79228 |
| 100 | 103 | HashiCorp Vault Transit (one copy) | 80.89614 | -22.10386 |
| 100 | 103 | HashiCorp Vault Transit (two copies) | 161.79228 | 58.79228 |
| 1000 | 1003 | HashiCorp Vault Transit (one copy) | 80.89614 | -922.10386 |
| 1000 | 1003 | HashiCorp Vault Transit (two copies) | 161.79228 | -841.20772 |
| 10000 | 10003 | HashiCorp Vault Transit (one copy) | 80.89614 | -9922.10386 |
| 10000 | 10003 | HashiCorp Vault Transit (two copies) | 161.79228 | -9841.20772 |
| 100000 | 100003 | HashiCorp Vault Transit (one copy) | 80.89614 | -99922.10386 |
| 100000 | 100003 | HashiCorp Vault Transit (two copies) | 161.79228 | -99841.20772 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 keys / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 keys / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / HashiCorp Vault Transit (one copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / HashiCorp Vault Transit (two copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| HashiCorp Vault Transit (one copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| HashiCorp Vault Transit (one copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (one copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (one copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (one copy) | Target key versions per logical key | 2 | versions/key |
| HashiCorp Vault Transit (one copy) | Native crypto retry multiplier | 1.05 | multiplier |
| HashiCorp Vault Transit (one copy) | Durable key metadata and aliases | 16384 | bytes/key |
| HashiCorp Vault Transit (one copy) | Target price guess · read | 0 | USD/read |
| HashiCorp Vault Transit (one copy) | Target price guess · write | 0 | USD/write |
| HashiCorp Vault Transit (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| HashiCorp Vault Transit (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| HashiCorp Vault Transit (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| HashiCorp Vault Transit (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| HashiCorp Vault Transit (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| HashiCorp Vault Transit (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| HashiCorp Vault Transit (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| HashiCorp Vault Transit (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| HashiCorp Vault Transit (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| HashiCorp Vault Transit (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| HashiCorp Vault Transit (one copy) | Target price guess · input token | 0 | USD/input token |
| HashiCorp Vault Transit (one copy) | Target price guess · output token | 0 | USD/output token |
| HashiCorp Vault Transit (one copy) | Target monthly base charge | 0 | USD/month |
| HashiCorp Vault Transit (one copy) | Approximate target service minimum | 0 | USD/month |
| HashiCorp Vault Transit (one copy) | Minimum primary CPU | 2 | vCPU |
| HashiCorp Vault Transit (one copy) | Minimum primary RAM | 8 | GiB |
| HashiCorp Vault Transit (one copy) | Minimum primary disk | 100 | GiB |
| HashiCorp Vault Transit (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| HashiCorp Vault Transit (one copy) | Allocated share of provisioned cost | 1 | fraction |
| HashiCorp Vault Transit (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| HashiCorp Vault Transit (one copy) | Planning peak / mean work | 2 | multiplier |
| HashiCorp Vault Transit (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| HashiCorp Vault Transit (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| HashiCorp Vault Transit (one copy) | Planning disk utilization | 0.8 | fraction |
| HashiCorp Vault Transit (one copy) | Maintenance and log disk reserve | 20 | GiB |
| HashiCorp Vault Transit (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| HashiCorp Vault Transit (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| HashiCorp Vault Transit (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| HashiCorp Vault Transit (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| HashiCorp Vault Transit (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| HashiCorp Vault Transit (two copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| HashiCorp Vault Transit (two copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (two copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (two copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| HashiCorp Vault Transit (two copies) | Target key versions per logical key | 2 | versions/key |
| HashiCorp Vault Transit (two copies) | Native crypto retry multiplier | 1.05 | multiplier |
| HashiCorp Vault Transit (two copies) | Durable key metadata and aliases | 16384 | bytes/key |
| HashiCorp Vault Transit (two copies) | Target price guess · read | 0 | USD/read |
| HashiCorp Vault Transit (two copies) | Target price guess · write | 0 | USD/write |
| HashiCorp Vault Transit (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| HashiCorp Vault Transit (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| HashiCorp Vault Transit (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| HashiCorp Vault Transit (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| HashiCorp Vault Transit (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| HashiCorp Vault Transit (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| HashiCorp Vault Transit (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| HashiCorp Vault Transit (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| HashiCorp Vault Transit (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| HashiCorp Vault Transit (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| HashiCorp Vault Transit (two copies) | Target price guess · input token | 0 | USD/input token |
| HashiCorp Vault Transit (two copies) | Target price guess · output token | 0 | USD/output token |
| HashiCorp Vault Transit (two copies) | Target monthly base charge | 0 | USD/month |
| HashiCorp Vault Transit (two copies) | Approximate target service minimum | 0 | USD/month |
| HashiCorp Vault Transit (two copies) | Minimum primary CPU | 2 | vCPU |
| HashiCorp Vault Transit (two copies) | Minimum primary RAM | 8 | GiB |
| HashiCorp Vault Transit (two copies) | Minimum primary disk | 100 | GiB |
| HashiCorp Vault Transit (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| HashiCorp Vault Transit (two copies) | Allocated share of provisioned cost | 1 | fraction |
| HashiCorp Vault Transit (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| HashiCorp Vault Transit (two copies) | Planning peak / mean work | 2 | multiplier |
| HashiCorp Vault Transit (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| HashiCorp Vault Transit (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| HashiCorp Vault Transit (two copies) | Planning disk utilization | 0.8 | fraction |
| HashiCorp Vault Transit (two copies) | Maintenance and log disk reserve | 20 | GiB |
| HashiCorp Vault Transit (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| HashiCorp Vault Transit (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| HashiCorp Vault Transit (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| HashiCorp Vault Transit (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| HashiCorp Vault Transit (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Self-hosted target: Vault community edition (Business Source License 1.1, [https://github.com/hashicorp/vault/blob/main/LICENSE](https://github.com/hashicorp/vault/blob/main/LICENSE), free to self-host); Vault Enterprise is quote-priced and not selected. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-fb56965b212a8c75b37e6365d7e717dfccb7185f` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## AWS KMS → Key Vault

Origin API: `aws::1.0.0::kms`. Target backend: `azure::1.0.0::keyvault`.

### AWS KMS · Crypto requests

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/bde55cb17df4fa9865c48215d2158580a8bdd2e65a402e52abe89ef4bace5527-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/2a5245fc23871e6e6e91ad1ce3de05e23921a04e3809a1454c0fb3f1bb45c512-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Crypto requests (operations/s) | KMS Keys | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 100 | Key Vault (one staging copy) | 118.178 | 18.178 |
| 0 | 100 | Key Vault (two staging copies) | 236.356 | 136.356 |
| 1 | 107.884 | Key Vault (one staging copy) | 126.4562 | 18.5722 |
| 1 | 107.884 | Key Vault (two staging copies) | 244.6342 | 136.7502 |
| 10 | 178.84 | Key Vault (one staging copy) | 200.96 | 22.12 |
| 10 | 178.84 | Key Vault (two staging copies) | 319.138 | 140.298 |
| 100 | 888.4 | Key Vault (one staging copy) | 945.998 | 57.598 |
| 100 | 888.4 | Key Vault (two staging copies) | 1064.176 | 175.776 |
| 1000 | 7984 | Key Vault (one staging copy) | 8396.378 | 412.378 |
| 1000 | 7984 | Key Vault (two staging copies) | 8514.556 | 530.556 |
| 10000 | 78940 | Key Vault (one staging copy) | 84417.848 | 5477.848 |
| 10000 | 78940 | Key Vault (two staging copies) | 86053.696 | 7113.696 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Key Vault (one staging copy) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Key Vault (two staging copies) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Key Vault (one staging copy) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Key Vault (two staging copies) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Key Vault (one staging copy) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Key Vault (two staging copies) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Key Vault (one staging copy) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Key Vault (two staging copies) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Key Vault (one staging copy) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Key Vault (two staging copies) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Key Vault (one staging copy) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Key Vault (two staging copies) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Key Vault (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Key Vault (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Key Vault crypto calls price managedOperations. Standard software-protected keys have no per-version storage meter; Premium HSM-protected keys list USD 1 per key-month and automated rotation 1 per rotation, neither selected.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-ef50affc42e0701bc747b2bf76645106c0ea8eb2` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

### AWS KMS · Logical keys

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/3117f7982cc41d2f7ceb8d996600b89420142f3bc715f7ac4f7facc30594c9dc-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/8329c3d19ff706f9a87cdb6c6412fcd1b71719464bf0617838efed8d65835e6b-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Logical keys (keys) | KMS Keys | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 3 | Key Vault (one staging copy) | 121.328 | 118.328 |
| 0 | 3 | Key Vault (two staging copies) | 239.506 | 236.506 |
| 10 | 13 | Key Vault (one staging copy) | 121.328 | 108.328 |
| 10 | 13 | Key Vault (two staging copies) | 239.506 | 226.506 |
| 100 | 103 | Key Vault (one staging copy) | 121.328 | 18.328 |
| 100 | 103 | Key Vault (two staging copies) | 239.506 | 136.506 |
| 1000 | 1003 | Key Vault (one staging copy) | 121.328 | -881.672 |
| 1000 | 1003 | Key Vault (two staging copies) | 239.506 | -763.494 |
| 10000 | 10003 | Key Vault (one staging copy) | 121.328 | -9881.672 |
| 10000 | 10003 | Key Vault (two staging copies) | 239.506 | -9763.494 |
| 100000 | 100003 | Key Vault (one staging copy) | 121.328 | -99881.672 |
| 100000 | 100003 | Key Vault (two staging copies) | 239.506 | -99763.494 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 keys / Key Vault (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 keys / Key Vault (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / Key Vault (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / Key Vault (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / Key Vault (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / Key Vault (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / Key Vault (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / Key Vault (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / Key Vault (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / Key Vault (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / Key Vault (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / Key Vault (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Key Vault (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Key Vault (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Key Vault crypto calls price managedOperations. Standard software-protected keys have no per-version storage meter; Premium HSM-protected keys list USD 1 per key-month and automated rotation 1 per rotation, neither selected.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-ef50affc42e0701bc747b2bf76645106c0ea8eb2` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## AWS KMS → OCI KMS

Origin API: `aws::1.0.0::kms`. Target backend: `oci::1.0.0::kms`.

### AWS KMS · Crypto requests

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/5dd164839a1e9c04e06ce7d3377cde2190faace212d2e3cb9f55c5bf245bed55-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/3910821c1b3487d9ed91ad1c3a2d90f3181b21fa9ecd135273fe02583f863e11-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Crypto requests (operations/s) | KMS Keys | Target scenario | OCI KMS | Difference |
| -: | -: | - | -: | -: |
| 0 | 100 | OCI KMS (one staging copy) | 118.178 | 18.178 |
| 0 | 100 | OCI KMS (two staging copies) | 236.356 | 136.356 |
| 1 | 107.884 | OCI KMS (one staging copy) | 118.178 | 10.294 |
| 1 | 107.884 | OCI KMS (two staging copies) | 236.356 | 128.472 |
| 10 | 178.84 | OCI KMS (one staging copy) | 118.178 | -60.662 |
| 10 | 178.84 | OCI KMS (two staging copies) | 236.356 | 57.516 |
| 100 | 888.4 | OCI KMS (one staging copy) | 118.178 | -770.222 |
| 100 | 888.4 | OCI KMS (two staging copies) | 236.356 | -652.044 |
| 1000 | 7984 | OCI KMS (one staging copy) | 118.178 | -7865.822 |
| 1000 | 7984 | OCI KMS (two staging copies) | 236.356 | -7747.644 |
| 10000 | 78940 | OCI KMS (one staging copy) | 1635.848 | -77304.152 |
| 10000 | 78940 | OCI KMS (two staging copies) | 3271.696 | -75668.304 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / OCI KMS (one staging copy) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / OCI KMS (two staging copies) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI KMS (one staging copy) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI KMS (two staging copies) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI KMS (one staging copy) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI KMS (two staging copies) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI KMS (one staging copy) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI KMS (two staging copies) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI KMS (one staging copy) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI KMS (two staging copies) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI KMS (one staging copy) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI KMS (two staging copies) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI KMS (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| OCI KMS (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| OCI KMS (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| OCI KMS (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| OCI KMS (one staging copy) | Target key versions per logical key | 2 | versions/key |
| OCI KMS (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| OCI KMS (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| OCI KMS (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI KMS (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI KMS (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI KMS (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI KMS (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI KMS (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI KMS (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI KMS (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI KMS (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI KMS (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI KMS (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI KMS (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI KMS (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI KMS (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI KMS (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI KMS (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI KMS (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI KMS (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI KMS (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI KMS (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI KMS (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI KMS (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI KMS (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI KMS (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI KMS (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI KMS (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI KMS (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI KMS (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI KMS (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI KMS (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI KMS (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI KMS (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI KMS (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| OCI KMS (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| OCI KMS (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| OCI KMS (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| OCI KMS (two staging copies) | Target key versions per logical key | 2 | versions/key |
| OCI KMS (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| OCI KMS (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| OCI KMS (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI KMS (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI KMS (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI KMS (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI KMS (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI KMS (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI KMS (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI KMS (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI KMS (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI KMS (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI KMS (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI KMS (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI KMS (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI KMS (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI KMS (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI KMS (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI KMS (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI KMS (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI KMS (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI KMS (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI KMS (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI KMS (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI KMS (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI KMS (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI KMS (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI KMS (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI KMS (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI KMS (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI KMS (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI KMS (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI KMS (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI KMS (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Software-protected Vault keys are free and OCI lists no per-operation Key Management charge. HSM-protected keys bill USD 0.5334 per key version-month above the first 20 (part B92092) and a private vault 3.724/hour (B90328); select those rates for HSM keys.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-df33f582467d15fa7f506d77977ee6fb958724c0` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [OCI price list](https://www.oracle.com/cloud/price-list/).

### AWS KMS · Logical keys

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/6823abfad2068356b9568dc55850539592dcb2ad3cded942fa85df17e02a7caa-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/f0b68dcc0e7f643160c4caabe6f6490ea249b47a6815688002f545f1cb27ebfc-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Logical keys (keys) | KMS Keys | Target scenario | OCI KMS | Difference |
| -: | -: | - | -: | -: |
| 0 | 3 | OCI KMS (one staging copy) | 118.178 | 115.178 |
| 0 | 3 | OCI KMS (two staging copies) | 236.356 | 233.356 |
| 10 | 13 | OCI KMS (one staging copy) | 118.178 | 105.178 |
| 10 | 13 | OCI KMS (two staging copies) | 236.356 | 223.356 |
| 100 | 103 | OCI KMS (one staging copy) | 118.178 | 15.178 |
| 100 | 103 | OCI KMS (two staging copies) | 236.356 | 133.356 |
| 1000 | 1003 | OCI KMS (one staging copy) | 118.178 | -884.822 |
| 1000 | 1003 | OCI KMS (two staging copies) | 236.356 | -766.644 |
| 10000 | 10003 | OCI KMS (one staging copy) | 118.178 | -9884.822 |
| 10000 | 10003 | OCI KMS (two staging copies) | 236.356 | -9766.644 |
| 100000 | 100003 | OCI KMS (one staging copy) | 118.178 | -99884.822 |
| 100000 | 100003 | OCI KMS (two staging copies) | 236.356 | -99766.644 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 keys / OCI KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 keys / OCI KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / OCI KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / OCI KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / OCI KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / OCI KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / OCI KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / OCI KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / OCI KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / OCI KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / OCI KMS (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / OCI KMS (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI KMS (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| OCI KMS (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| OCI KMS (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| OCI KMS (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| OCI KMS (one staging copy) | Target key versions per logical key | 2 | versions/key |
| OCI KMS (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| OCI KMS (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| OCI KMS (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI KMS (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI KMS (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI KMS (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI KMS (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI KMS (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI KMS (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI KMS (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI KMS (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI KMS (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI KMS (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI KMS (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI KMS (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI KMS (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI KMS (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI KMS (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI KMS (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI KMS (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI KMS (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI KMS (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI KMS (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI KMS (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI KMS (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI KMS (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI KMS (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI KMS (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI KMS (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI KMS (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI KMS (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI KMS (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI KMS (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI KMS (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI KMS (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| OCI KMS (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| OCI KMS (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| OCI KMS (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| OCI KMS (two staging copies) | Target key versions per logical key | 2 | versions/key |
| OCI KMS (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| OCI KMS (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| OCI KMS (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI KMS (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI KMS (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI KMS (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI KMS (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI KMS (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI KMS (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI KMS (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI KMS (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI KMS (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI KMS (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI KMS (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI KMS (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI KMS (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI KMS (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI KMS (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI KMS (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI KMS (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI KMS (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI KMS (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI KMS (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI KMS (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI KMS (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI KMS (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI KMS (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI KMS (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI KMS (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI KMS (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI KMS (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI KMS (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI KMS (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI KMS (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Software-protected Vault keys are free and OCI lists no per-operation Key Management charge. HSM-protected keys bill USD 0.5334 per key version-month above the first 20 (part B92092) and a private vault 3.724/hour (B90328); select those rates for HSM keys.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-df33f582467d15fa7f506d77977ee6fb958724c0` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [OCI price list](https://www.oracle.com/cloud/price-list/).

## AWS KMS → Scaleway Key Manager

Origin API: `aws::1.0.0::kms`. Target backend: `scaleway::1.0.0::key-manager`.

### AWS KMS · Crypto requests

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: fr-par; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/dfc5542723cb5c51238d27617acff6cb93c67764bfa0e3cbcefae270ae10dfe8-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](/images/diagrams/service-cost/0771753f30ac8de6c9110f2ebcd8376f65e5633e77495d2b3e550a412a44bf1d-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Crypto requests (operations/s) | KMS Keys | Target scenario | Scaleway Key Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 100 | Scaleway Key Manager (one staging copy) | 131.624 | 31.624 |
| 0 | 100 | Scaleway Key Manager (two staging copies) | 249.802 | 149.802 |
| 1 | 107.884 | Scaleway Key Manager (one staging copy) | 140.8997231 | 33.0157231 |
| 1 | 107.884 | Scaleway Key Manager (two staging copies) | 259.0777231 | 151.1937231 |
| 10 | 178.84 | Scaleway Key Manager (one staging copy) | 224.381231 | 45.541231 |
| 10 | 178.84 | Scaleway Key Manager (two staging copies) | 342.559231 | 163.719231 |
| 100 | 888.4 | Scaleway Key Manager (one staging copy) | 1059.19631 | 170.79631 |
| 100 | 888.4 | Scaleway Key Manager (two staging copies) | 1177.37431 | 288.97431 |
| 1000 | 7984 | Scaleway Key Manager (one staging copy) | 9407.3471 | 1423.3471 |
| 1000 | 7984 | Scaleway Key Manager (two staging copies) | 9525.5251 | 1541.5251 |
| 10000 | 78940 | Scaleway Key Manager (one staging copy) | 94406.525 | 15466.525 |
| 10000 | 78940 | Scaleway Key Manager (two staging copies) | 96042.373 | 17102.373 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0 / 0 | 0 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Scaleway Key Manager (one staging copy) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Scaleway Key Manager (two staging copies) | PlanningAssumption | 1 / 2 | 0.001904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Scaleway Key Manager (one staging copy) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Scaleway Key Manager (two staging copies) | PlanningAssumption | 10 / 20 | 0.01904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Scaleway Key Manager (one staging copy) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Scaleway Key Manager (two staging copies) | PlanningAssumption | 100 / 200 | 0.1904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Scaleway Key Manager (one staging copy) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Scaleway Key Manager (two staging copies) | PlanningAssumption | 1000 / 2000 | 1.904761904761904761904761904761905 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Scaleway Key Manager (one staging copy) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Scaleway Key Manager (two staging copies) | PlanningAssumption | 10000 / 20000 | 19.04761904761904761904761904761905 | 32 | 128 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Scaleway Key Manager (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Scaleway Key Manager (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Scaleway Key Manager (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Scaleway Key Manager (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Scaleway Key Manager (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Scaleway Key Manager (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Scaleway Key Manager (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| Scaleway Key Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Scaleway Key Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Scaleway Key Manager (one staging copy) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Key Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Key Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Key Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Key Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Key Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Key Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Key Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Key Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Key Manager (one staging copy) | Target list price · resource-month | 0.06723 | USD/resource-month |
| Scaleway Key Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Scaleway Key Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Scaleway Key Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Scaleway Key Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Scaleway Key Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Scaleway Key Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Scaleway Key Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Scaleway Key Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Scaleway Key Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Key Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Key Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Scaleway Key Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Key Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Key Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Scaleway Key Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Key Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Key Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Key Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Key Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Key Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Scaleway Key Manager (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Scaleway Key Manager (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Scaleway Key Manager (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Scaleway Key Manager (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Scaleway Key Manager (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Scaleway Key Manager (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Scaleway Key Manager (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| Scaleway Key Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Scaleway Key Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Scaleway Key Manager (two staging copies) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Key Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Key Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Key Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Key Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Key Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Key Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Key Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Key Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Key Manager (two staging copies) | Target list price · resource-month | 0.06723 | USD/resource-month |
| Scaleway Key Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Scaleway Key Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Scaleway Key Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Scaleway Key Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Scaleway Key Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Scaleway Key Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Scaleway Key Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Scaleway Key Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Scaleway Key Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Key Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Key Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Scaleway Key Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Key Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Key Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Scaleway Key Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Key Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Key Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Key Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Key Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Key Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → fr-par, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Resource inventory is retained symmetric key versions; symmetric key operations price managedOperations.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Scaleway Security and Account pricing: [https://www.scaleway.com/en/pricing/security-and-account/](https://www.scaleway.com/en/pricing/security-and-account/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-c745533c2747ace241c59068269f123df1adffd8` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Scaleway Security and Account pricing](https://www.scaleway.com/en/pricing/security-and-account/).

### AWS KMS · Logical keys

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: fr-par; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/58eef02c7585fa23b0f957819faf9e9e73d8b959ec2518102b77f3b93bfeed20-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](/images/diagrams/service-cost/6346a60fd80fbe5e2dbe5936fbf18766490c6b35935df893afb6bc29f9ef30f3-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Logical keys (keys) | KMS Keys | Target scenario | Scaleway Key Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 3 | Scaleway Key Manager (one staging copy) | 121.707575 | 118.707575 |
| 0 | 3 | Scaleway Key Manager (two staging copies) | 239.885575 | 236.885575 |
| 10 | 13 | Scaleway Key Manager (one staging copy) | 123.052175 | 110.052175 |
| 10 | 13 | Scaleway Key Manager (two staging copies) | 241.230175 | 228.230175 |
| 100 | 103 | Scaleway Key Manager (one staging copy) | 135.153575 | 32.153575 |
| 100 | 103 | Scaleway Key Manager (two staging copies) | 253.331575 | 150.331575 |
| 1000 | 1003 | Scaleway Key Manager (one staging copy) | 256.167575 | -746.832425 |
| 1000 | 1003 | Scaleway Key Manager (two staging copies) | 374.345575 | -628.654425 |
| 10000 | 10003 | Scaleway Key Manager (one staging copy) | 1466.307575 | -8536.692425 |
| 10000 | 10003 | Scaleway Key Manager (two staging copies) | 1584.485575 | -8418.514425 |
| 100000 | 100003 | Scaleway Key Manager (one staging copy) | 13567.707575 | -86435.292425 |
| 100000 | 100003 | Scaleway Key Manager (two staging copies) | 13685.885575 | -86317.114425 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 keys / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 keys / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 keys / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.000152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 keys / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.00152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 keys / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.0152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 keys / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 0.152587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / Scaleway Key Manager (one staging copy) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 keys / Scaleway Key Manager (two staging copies) | PlanningAssumption | 0.3805175038051750380517503805175038 / 0.7610350076103500761035007610350076 | 0.0007247952453431905486700007247952453 | 2 | 8 | 100 | 1.52587890625 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Scaleway Key Manager (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Scaleway Key Manager (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Scaleway Key Manager (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Scaleway Key Manager (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Scaleway Key Manager (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Scaleway Key Manager (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Scaleway Key Manager (one staging copy) | Durable key metadata and aliases | 16384 | bytes/key |
| Scaleway Key Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Scaleway Key Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Scaleway Key Manager (one staging copy) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Key Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Key Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Key Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Key Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Key Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Key Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Key Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Key Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Key Manager (one staging copy) | Target list price · resource-month | 0.06723 | USD/resource-month |
| Scaleway Key Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Scaleway Key Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Scaleway Key Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Scaleway Key Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Scaleway Key Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Scaleway Key Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Scaleway Key Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Scaleway Key Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Scaleway Key Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Key Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Key Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Scaleway Key Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Key Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Key Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Scaleway Key Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Key Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Key Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Key Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Key Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Key Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Scaleway Key Manager (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Scaleway Key Manager (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Scaleway Key Manager (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Scaleway Key Manager (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Scaleway Key Manager (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Scaleway Key Manager (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Scaleway Key Manager (two staging copies) | Durable key metadata and aliases | 16384 | bytes/key |
| Scaleway Key Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Scaleway Key Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Scaleway Key Manager (two staging copies) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Key Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Key Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Key Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Key Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Key Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Key Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Key Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Key Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Key Manager (two staging copies) | Target list price · resource-month | 0.06723 | USD/resource-month |
| Scaleway Key Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Scaleway Key Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Scaleway Key Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Scaleway Key Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Scaleway Key Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Scaleway Key Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Scaleway Key Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Scaleway Key Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Scaleway Key Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Key Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Key Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Scaleway Key Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Key Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Key Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Scaleway Key Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Key Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Key Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Key Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Key Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Key Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → fr-par, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Resource inventory is retained symmetric key versions; symmetric key operations price managedOperations.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Scaleway Security and Account pricing: [https://www.scaleway.com/en/pricing/security-and-account/](https://www.scaleway.com/en/pricing/security-and-account/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm tariffs, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-c745533c2747ace241c59068269f123df1adffd8` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Scaleway Security and Account pricing](https://www.scaleway.com/en/pricing/security-and-account/).

See the [service catalog](/byoc/service-adapters/catalog.md) for operation coverage, supported directions and backend limitations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.