> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets Manager costs

> Compare Secrets Manager backend choices using explicit service-adapter planning assumptions.

Tensor9 Cloud Adapter planning comparisons for `aws::1.0.0::secretsmanager`, with backend choices shown together. Read [how Tensor9 estimates service-adapter costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) for price scope and capacity qualification, or return to [additional services](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services.md).

## AWS Secrets Manager → Key Vault

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `azure::1.0.0::keyvault`.

### AWS Secrets Manager · Secret API reads

Feature: AWS Secrets Manager.

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e556997e7a5076a1fe43a5f40cbc3abf8981cdf98c9245341e17b5bd6d5f138e-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/43901759e6414e608d4ec83378eab4c2eb31cfb979914a3c291f1474c1aa94d2-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Key Vault (one staging copy) | 118.25 | 78.20 |
| 0 | 40.05 | Key Vault (two staging copies) | 236.43 | 196.38 |
| 1 | 53.19 | Key Vault (one staging copy) | 118.25 | 65.06 |
| 1 | 53.19 | Key Vault (two staging copies) | 236.43 | 183.24 |
| 10 | 171.45 | Key Vault (one staging copy) | 118.25 | -53.20 |
| 10 | 171.45 | Key Vault (two staging copies) | 236.43 | 64.98 |
| 100 | 1,354.05 | Key Vault (one staging copy) | 118.25 | -1,235.80 |
| 100 | 1,354.05 | Key Vault (two staging copies) | 236.43 | -1,117.62 |
| 1,000 | 13,180.05 | Key Vault (one staging copy) | 118.25 | -13,061.80 |
| 1,000 | 13,180.05 | Key Vault (two staging copies) | 236.43 | -12,943.62 |
| 10,000 | 131,440.05 | Key Vault (one staging copy) | 1,635.92 | -129,804.13 |
| 10,000 | 131,440.05 | Key Vault (two staging copies) | 3,271.77 | -128,168.28 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Representative value size | 1,024 | bytes |
| Key Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Records read per API request | 1 | records/request |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Representative value size | 1,024 | bytes |
| Key Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Records read per API request | 1 | records/request |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Provider reconciliation operations use the vault-operation rate; Standard secrets have no storage meter.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a5870b86a42807d366a1ccbb2d8d495c03fa4ea1` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

### AWS Secrets Manager · Stored logical secrets

Feature: AWS Secrets Manager.

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/3ef0e7110b75faac7900e36720433ab37329907c7be6c1892c1f14f910cb7927-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/b5b4eda2e69a7a4477e067ed4ff8f7dc566059f2c0dcde750c49c3d20974bdbd-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Key Vault (one staging copy) | 118.24 | 113.19 |
| 0 | 5.05 | Key Vault (two staging copies) | 236.42 | 231.37 |
| 10 | 9.05 | Key Vault (one staging copy) | 118.24 | 109.19 |
| 10 | 9.05 | Key Vault (two staging copies) | 236.42 | 227.37 |
| 100 | 45.05 | Key Vault (one staging copy) | 118.25 | 73.20 |
| 100 | 45.05 | Key Vault (two staging copies) | 236.43 | 191.38 |
| 1,000 | 405.05 | Key Vault (one staging copy) | 118.34 | -286.71 |
| 1,000 | 405.05 | Key Vault (two staging copies) | 236.52 | -168.53 |
| 10,000 | 4,005.05 | Key Vault (one staging copy) | 119.23 | -3,885.82 |
| 10,000 | 4,005.05 | Key Vault (two staging copies) | 237.41 | -3,767.64 |
| 100,000 | 40,005.05 | Key Vault (one staging copy) | 128.14 | -39,876.91 |
| 100,000 | 40,005.05 | Key Vault (two staging copies) | 246.32 | -39,758.73 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (one staging copy) | Representative value size | 1,024 | bytes |
| Key Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (one staging copy) | Records read per API request | 1 | records/request |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Key Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Key Vault (two staging copies) | Representative value size | 1,024 | bytes |
| Key Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Key Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Key Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Key Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Key Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Key Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Key Vault (two staging copies) | Records read per API request | 1 | records/request |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Provider reconciliation operations use the vault-operation rate; Standard secrets have no storage meter.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a5870b86a42807d366a1ccbb2d8d495c03fa4ea1` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## AWS Secrets Manager → Kubernetes Secret

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `tensor9::1.0.0::emu::aws/1.0.0/secretsmanager::kube`.

### AWS Secrets Manager · Secret API reads

Feature: AWS Secrets Manager.

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/3ff5e531a8ae326645a9cfb179fef4b422ee97fe9a3d4338c7067d92d3b79cdf-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/efe1909835d0d9e714857db062ab471b43d331eba6534cf88051d3ccb9c3d7c3-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Kubernetes Secret | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Kubernetes Secret (one copy) | 80.90 | 40.85 |
| 0 | 40.05 | Kubernetes Secret (two copies) | 161.79 | 121.74 |
| 1 | 53.19 | Kubernetes Secret (one copy) | 80.90 | 27.71 |
| 1 | 53.19 | Kubernetes Secret (two copies) | 161.79 | 108.60 |
| 10 | 171.45 | Kubernetes Secret (one copy) | 80.90 | -90.55 |
| 10 | 171.45 | Kubernetes Secret (two copies) | 161.79 | -9.66 |
| 100 | 1,354.05 | Kubernetes Secret (one copy) | 80.90 | -1,273.15 |
| 100 | 1,354.05 | Kubernetes Secret (two copies) | 161.79 | -1,192.26 |
| 1,000 | 13,180.05 | Kubernetes Secret (one copy) | 80.90 | -13,099.15 |
| 1,000 | 13,180.05 | Kubernetes Secret (two copies) | 161.79 | -13,018.26 |
| 10,000 | 131,440.05 | Kubernetes Secret (one copy) | 1,144.34 | -130,295.71 |
| 10,000 | 131,440.05 | Kubernetes Secret (two copies) | 2,288.68 | -129,151.37 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Secret (one copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Representative value size | 1,024 | bytes |
| Kubernetes Secret (one copy) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (one copy) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (one copy) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (one copy) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (one copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (one copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (one copy) | Records read per API request | 1 | records/request |
| Kubernetes Secret (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Secret (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Secret (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Secret (two copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Representative value size | 1,024 | bytes |
| Kubernetes Secret (two copies) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (two copies) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (two copies) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (two copies) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (two copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (two copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (two copies) | Records read per API request | 1 | records/request |
| Kubernetes Secret (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Secret (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Secret (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Self-hosted target: Tensor9-built Secrets Manager service on Kubernetes Secrets; no vendor charge. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-3cc07bdd0f43f7beabfb1c23deaeed786570940f` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

### AWS Secrets Manager · Stored logical secrets

Feature: AWS Secrets Manager.

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/05fa8136c8defab8d3def1d1f3efc93cb3d1ff16e9e3eb64e1a806351322f919-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/aed64f99c654e5b4e8cfbcb28e85d85275558466c96fdfc662707b50993be672-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Kubernetes Secret | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Kubernetes Secret (one copy) | 80.90 | 75.85 |
| 0 | 5.05 | Kubernetes Secret (two copies) | 161.79 | 156.74 |
| 10 | 9.05 | Kubernetes Secret (one copy) | 80.90 | 71.85 |
| 10 | 9.05 | Kubernetes Secret (two copies) | 161.79 | 152.74 |
| 100 | 45.05 | Kubernetes Secret (one copy) | 80.90 | 35.85 |
| 100 | 45.05 | Kubernetes Secret (two copies) | 161.79 | 116.74 |
| 1,000 | 405.05 | Kubernetes Secret (one copy) | 80.90 | -324.15 |
| 1,000 | 405.05 | Kubernetes Secret (two copies) | 161.79 | -243.26 |
| 10,000 | 4,005.05 | Kubernetes Secret (one copy) | 80.90 | -3,924.15 |
| 10,000 | 4,005.05 | Kubernetes Secret (two copies) | 161.79 | -3,843.26 |
| 100,000 | 40,005.05 | Kubernetes Secret (one copy) | 80.90 | -39,924.15 |
| 100,000 | 40,005.05 | Kubernetes Secret (two copies) | 161.79 | -39,843.26 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Secret (one copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (one copy) | Representative value size | 1,024 | bytes |
| Kubernetes Secret (one copy) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (one copy) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (one copy) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (one copy) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (one copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (one copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (one copy) | Records read per API request | 1 | records/request |
| Kubernetes Secret (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Secret (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Secret (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Secret (two copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Kubernetes Secret (two copies) | Representative value size | 1,024 | bytes |
| Kubernetes Secret (two copies) | Versions retained in adapter state | 10 | versions/object |
| Kubernetes Secret (two copies) | Provider revisions retained per logical object | 2 | versions/object |
| Kubernetes Secret (two copies) | Physical record / payload storage | 1.5 | multiplier |
| Kubernetes Secret (two copies) | Provider reconciliation checks | 30 | checks/object-month |
| Kubernetes Secret (two copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Kubernetes Secret (two copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Kubernetes Secret (two copies) | Records read per API request | 1 | records/request |
| Kubernetes Secret (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Secret (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Secret (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Secret (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Secret (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Secret (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Secret (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Secret (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Secret (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Secret (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Secret (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Secret (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Secret (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Secret (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Secret (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Secret (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Secret (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Secret (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Secret (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Secret (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Secret (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Secret (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Secret (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Secret (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Secret (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Secret (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Secret (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Secret (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Secret (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Self-hosted target: Tensor9-built Secrets Manager service on Kubernetes Secrets; no vendor charge. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-3cc07bdd0f43f7beabfb1c23deaeed786570940f` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## AWS Secrets Manager → OCI Vault

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `oci::1.0.0::vault`.

### AWS Secrets Manager · Secret API reads

Feature: AWS Secrets Manager.

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e44dac759db16a1d393d1004749a661fe1dd6550db37d34fa6a8099c64399e79-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/cce78af63a8486dae32208af9aee201409e563a781772fe724dc79b90af0fd5c-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | OCI Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | OCI Vault (one staging copy) | 118.18 | 78.13 |
| 0 | 40.05 | OCI Vault (two staging copies) | 236.36 | 196.31 |
| 1 | 53.19 | OCI Vault (one staging copy) | 118.18 | 64.99 |
| 1 | 53.19 | OCI Vault (two staging copies) | 236.36 | 183.17 |
| 10 | 171.45 | OCI Vault (one staging copy) | 118.18 | -53.27 |
| 10 | 171.45 | OCI Vault (two staging copies) | 236.36 | 64.91 |
| 100 | 1,354.05 | OCI Vault (one staging copy) | 118.18 | -1,235.87 |
| 100 | 1,354.05 | OCI Vault (two staging copies) | 236.36 | -1,117.69 |
| 1,000 | 13,180.05 | OCI Vault (one staging copy) | 118.18 | -13,061.87 |
| 1,000 | 13,180.05 | OCI Vault (two staging copies) | 236.36 | -12,943.69 |
| 10,000 | 131,440.05 | OCI Vault (one staging copy) | 1,635.85 | -129,804.20 |
| 10,000 | 131,440.05 | OCI Vault (two staging copies) | 3,271.70 | -128,168.35 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Representative value size | 1,024 | bytes |
| OCI Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (one staging copy) | Records read per API request | 1 | records/request |
| OCI Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI Vault (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Representative value size | 1,024 | bytes |
| OCI Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (two staging copies) | Records read per API request | 1 | records/request |
| OCI Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI Vault (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* OCI Secret Management has no charge for secret versions or retrieval; only an HSM-protected protecting key above 20 versions or a private vault (USD 3.724/hour) would bill, and the default software-protected key is free.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* OCI Secret Management: [https://www.oracle.com/security/cloud-security/secrets/](https://www.oracle.com/security/cloud-security/secrets/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a3102dfef67b819887de750afea3c1b456606428` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [OCI Secret Management](https://www.oracle.com/security/cloud-security/secrets/).

### AWS Secrets Manager · Stored logical secrets

Feature: AWS Secrets Manager.

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/043bf303138741d1b6f91b48ca679ea6cb93c908f9f4213b4388276b6bdfe564-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/52f645aee1012755a52833c314db50ed8b1f3acbcd514849b51cb32caea0eba0-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | OCI Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | OCI Vault (one staging copy) | 118.18 | 113.13 |
| 0 | 5.05 | OCI Vault (two staging copies) | 236.36 | 231.31 |
| 10 | 9.05 | OCI Vault (one staging copy) | 118.18 | 109.13 |
| 10 | 9.05 | OCI Vault (two staging copies) | 236.36 | 227.31 |
| 100 | 45.05 | OCI Vault (one staging copy) | 118.18 | 73.13 |
| 100 | 45.05 | OCI Vault (two staging copies) | 236.36 | 191.31 |
| 1,000 | 405.05 | OCI Vault (one staging copy) | 118.18 | -286.87 |
| 1,000 | 405.05 | OCI Vault (two staging copies) | 236.36 | -168.69 |
| 10,000 | 4,005.05 | OCI Vault (one staging copy) | 118.18 | -3,886.87 |
| 10,000 | 4,005.05 | OCI Vault (two staging copies) | 236.36 | -3,768.69 |
| 100,000 | 40,005.05 | OCI Vault (one staging copy) | 118.18 | -39,886.87 |
| 100,000 | 40,005.05 | OCI Vault (two staging copies) | 236.36 | -39,768.69 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI Vault (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (one staging copy) | Representative value size | 1,024 | bytes |
| OCI Vault (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (one staging copy) | Records read per API request | 1 | records/request |
| OCI Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI Vault (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (one staging copy) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI Vault (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| OCI Vault (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| OCI Vault (two staging copies) | Representative value size | 1,024 | bytes |
| OCI Vault (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| OCI Vault (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| OCI Vault (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| OCI Vault (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| OCI Vault (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| OCI Vault (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| OCI Vault (two staging copies) | Records read per API request | 1 | records/request |
| OCI Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI Vault (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI Vault (two staging copies) | Target list price · resource-month | 0 | USD/resource-month |
| OCI Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* OCI Secret Management has no charge for secret versions or retrieval; only an HSM-protected protecting key above 20 versions or a private vault (USD 3.724/hour) would bill, and the default software-protected key is free.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* OCI Secret Management: [https://www.oracle.com/security/cloud-security/secrets/](https://www.oracle.com/security/cloud-security/secrets/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-a3102dfef67b819887de750afea3c1b456606428` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [OCI Secret Management](https://www.oracle.com/security/cloud-security/secrets/).

## AWS Secrets Manager → Secret Manager

Origin API: `aws::1.0.0::secretsmanager`. Target backend: `google::1.0.0::secret-manager`.

### AWS Secrets Manager · Secret API reads

Feature: AWS Secrets Manager.

Estimated monthly service charges by Secret API reads. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e5259acd8997885d7355205cb6cdf0ae7b0a9e78bd5924e67dd108a82fd150be-light.svg)

![AWS Secrets Manager · Secret API reads: monthly service charges by Secret API reads. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/c54a9eab079adc7be61d7ac4462fa8546f0c97a1780400437180b35813568bf0-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Secret API reads (operations/s) | Secrets Manager | Target scenario | Secret Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 40.05 | Secret Manager (one staging copy) | 130.25 | 90.20 |
| 0 | 40.05 | Secret Manager (two staging copies) | 248.43 | 208.38 |
| 1 | 53.19 | Secret Manager (one staging copy) | 130.25 | 77.06 |
| 1 | 53.19 | Secret Manager (two staging copies) | 248.43 | 195.24 |
| 10 | 171.45 | Secret Manager (one staging copy) | 130.25 | -41.20 |
| 10 | 171.45 | Secret Manager (two staging copies) | 248.43 | 76.98 |
| 100 | 1,354.05 | Secret Manager (one staging copy) | 130.25 | -1,223.80 |
| 100 | 1,354.05 | Secret Manager (two staging copies) | 248.43 | -1,105.62 |
| 1,000 | 13,180.05 | Secret Manager (one staging copy) | 130.25 | -13,049.80 |
| 1,000 | 13,180.05 | Secret Manager (two staging copies) | 248.43 | -12,931.62 |
| 10,000 | 131,440.05 | Secret Manager (one staging copy) | 1,647.92 | -129,792.13 |
| 10,000 | 131,440.05 | Secret Manager (two staging copies) | 3,283.77 | -128,156.28 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Secret Manager (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Representative value size | 1,024 | bytes |
| Secret Manager (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (one staging copy) | Records read per API request | 1 | records/request |
| Secret Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Secret Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Secret Manager (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Secret Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Secret Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Secret Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Secret Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Secret Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Secret Manager (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Representative value size | 1,024 | bytes |
| Secret Manager (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (two staging copies) | Records read per API request | 1 | records/request |
| Secret Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Secret Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Secret Manager (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Secret Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Secret Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Secret Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Secret Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Secret Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Monthly resource quantity is retained active provider versions, independent of logical source objects; access operations are separate from local adapter reads, and management operations are free. The account-wide free tier (6 versions, 10,000 accesses a month) is not applied.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Secret Manager pricing: [https://cloud.google.com/secret-manager/pricing](https://cloud.google.com/secret-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-74be73a1c55cd94e18955e080cba3c0d8c54b8ff` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Secret Manager pricing](https://cloud.google.com/secret-manager/pricing).

### AWS Secrets Manager · Stored logical secrets

Feature: AWS Secrets Manager.

Estimated monthly service charges by Stored logical secrets. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/f9fea7c05a693edbaf23836554ea1ab76aac9b06bc6dfa99b7d78d50830b91e2-light.svg)

![AWS Secrets Manager · Stored logical secrets: monthly service charges by Stored logical secrets. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/eeb50a177eb8cd64f3a61fb2fd2958dc81ad128b8a096a08e9fdac7c093ed3d5-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Stored logical secrets (secrets) | Secrets Manager | Target scenario | Secret Manager | Difference |
| -: | -: | - | -: | -: |
| 0 | 5.05 | Secret Manager (one staging copy) | 118.24 | 113.19 |
| 0 | 5.05 | Secret Manager (two staging copies) | 236.42 | 231.37 |
| 10 | 9.05 | Secret Manager (one staging copy) | 119.44 | 110.39 |
| 10 | 9.05 | Secret Manager (two staging copies) | 237.62 | 228.57 |
| 100 | 45.05 | Secret Manager (one staging copy) | 130.25 | 85.20 |
| 100 | 45.05 | Secret Manager (two staging copies) | 248.43 | 203.38 |
| 1,000 | 405.05 | Secret Manager (one staging copy) | 238.34 | -166.71 |
| 1,000 | 405.05 | Secret Manager (two staging copies) | 356.52 | -48.53 |
| 10,000 | 4,005.05 | Secret Manager (one staging copy) | 1,319.23 | -2,685.82 |
| 10,000 | 4,005.05 | Secret Manager (two staging copies) | 1,437.41 | -2,567.64 |
| 100,000 | 40,005.05 | Secret Manager (one staging copy) | 12,128.14 | -27,876.91 |
| 100,000 | 40,005.05 | Secret Manager (two staging copies) | 12,246.32 | -27,758.73 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Secret Manager (one staging copy) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (one staging copy) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (one staging copy) | Representative value size | 1,024 | bytes |
| Secret Manager (one staging copy) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (one staging copy) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (one staging copy) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (one staging copy) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (one staging copy) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (one staging copy) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (one staging copy) | Records read per API request | 1 | records/request |
| Secret Manager (one staging copy) | Target price guess · read | 0 | USD/read |
| Secret Manager (one staging copy) | Target price guess · write | 0 | USD/write |
| Secret Manager (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (one staging copy) | Target monthly base charge | 0 | USD/month |
| Secret Manager (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (one staging copy) | Minimum primary RAM | 8 | GiB |
| Secret Manager (one staging copy) | Minimum primary disk | 100 | GiB |
| Secret Manager (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Secret Manager (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Secret Manager (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Secret Manager (two staging copies) | Origin list price · Logical secret inventory | 0.4 | USD/secret-month |
| Secret Manager (two staging copies) | Origin list price · Value and metadata reads | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Origin list price · Value and metadata mutations | 0.000005 | USD/requests |
| Secret Manager (two staging copies) | Representative value size | 1,024 | bytes |
| Secret Manager (two staging copies) | Versions retained in adapter state | 10 | versions/object |
| Secret Manager (two staging copies) | Provider revisions retained per logical object | 2 | versions/object |
| Secret Manager (two staging copies) | Physical record / payload storage | 1.5 | multiplier |
| Secret Manager (two staging copies) | Provider reconciliation checks | 30 | checks/object-month |
| Secret Manager (two staging copies) | Provider calls per current-value mutation | 2 | operations/mutation |
| Secret Manager (two staging copies) | Provider reconciliation retry multiplier | 1.1 | multiplier |
| Secret Manager (two staging copies) | Records read per API request | 1 | records/request |
| Secret Manager (two staging copies) | Target price guess · read | 0 | USD/read |
| Secret Manager (two staging copies) | Target price guess · write | 0 | USD/write |
| Secret Manager (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Secret Manager (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Secret Manager (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Secret Manager (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Secret Manager (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Secret Manager (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Secret Manager (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Secret Manager (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Secret Manager (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Secret Manager (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Secret Manager (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Secret Manager (two staging copies) | Target monthly base charge | 0 | USD/month |
| Secret Manager (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Secret Manager (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Secret Manager (two staging copies) | Minimum primary RAM | 8 | GiB |
| Secret Manager (two staging copies) | Minimum primary disk | 100 | GiB |
| Secret Manager (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Secret Manager (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Secret Manager (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Secret Manager (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Secret Manager (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Secret Manager (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Secret Manager (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Secret Manager (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Secret Manager (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Secret Manager (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Secret Manager (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Secret Manager (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Application reads use durable adapter records. Managed operations estimate independent backend reconciliation, not a provider secret-access charge on every application read.
* The External Secrets synchronization option has a different read path: source polling and its source-provider charges must be supplied separately. This family does not imply those source charges disappear.
* The adapter-state Kubernetes backend creates no additional Kubernetes Secret; cloud provider copies and history have separate retention.
* Monthly resource quantity is retained active provider versions, independent of logical source objects; access operations are separate from local adapter reads, and management operations are free. The account-wide free tier (6 versions, 10,000 accesses a month) is not applied.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSSecretsManager offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json)
* Secret Manager pricing: [https://cloud.google.com/secret-manager/pricing](https://cloud.google.com/secret-manager/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Rotation-function execution, customer-managed encryption-key calls, geographic replica copies and External Secrets source polling.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-74be73a1c55cd94e18955e080cba3c0d8c54b8ff` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSSecretsManager offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSSecretsManager/current/us-east-1/index.json), [Secret Manager pricing](https://cloud.google.com/secret-manager/pricing).

See the [service catalog](https://docs.tensor9.com/cloud-adapter-early-access/service-catalog/aws/catalog.md) for operation coverage, supported directions and backend limitations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.