> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Manager costs

> Compare Secrets Manager backend choices using explicit service-adapter planning assumptions.

Tensor9 BYOC planning comparisons for `aws::1.0.0::secretsmanager`, with backend choices shown together. Read [how Tensor9 estimates service-adapter costs](/byoc/costs/overview.md) for price scope and capacity qualification, or return to [additional services](/byoc/costs/additional-services.md).

## AWS Secrets Manager → Key Vault

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `azure::1.0.0::keyvault`.

### AWS Secrets Manager · Secret API reads

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/6af472628f18286dcfd367991d6bb1cdb8fcfa5b9fdfd645e0b414d5d75c07bf-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/e457da680c69fedc744d0795f729c131dd5bce2dd8b1f7829ac47bc79d2766b6-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Key Vault (one staging copy) | 118.2539 | 78.2039 |
| 0 | 40.05 | Key Vault (two staging copies) | 236.4319 | 196.3819 |
| 1 | 53.19 | Key Vault (one staging copy) | 118.2539 | 65.0639 |
| 1 | 53.19 | Key Vault (two staging copies) | 236.4319 | 183.2419 |
| 10 | 171.45 | Key Vault (one staging copy) | 118.2539 | -53.1961 |
| 10 | 171.45 | Key Vault (two staging copies) | 236.4319 | 64.9819 |
| 100 | 1354.05 | Key Vault (one staging copy) | 118.2539 | -1235.7961 |
| 100 | 1354.05 | Key Vault (two staging copies) | 236.4319 | -1117.6181 |
| 1000 | 13180.05 | Key Vault (one staging copy) | 118.2539 | -13061.7961 |
| 1000 | 13180.05 | Key Vault (two staging copies) | 236.4319 | -12943.6181 |
| 10000 | 131440.05 | Key Vault (one staging copy) | 1635.9239 | -129804.1261 |
| 10000 | 131440.05 | Key Vault (two staging copies) | 3271.7719 | -128168.2781 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Key Vault (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Key Vault (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Key Vault (one staging copy) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Key Vault (two staging copies) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Key Vault (one staging copy) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Key Vault (two staging copies) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Key Vault (one staging copy) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Key Vault (two staging copies) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Key Vault (one staging copy) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Key Vault (two staging copies) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Key Vault (one staging copy) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Key Vault (two staging copies) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Representative value size | 1024 | bytes |
| Key Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Records read per API request | 1 | records/request |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Representative value size | 1024 | bytes |
| Key Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Records read per API request | 1 | records/request |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Provider reconciliation operations use the vault-operation tariff; Standard secrets have no storage meter.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a5870b86a42807d366a1ccbb2d8d495c03fa4ea1` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

### AWS Secrets Manager · Stored logical secrets

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/bd9bbbf81ad91d4b998e720fc9cc99341c2d45eca425d3334a997238fc42b294-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/79aabfc740632ab36b31b455155be2aab0c079e7cae9914cc3846f002bf8a225-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Key Vault (one staging copy) | 118.244 | 113.194 |
| 0 | 5.05 | Key Vault (two staging copies) | 236.422 | 231.372 |
| 10 | 9.05 | Key Vault (one staging copy) | 118.24499 | 109.19499 |
| 10 | 9.05 | Key Vault (two staging copies) | 236.42299 | 227.37299 |
| 100 | 45.05 | Key Vault (one staging copy) | 118.2539 | 73.2039 |
| 100 | 45.05 | Key Vault (two staging copies) | 236.4319 | 191.3819 |
| 1000 | 405.05 | Key Vault (one staging copy) | 118.343 | -286.707 |
| 1000 | 405.05 | Key Vault (two staging copies) | 236.521 | -168.529 |
| 10000 | 4005.05 | Key Vault (one staging copy) | 119.234 | -3885.816 |
| 10000 | 4005.05 | Key Vault (two staging copies) | 237.412 | -3767.638 |
| 100000 | 40005.05 | Key Vault (one staging copy) | 128.144 | -39876.906 |
| 100000 | 40005.05 | Key Vault (two staging copies) | 246.322 | -39758.728 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 secrets / Key Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 secrets / Key Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Key Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Key Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Key Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Key Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Key Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Key Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Key Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Key Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Key Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Key Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Representative value size | 1024 | bytes |
| Key Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Records read per API request | 1 | records/request |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Representative value size | 1024 | bytes |
| Key Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Records read per API request | 1 | records/request |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Provider reconciliation operations use the vault-operation tariff; Standard secrets have no storage meter.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a5870b86a42807d366a1ccbb2d8d495c03fa4ea1` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## AWS Secrets Manager → Kubernetes Secret

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `tensor9::1.0.0::emu::aws/1.0.0/secretsmanager::kube`.

### AWS Secrets Manager · Secret API reads

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/c90a09b455b714e4a81a9db275227451d6c6714ec5180b9c333aad8d5bf1be9a-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/317eaecf53a704bd7b92eeffff1873288e4e566b8d465090bd289efbcf7778bc-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Kubernetes Secret | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Kubernetes Secret (one copy) | 80.89614 | 40.84614 |
| 0 | 40.05 | Kubernetes Secret (two copies) | 161.79228 | 121.74228 |
| 1 | 53.19 | Kubernetes Secret (one copy) | 80.89614 | 27.70614 |
| 1 | 53.19 | Kubernetes Secret (two copies) | 161.79228 | 108.60228 |
| 10 | 171.45 | Kubernetes Secret (one copy) | 80.89614 | -90.55386 |
| 10 | 171.45 | Kubernetes Secret (two copies) | 161.79228 | -9.65772 |
| 100 | 1354.05 | Kubernetes Secret (one copy) | 80.89614 | -1273.15386 |
| 100 | 1354.05 | Kubernetes Secret (two copies) | 161.79228 | -1192.25772 |
| 1000 | 13180.05 | Kubernetes Secret (one copy) | 80.89614 | -13099.15386 |
| 1000 | 13180.05 | Kubernetes Secret (two copies) | 161.79228 | -13018.25772 |
| 10000 | 131440.05 | Kubernetes Secret (one copy) | 1144.33824 | -130295.71176 |
| 10000 | 131440.05 | Kubernetes Secret (two copies) | 2288.67648 | -129151.37352 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Kubernetes Secret (one copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Kubernetes Secret (two copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Kubernetes Secret (one copy) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Kubernetes Secret (two copies) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Kubernetes Secret (one copy) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Kubernetes Secret (two copies) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Kubernetes Secret (one copy) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Kubernetes Secret (two copies) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Kubernetes Secret (one copy) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Kubernetes Secret (two copies) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Kubernetes Secret (one copy) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Kubernetes Secret (two copies) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Secret (one copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Representative value size | 1024 | bytes |
| Kubernetes Secret (one copy) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (one copy) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (one copy) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (one copy) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (one copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (one copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (one copy) | Records read per API request | 1 | records/request |
| Kubernetes Secret (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Secret (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secret (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Secret (two copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Representative value size | 1024 | bytes |
| Kubernetes Secret (two copies) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (two copies) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (two copies) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (two copies) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (two copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (two copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (two copies) | Records read per API request | 1 | records/request |
| Kubernetes Secret (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Secret (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secret (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Self-hosted target: Tensor9-built Secrets Manager service on Kubernetes Secrets; no vendor tariff. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-3cc07bdd0f43f7beabfb1c23deaeed786570940f` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

### AWS Secrets Manager · Stored logical secrets

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/5ddceedbf26e09c37cb022c528fa7166df766b872e34deccbbb33c90e7ab1113-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/51294e4d648f99d8d9dbbab15129dfb0294faca4ae6fe3ec2d1cb8f756d94b98-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Kubernetes Secret | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Kubernetes Secret (one copy) | 80.89614 | 75.84614 |
| 0 | 5.05 | Kubernetes Secret (two copies) | 161.79228 | 156.74228 |
| 10 | 9.05 | Kubernetes Secret (one copy) | 80.89614 | 71.84614 |
| 10 | 9.05 | Kubernetes Secret (two copies) | 161.79228 | 152.74228 |
| 100 | 45.05 | Kubernetes Secret (one copy) | 80.89614 | 35.84614 |
| 100 | 45.05 | Kubernetes Secret (two copies) | 161.79228 | 116.74228 |
| 1000 | 405.05 | Kubernetes Secret (one copy) | 80.89614 | -324.15386 |
| 1000 | 405.05 | Kubernetes Secret (two copies) | 161.79228 | -243.25772 |
| 10000 | 4005.05 | Kubernetes Secret (one copy) | 80.89614 | -3924.15386 |
| 10000 | 4005.05 | Kubernetes Secret (two copies) | 161.79228 | -3843.25772 |
| 100000 | 40005.05 | Kubernetes Secret (one copy) | 80.89614 | -39924.15386 |
| 100000 | 40005.05 | Kubernetes Secret (two copies) | 161.79228 | -39843.25772 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 secrets / Kubernetes Secret (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 secrets / Kubernetes Secret (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Kubernetes Secret (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Kubernetes Secret (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Kubernetes Secret (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Kubernetes Secret (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Kubernetes Secret (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Kubernetes Secret (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Kubernetes Secret (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Kubernetes Secret (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Kubernetes Secret (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Kubernetes Secret (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Secret (one copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Representative value size | 1024 | bytes |
| Kubernetes Secret (one copy) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (one copy) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (one copy) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (one copy) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (one copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (one copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (one copy) | Records read per API request | 1 | records/request |
| Kubernetes Secret (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Secret (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secret (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Secret (two copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Representative value size | 1024 | bytes |
| Kubernetes Secret (two copies) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (two copies) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (two copies) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (two copies) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (two copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (two copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (two copies) | Records read per API request | 1 | records/request |
| Kubernetes Secret (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Secret (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secret (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Self-hosted target: Tensor9-built Secrets Manager service on Kubernetes Secrets; no vendor tariff. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-3cc07bdd0f43f7beabfb1c23deaeed786570940f` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## AWS Secrets Manager → Kubernetes Secrets

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `external-secrets::1.0.0::secret-store`.

### AWS Secrets Manager · Secret API reads

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/106c4cbce39009e09f8fc70565de60985100cbf061750374d599065be5468b75-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/53d68f57a70b3fb537f4d7f37aa90d3a8f41f681db822a8e2e8ee140a2d72a24-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Kubernetes Secrets | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Kubernetes Secrets (one copy) | 80.89614 | 40.84614 |
| 0 | 40.05 | Kubernetes Secrets (two copies) | 161.79228 | 121.74228 |
| 1 | 53.19 | Kubernetes Secrets (one copy) | 80.89614 | 27.70614 |
| 1 | 53.19 | Kubernetes Secrets (two copies) | 161.79228 | 108.60228 |
| 10 | 171.45 | Kubernetes Secrets (one copy) | 80.89614 | -90.55386 |
| 10 | 171.45 | Kubernetes Secrets (two copies) | 161.79228 | -9.65772 |
| 100 | 1354.05 | Kubernetes Secrets (one copy) | 80.89614 | -1273.15386 |
| 100 | 1354.05 | Kubernetes Secrets (two copies) | 161.79228 | -1192.25772 |
| 1000 | 13180.05 | Kubernetes Secrets (one copy) | 80.89614 | -13099.15386 |
| 1000 | 13180.05 | Kubernetes Secrets (two copies) | 161.79228 | -13018.25772 |
| 10000 | 131440.05 | Kubernetes Secrets (one copy) | 1144.33824 | -130295.71176 |
| 10000 | 131440.05 | Kubernetes Secrets (two copies) | 2288.67648 | -129151.37352 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Kubernetes Secrets (one copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Kubernetes Secrets (two copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Kubernetes Secrets (one copy) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Kubernetes Secrets (two copies) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Kubernetes Secrets (one copy) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Kubernetes Secrets (two copies) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Kubernetes Secrets (one copy) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Kubernetes Secrets (two copies) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Kubernetes Secrets (one copy) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Kubernetes Secrets (two copies) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Kubernetes Secrets (one copy) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Kubernetes Secrets (two copies) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Secrets (one copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secrets (one copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secrets (one copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secrets (one copy) | Representative value size | 1024 | bytes |
| Kubernetes Secrets (one copy) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secrets (one copy) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secrets (one copy) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secrets (one copy) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secrets (one copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secrets (one copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secrets (one copy) | Records read per API request | 1 | records/request |
| Kubernetes Secrets (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Secrets (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Secrets (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secrets (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secrets (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secrets (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secrets (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secrets (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secrets (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secrets (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secrets (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secrets (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secrets (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secrets (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secrets (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secrets (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secrets (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secrets (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secrets (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Secrets (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Secrets (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secrets (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secrets (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secrets (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secrets (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secrets (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secrets (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secrets (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secrets (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secrets (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secrets (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secrets (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Secrets (two copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secrets (two copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secrets (two copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secrets (two copies) | Representative value size | 1024 | bytes |
| Kubernetes Secrets (two copies) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secrets (two copies) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secrets (two copies) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secrets (two copies) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secrets (two copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secrets (two copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secrets (two copies) | Records read per API request | 1 | records/request |
| Kubernetes Secrets (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Secrets (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Secrets (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secrets (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secrets (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secrets (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secrets (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secrets (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secrets (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secrets (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secrets (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secrets (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secrets (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secrets (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secrets (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secrets (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secrets (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secrets (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secrets (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Secrets (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Secrets (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secrets (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secrets (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secrets (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secrets (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secrets (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secrets (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secrets (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secrets (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secrets (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secrets (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secrets (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Self-hosted target: External Secrets Operator (Apache-2.0, [https://github.com/external-secrets/external-secrets/blob/main/LICENSE](https://github.com/external-secrets/external-secrets/blob/main/LICENSE)); a backing secret provider, if any, bills separately. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-e3a242e51282ee051f406cb9f77beb9aecbf2294` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

### AWS Secrets Manager · Stored logical secrets

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/bdc95a0d8b3952314158244ff79be0fcc9af54494ea5c560c94688c85702e7b0-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/322a538e157867eaf67a450cd7fa52fac5e9fb2e5940d6939d9ea249df7f5134-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Kubernetes Secrets | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Kubernetes Secrets (one copy) | 80.89614 | 75.84614 |
| 0 | 5.05 | Kubernetes Secrets (two copies) | 161.79228 | 156.74228 |
| 10 | 9.05 | Kubernetes Secrets (one copy) | 80.89614 | 71.84614 |
| 10 | 9.05 | Kubernetes Secrets (two copies) | 161.79228 | 152.74228 |
| 100 | 45.05 | Kubernetes Secrets (one copy) | 80.89614 | 35.84614 |
| 100 | 45.05 | Kubernetes Secrets (two copies) | 161.79228 | 116.74228 |
| 1000 | 405.05 | Kubernetes Secrets (one copy) | 80.89614 | -324.15386 |
| 1000 | 405.05 | Kubernetes Secrets (two copies) | 161.79228 | -243.25772 |
| 10000 | 4005.05 | Kubernetes Secrets (one copy) | 80.89614 | -3924.15386 |
| 10000 | 4005.05 | Kubernetes Secrets (two copies) | 161.79228 | -3843.25772 |
| 100000 | 40005.05 | Kubernetes Secrets (one copy) | 80.89614 | -39924.15386 |
| 100000 | 40005.05 | Kubernetes Secrets (two copies) | 161.79228 | -39843.25772 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 secrets / Kubernetes Secrets (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 secrets / Kubernetes Secrets (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Kubernetes Secrets (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Kubernetes Secrets (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Kubernetes Secrets (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Kubernetes Secrets (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Kubernetes Secrets (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Kubernetes Secrets (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Kubernetes Secrets (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Kubernetes Secrets (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Kubernetes Secrets (one copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Kubernetes Secrets (two copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Secrets (one copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secrets (one copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secrets (one copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secrets (one copy) | Representative value size | 1024 | bytes |
| Kubernetes Secrets (one copy) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secrets (one copy) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secrets (one copy) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secrets (one copy) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secrets (one copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secrets (one copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secrets (one copy) | Records read per API request | 1 | records/request |
| Kubernetes Secrets (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Secrets (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Secrets (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secrets (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secrets (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secrets (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secrets (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secrets (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secrets (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secrets (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secrets (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secrets (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secrets (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secrets (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secrets (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secrets (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secrets (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secrets (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secrets (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Secrets (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Secrets (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secrets (one copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secrets (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secrets (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secrets (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secrets (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secrets (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secrets (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secrets (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secrets (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secrets (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secrets (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Secrets (two copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secrets (two copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secrets (two copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secrets (two copies) | Representative value size | 1024 | bytes |
| Kubernetes Secrets (two copies) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secrets (two copies) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secrets (two copies) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secrets (two copies) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secrets (two copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secrets (two copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secrets (two copies) | Records read per API request | 1 | records/request |
| Kubernetes Secrets (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Secrets (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Secrets (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secrets (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secrets (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secrets (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secrets (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secrets (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secrets (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secrets (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secrets (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secrets (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secrets (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secrets (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secrets (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secrets (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secrets (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secrets (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secrets (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Secrets (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Secrets (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secrets (two copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Kubernetes Secrets (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secrets (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secrets (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secrets (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secrets (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secrets (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secrets (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secrets (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secrets (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secrets (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Self-hosted target: External Secrets Operator (Apache-2.0, [https://github.com/external-secrets/external-secrets/blob/main/LICENSE](https://github.com/external-secrets/external-secrets/blob/main/LICENSE)); a backing secret provider, if any, bills separately. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor tariff: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-e3a242e51282ee051f406cb9f77beb9aecbf2294` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## AWS Secrets Manager → OCI Vault

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `oci::1.0.0::vault`.

### AWS Secrets Manager · Secret API reads

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/4b3b87a85a5d95ee3302a504016180d612f2724361365b43754d14ff237a67a8-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/e84bffe085f05a3e2509f5d435afb9134e1b756f297bd691e2867e53a7c8b9c6-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | OCI Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | OCI Vault (one staging copy) | 118.178 | 78.128 |
| 0 | 40.05 | OCI Vault (two staging copies) | 236.356 | 196.306 |
| 1 | 53.19 | OCI Vault (one staging copy) | 118.178 | 64.988 |
| 1 | 53.19 | OCI Vault (two staging copies) | 236.356 | 183.166 |
| 10 | 171.45 | OCI Vault (one staging copy) | 118.178 | -53.272 |
| 10 | 171.45 | OCI Vault (two staging copies) | 236.356 | 64.906 |
| 100 | 1354.05 | OCI Vault (one staging copy) | 118.178 | -1235.872 |
| 100 | 1354.05 | OCI Vault (two staging copies) | 236.356 | -1117.694 |
| 1000 | 13180.05 | OCI Vault (one staging copy) | 118.178 | -13061.872 |
| 1000 | 13180.05 | OCI Vault (two staging copies) | 236.356 | -12943.694 |
| 10000 | 131440.05 | OCI Vault (one staging copy) | 1635.848 | -129804.202 |
| 10000 | 131440.05 | OCI Vault (two staging copies) | 3271.696 | -128168.354 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / OCI Vault (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / OCI Vault (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI Vault (one staging copy) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / OCI Vault (two staging copies) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI Vault (one staging copy) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / OCI Vault (two staging copies) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI Vault (one staging copy) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / OCI Vault (two staging copies) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI Vault (one staging copy) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / OCI Vault (two staging copies) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI Vault (one staging copy) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / OCI Vault (two staging copies) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Representative value size | 1024 | bytes |
| OCI Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (one staging copy) | Records read per API request | 1 | records/request |
| OCI Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI Vault (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Representative value size | 1024 | bytes |
| OCI Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (two staging copies) | Records read per API request | 1 | records/request |
| OCI Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI Vault (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* OCI Secret Management has no charge for secret versions or retrieval; only an HSM-protected protecting key above 20 versions or a private vault (USD 3.724/hour) would bill, and the default software-protected key is free.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* OCI Secret Management: [https://www.oracle.com/security/cloud-security/secrets/](https://www.oracle.com/security/cloud-security/secrets/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a3102dfef67b819887de750afea3c1b456606428` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [OCI Secret Management](https://www.oracle.com/security/cloud-security/secrets/).

### AWS Secrets Manager · Stored logical secrets

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/12d992abfd12cbc839e1e4c0634aee582eabe5bbd6d68a89f6cab71093cc819f-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/95c68022f2f7dd2b6688a3f16f70e66e778e4770204efd65e64126e974831a92-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | OCI Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | OCI Vault (one staging copy) | 118.178 | 113.128 |
| 0 | 5.05 | OCI Vault (two staging copies) | 236.356 | 231.306 |
| 10 | 9.05 | OCI Vault (one staging copy) | 118.178 | 109.128 |
| 10 | 9.05 | OCI Vault (two staging copies) | 236.356 | 227.306 |
| 100 | 45.05 | OCI Vault (one staging copy) | 118.178 | 73.128 |
| 100 | 45.05 | OCI Vault (two staging copies) | 236.356 | 191.306 |
| 1000 | 405.05 | OCI Vault (one staging copy) | 118.178 | -286.872 |
| 1000 | 405.05 | OCI Vault (two staging copies) | 236.356 | -168.694 |
| 10000 | 4005.05 | OCI Vault (one staging copy) | 118.178 | -3886.872 |
| 10000 | 4005.05 | OCI Vault (two staging copies) | 236.356 | -3768.694 |
| 100000 | 40005.05 | OCI Vault (one staging copy) | 118.178 | -39886.872 |
| 100000 | 40005.05 | OCI Vault (two staging copies) | 236.356 | -39768.694 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 secrets / OCI Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 secrets / OCI Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / OCI Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / OCI Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / OCI Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / OCI Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / OCI Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / OCI Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / OCI Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / OCI Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / OCI Vault (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / OCI Vault (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Representative value size | 1024 | bytes |
| OCI Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (one staging copy) | Records read per API request | 1 | records/request |
| OCI Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI Vault (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Representative value size | 1024 | bytes |
| OCI Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (two staging copies) | Records read per API request | 1 | records/request |
| OCI Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI Vault (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| OCI Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* OCI Secret Management has no charge for secret versions or retrieval; only an HSM-protected protecting key above 20 versions or a private vault (USD 3.724/hour) would bill, and the default software-protected key is free.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* OCI Secret Management: [https://www.oracle.com/security/cloud-security/secrets/](https://www.oracle.com/security/cloud-security/secrets/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a3102dfef67b819887de750afea3c1b456606428` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [OCI Secret Management](https://www.oracle.com/security/cloud-security/secrets/).

## AWS Secrets Manager → Scaleway Secret Manager

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `scaleway::1.0.0::secret-manager`.

### AWS Secrets Manager · Secret API reads

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: fr-par; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/da9344353dd1f1738d3dffe8e5ec3e98644d441cee30a6b088ab460849f0a96c-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/ea8bbfb8498ce480bb135d97b62adaf1be9e1e05ab9e5b50916ae027378ecf3f-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Scaleway Secret Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Scaleway Secret Manager (one staging copy) | 127.22704595 | 87.17704595 |
| 0 | 40.05 | Scaleway Secret Manager (two staging copies) | 245.40504595 | 205.35504595 |
| 1 | 53.19 | Scaleway Secret Manager (one staging copy) | 127.22704595 | 74.03704595 |
| 1 | 53.19 | Scaleway Secret Manager (two staging copies) | 245.40504595 | 192.21504595 |
| 10 | 171.45 | Scaleway Secret Manager (one staging copy) | 127.22704595 | -44.22295405 |
| 10 | 171.45 | Scaleway Secret Manager (two staging copies) | 245.40504595 | 73.95504595 |
| 100 | 1354.05 | Scaleway Secret Manager (one staging copy) | 127.22704595 | -1226.82295405 |
| 100 | 1354.05 | Scaleway Secret Manager (two staging copies) | 245.40504595 | -1108.64495405 |
| 1000 | 13180.05 | Scaleway Secret Manager (one staging copy) | 127.22704595 | -13052.82295405 |
| 1000 | 13180.05 | Scaleway Secret Manager (two staging copies) | 245.40504595 | -12934.64495405 |
| 10000 | 131440.05 | Scaleway Secret Manager (one staging copy) | 1644.89704595 | -129795.15295405 |
| 10000 | 131440.05 | Scaleway Secret Manager (two staging copies) | 3280.74504595 | -128159.30495405 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Scaleway Secret Manager (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Scaleway Secret Manager (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Scaleway Secret Manager (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Scaleway Secret Manager (one staging copy) | Representative value size | 1024 | bytes |
| Scaleway Secret Manager (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Scaleway Secret Manager (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Scaleway Secret Manager (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Scaleway Secret Manager (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Scaleway Secret Manager (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Scaleway Secret Manager (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Scaleway Secret Manager (one staging copy) | Records read per API request | 1 | records/request |
| Scaleway Secret Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Scaleway Secret Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Scaleway Secret Manager (one staging copy) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Secret Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Secret Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Secret Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Secret Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Secret Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Secret Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Secret Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Secret Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Secret Manager (one staging copy) | Target list price · resource-month | 0.04482 | USD/resource-month |
| Scaleway Secret Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Scaleway Secret Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Scaleway Secret Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Scaleway Secret Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Scaleway Secret Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Scaleway Secret Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Scaleway Secret Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Scaleway Secret Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Scaleway Secret Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Secret Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Secret Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Scaleway Secret Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Secret Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Secret Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Scaleway Secret Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Secret Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Secret Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Secret Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Secret Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Secret Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Scaleway Secret Manager (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Scaleway Secret Manager (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Scaleway Secret Manager (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Scaleway Secret Manager (two staging copies) | Representative value size | 1024 | bytes |
| Scaleway Secret Manager (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Scaleway Secret Manager (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Scaleway Secret Manager (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Scaleway Secret Manager (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Scaleway Secret Manager (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Scaleway Secret Manager (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Scaleway Secret Manager (two staging copies) | Records read per API request | 1 | records/request |
| Scaleway Secret Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Scaleway Secret Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Scaleway Secret Manager (two staging copies) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Secret Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Secret Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Secret Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Secret Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Secret Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Secret Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Secret Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Secret Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Secret Manager (two staging copies) | Target list price · resource-month | 0.04482 | USD/resource-month |
| Scaleway Secret Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Scaleway Secret Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Scaleway Secret Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Scaleway Secret Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Scaleway Secret Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Scaleway Secret Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Scaleway Secret Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Scaleway Secret Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Scaleway Secret Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Secret Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Secret Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Scaleway Secret Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Secret Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Secret Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Scaleway Secret Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Secret Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Secret Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Secret Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Secret Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Secret Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → fr-par, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Monthly resource quantity is stored secret versions; access requests are separate from local adapter reads. Restoring a version costs EUR 0.01 and is not modeled.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Scaleway Security and Account pricing: [https://www.scaleway.com/en/pricing/security-and-account/](https://www.scaleway.com/en/pricing/security-and-account/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-f1fcbcd483b59816d6c595395cd6fecb9f2ccdcf` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Scaleway Security and Account pricing](https://www.scaleway.com/en/pricing/security-and-account/).

### AWS Secrets Manager · Stored logical secrets

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: fr-par; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/bc8fafcdb939c03a4891a2c8d0e1a31d172785f9c0dbe03045207dcedf7e3b81-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/4427cb9fc70eca74df6717fe4c21c4a949d8cd9523947b60e70c00eba691da09-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Scaleway Secret Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Scaleway Secret Manager (one staging copy) | 118.251953 | 113.201953 |
| 0 | 5.05 | Scaleway Secret Manager (two staging copies) | 236.429953 | 231.379953 |
| 10 | 9.05 | Scaleway Secret Manager (one staging copy) | 119.149462295 | 110.099462295 |
| 10 | 9.05 | Scaleway Secret Manager (two staging copies) | 237.327462295 | 228.277462295 |
| 100 | 45.05 | Scaleway Secret Manager (one staging copy) | 127.22704595 | 82.17704595 |
| 100 | 45.05 | Scaleway Secret Manager (two staging copies) | 245.40504595 | 200.35504595 |
| 1000 | 405.05 | Scaleway Secret Manager (one staging copy) | 208.0028825 | -197.0471175 |
| 1000 | 405.05 | Scaleway Secret Manager (two staging copies) | 326.1808825 | -78.8691175 |
| 10000 | 4005.05 | Scaleway Secret Manager (one staging copy) | 1015.761248 | -2989.288752 |
| 10000 | 4005.05 | Scaleway Secret Manager (two staging copies) | 1133.939248 | -2871.110752 |
| 100000 | 40005.05 | Scaleway Secret Manager (one staging copy) | 9093.344903 | -30911.705097 |
| 100000 | 40005.05 | Scaleway Secret Manager (two staging copies) | 9211.522903 | -30793.527097 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 secrets / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 secrets / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Scaleway Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Scaleway Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Scaleway Secret Manager (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Scaleway Secret Manager (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Scaleway Secret Manager (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Scaleway Secret Manager (one staging copy) | Representative value size | 1024 | bytes |
| Scaleway Secret Manager (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Scaleway Secret Manager (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Scaleway Secret Manager (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Scaleway Secret Manager (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Scaleway Secret Manager (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Scaleway Secret Manager (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Scaleway Secret Manager (one staging copy) | Records read per API request | 1 | records/request |
| Scaleway Secret Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Scaleway Secret Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Scaleway Secret Manager (one staging copy) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Secret Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Secret Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Secret Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Secret Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Secret Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Secret Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Secret Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Secret Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Secret Manager (one staging copy) | Target list price · resource-month | 0.04482 | USD/resource-month |
| Scaleway Secret Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Scaleway Secret Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Scaleway Secret Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Scaleway Secret Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Scaleway Secret Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Scaleway Secret Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Scaleway Secret Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Scaleway Secret Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Scaleway Secret Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Secret Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Secret Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Scaleway Secret Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Secret Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Secret Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Scaleway Secret Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Secret Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Secret Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Secret Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Secret Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Secret Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Scaleway Secret Manager (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Scaleway Secret Manager (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Scaleway Secret Manager (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Scaleway Secret Manager (two staging copies) | Representative value size | 1024 | bytes |
| Scaleway Secret Manager (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Scaleway Secret Manager (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Scaleway Secret Manager (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Scaleway Secret Manager (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Scaleway Secret Manager (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Scaleway Secret Manager (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Scaleway Secret Manager (two staging copies) | Records read per API request | 1 | records/request |
| Scaleway Secret Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Scaleway Secret Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Scaleway Secret Manager (two staging copies) | Target list price · provider operation | 0.0000033615 | USD/provider operation |
| Scaleway Secret Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Scaleway Secret Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Scaleway Secret Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Scaleway Secret Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Scaleway Secret Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Scaleway Secret Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Scaleway Secret Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Scaleway Secret Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Scaleway Secret Manager (two staging copies) | Target list price · resource-month | 0.04482 | USD/resource-month |
| Scaleway Secret Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Scaleway Secret Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Scaleway Secret Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Scaleway Secret Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Scaleway Secret Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Scaleway Secret Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Scaleway Secret Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Scaleway Secret Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Scaleway Secret Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Scaleway Secret Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Scaleway Secret Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Scaleway Secret Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Scaleway Secret Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Scaleway Secret Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Scaleway Secret Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Scaleway Secret Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Scaleway Secret Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Scaleway Secret Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Scaleway Secret Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Scaleway Secret Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → fr-par, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Monthly resource quantity is stored secret versions; access requests are separate from local adapter reads. Restoring a version costs EUR 0.01 and is not modeled.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Scaleway Security and Account pricing: [https://www.scaleway.com/en/pricing/security-and-account/](https://www.scaleway.com/en/pricing/security-and-account/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-f1fcbcd483b59816d6c595395cd6fecb9f2ccdcf` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Scaleway Security and Account pricing](https://www.scaleway.com/en/pricing/security-and-account/).

## AWS Secrets Manager → Secret Manager

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `google::1.0.0::secret-manager`.

### AWS Secrets Manager · Secret API reads

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/ad5f48bd9e5ac7b07cd35237b877e661ae8e04cb15e2ff4be89848a58933ad84-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](/images/diagrams/service-cost/afd8ea553792995c7205cb9eaa1c9db54de418647e716d6237f91c1e07d79000-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Secret Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Secret Manager (one staging copy) | 130.2539 | 90.2039 |
| 0 | 40.05 | Secret Manager (two staging copies) | 248.4319 | 208.3819 |
| 1 | 53.19 | Secret Manager (one staging copy) | 130.2539 | 77.0639 |
| 1 | 53.19 | Secret Manager (two staging copies) | 248.4319 | 195.2419 |
| 10 | 171.45 | Secret Manager (one staging copy) | 130.2539 | -41.1961 |
| 10 | 171.45 | Secret Manager (two staging copies) | 248.4319 | 76.9819 |
| 100 | 1354.05 | Secret Manager (one staging copy) | 130.2539 | -1223.7961 |
| 100 | 1354.05 | Secret Manager (two staging copies) | 248.4319 | -1105.6181 |
| 1000 | 13180.05 | Secret Manager (one staging copy) | 130.2539 | -13049.7961 |
| 1000 | 13180.05 | Secret Manager (two staging copies) | 248.4319 | -12931.6181 |
| 10000 | 131440.05 | Secret Manager (one staging copy) | 1647.9239 | -129792.1261 |
| 10000 | 131440.05 | Secret Manager (two staging copies) | 3283.7719 | -128156.2781 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 operations/s / Secret Manager (one staging copy) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 operations/s / Secret Manager (two staging copies) | PlanningAssumption | 0.003805175038051750380517503805175038 / 0.007610350076103500761035007610350076 | 0.000007247952453431905486700007247952453 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Secret Manager (one staging copy) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1 operations/s / Secret Manager (two staging copies) | PlanningAssumption | 1.003805175038051750380517503805175 / 2.00761035007610350076103500761035 | 0.001912009857215336667391461912009857 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Secret Manager (one staging copy) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 operations/s / Secret Manager (two staging copies) | PlanningAssumption | 10.00380517503805175038051750380518 / 20.00761035007610350076103500761036 | 0.01905486700007247952453431905486701 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Secret Manager (one staging copy) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 operations/s / Secret Manager (two staging copies) | PlanningAssumption | 100.0038051750380517503805175038052 / 200.0076103500761035007610350076104 | 0.1904834384286439080959628904834385 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Secret Manager (one staging copy) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 operations/s / Secret Manager (two staging copies) | PlanningAssumption | 1000.003805175038051750380517503805 / 2000.00761035007610350076103500761 | 1.904769152714358193810248604769152 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Secret Manager (one staging copy) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 operations/s / Secret Manager (two staging copies) | PlanningAssumption | 10000.00380517503805175038051750381 / 20000.00761035007610350076103500762 | 19.0476262955715010509531057476263 | 32 | 128 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Secret Manager (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Representative value size | 1024 | bytes |
| Secret Manager (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (one staging copy) | Records read per API request | 1 | records/request |
| Secret Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Secret Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Secret Manager (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Secret Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Secret Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Secret Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Secret Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Secret Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Secret Manager (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Representative value size | 1024 | bytes |
| Secret Manager (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (two staging copies) | Records read per API request | 1 | records/request |
| Secret Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Secret Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Secret Manager (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Secret Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Secret Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Secret Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Secret Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Secret Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Monthly resource quantity is retained active provider versions, independent of logical source objects; access operations are separate from local adapter reads, and management operations are free. The account-wide free tier (6 versions, 10,000 accesses a month) is not applied.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Secret Manager pricing: [https://cloud.google.com/secret-manager/pricing](https://cloud.google.com/secret-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-74be73a1c55cd94e18955e080cba3c0d8c54b8ff` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Secret Manager pricing](https://cloud.google.com/secret-manager/pricing).

### AWS Secrets Manager · Stored logical secrets

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/e60b1d482903a4cf4947c900c0c92b8a8553c8e14824ade229a9b1259b9bdeed-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](/images/diagrams/service-cost/23836b07dc3b0b1e376b894d580853e82ada25e4f5b849406daa244e31bd9c12-dark.svg)

Comparison pills describe all sampled scale points; card amounts show the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Exact sampled model outputs in USD/month. Difference means target minus origin; a positive difference means the target costs more.
Estimated allocation from planning assumptions; not benchmark calibrated. Lines connect evaluated samples; intermediate capacity and prices are not inferred. Unpriced means no target quote or cost difference is available within the sizing policy.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Secret Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Secret Manager (one staging copy) | 118.244 | 113.194 |
| 0 | 5.05 | Secret Manager (two staging copies) | 236.422 | 231.372 |
| 10 | 9.05 | Secret Manager (one staging copy) | 119.44499 | 110.39499 |
| 10 | 9.05 | Secret Manager (two staging copies) | 237.62299 | 228.57299 |
| 100 | 45.05 | Secret Manager (one staging copy) | 130.2539 | 85.2039 |
| 100 | 45.05 | Secret Manager (two staging copies) | 248.4319 | 203.3819 |
| 1000 | 405.05 | Secret Manager (one staging copy) | 238.343 | -166.707 |
| 1000 | 405.05 | Secret Manager (two staging copies) | 356.521 | -48.529 |
| 10000 | 4005.05 | Secret Manager (one staging copy) | 1319.234 | -2685.816 |
| 10000 | 4005.05 | Secret Manager (two staging copies) | 1437.412 | -2567.638 |
| 100000 | 40005.05 | Secret Manager (one staging copy) | 12128.144 | -27876.906 |
| 100000 | 40005.05 | Secret Manager (two staging copies) | 12246.322 | -27758.728 |

**Estimated allocation from planning assumptions; not benchmark calibrated.**

The sizing policy grows compute with translated work and peak headroom, memory with compute and working set, and disk with resident working state and reserve. Monthly usage is distinct from resident data; each workload's assumptions define the translation. HA changes pricing, not this policy's throughput estimate. Unpriced workloads exceed the policy's configuration range; no silent vertical cap or automatic sharding is assumed.

| Sample / scenario | Basis | Mean / peak work/s | Required vCPU | Allocated vCPU | Memory GiB | SSD GiB | Resident GiB | Policy | Constraints |
| - | - | -: | -: | -: | -: | -: | -: | - | - |
| 0 secrets / Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 0 secrets / Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10 secrets / Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.0001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100 secrets / Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.001430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 1000 secrets / Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.01430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 10000 secrets / Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 0.1430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Secret Manager (one staging copy) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |
| 100000 secrets / Secret Manager (two staging copies) | PlanningAssumption | 0.3843226788432267884322678843226788 / 0.7686453576864535768645357686453576 | 0.0007320431977966224541567007320431977 | 2 | 8 | 100 | 1.430511474609375 | `service-adapter-planning-2026-10-22.1` | None reported |

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Secret Manager (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Representative value size | 1024 | bytes |
| Secret Manager (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (one staging copy) | Records read per API request | 1 | records/request |
| Secret Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Secret Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Secret Manager (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Secret Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Secret Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Secret Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Secret Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (one staging copy) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Secret Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Secret Manager (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Representative value size | 1024 | bytes |
| Secret Manager (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (two staging copies) | Records read per API request | 1 | records/request |
| Secret Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Secret Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Secret Manager (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Secret Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Secret Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Secret Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Secret Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (two staging copies) | Read/write work per vCPU-second | 1500 | operations/vCPU-second |
| Secret Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Editable authored planning guesses, not verified provider tariffs, benchmark measurements or a commercial quote. Other native meters retain their explicitly displayed default quantities.
* Planning estimate · editable authored rates and sizing assumptions dated 2026-10-22; not verified provider prices. us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Explicit tariff samples are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Monthly resource quantity is retained active provider versions, independent of logical source objects; access operations are separate from local adapter reads, and management operations are free. The account-wide free tier (6 versions, 10,000 accesses a month) is not applied.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers, 4 GiB per vCPU, at most 6.5 GiB per vCPU, 96 vCPU and 65,536 GiB disk follow Cloud SQL Enterprise custom machine limits (provider-documented, same page); 624 GiB is 96 × 6.5. Targets billed per node, unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Secret Manager pricing: [https://cloud.google.com/secret-manager/pricing](https://cloud.google.com/secret-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances unless explicitly reflected in edited rates.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-74be73a1c55cd94e18955e080cba3c0d8c54b8ff` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Secret Manager pricing](https://cloud.google.com/secret-manager/pricing).

See the [service catalog](/byoc/service-adapters/catalog.md) for operation coverage, supported directions and backend limitations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.