> ## Documentation Index > Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt > Use this file to discover all available pages before exploring further. # Application Load Balancer > Application Load Balancer APIs with Cloud Adapter. This page describes how Application Load Balancer maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior. ## Supported environments * Azure * DigitalOcean * Google Cloud * OCI * Scaleway Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available. ## How the backends compare Each row compares a capability of Application Load Balancer with its adaptation on each backend. A dash means this profile does not state the capability for that backend. ### Cloud Adapter | Capability | Application Load Balancer | Azure | DigitalOcean | Google Cloud | OCI | Scaleway | | - | - | - | - | - | - | - | | Traffic path | AWS load balancer | Azure Application Gateway | DigitalOcean Load Balancer | Google Cloud Load Balancing | OCI Flexible Load Balancer | - | | Request routing | ALB listener conditions | Host and path | Port forwarding only | Path, host, header, query, method; weights | Path, host, header, query | - | | TLS termination | ALB certificate | Azure Key Vault certificate | Managed certificate or passthrough | Google-managed certificate | OCI certificate and listener TLS configuration | - | | Health checks | Per target group | Per backend setting | One per load balancer | Per backend service | Per backend set | - | | Session stickiness | Configured cookie lifetime | Browser-session affinity | Cookie affinity | Cookie duration up to one day | Cookie duration preserved | - | | Client endpoint | AWS hostname | Target cloud address | Target cloud address | Target cloud address | Target cloud address | - | | API coverage | full | partial | partial | partial | partial | partial | | Login at the load balancer · OIDC / OAuth termination | Yes - authenticate-oidc / authenticate-cognito | - | - | Partial - Identity-Aware Proxy on the backend service | - | - | ## On Azure ### Azure Load Balancer | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Authentication (OIDC / OAuth) | Access control | Out of scope | Most usage | Listener-based OIDC or OAuth login is outside this option. Handle authentication in the application or an identity-aware proxy. | | Health checks | Backends | Supported | Common | Health probes belong to backend settings. Azure also offers response-body matching as an Application Gateway capability. | | Session stickiness | Backends | Supported | Most usage | Cookie affinity lasts for the browser session; Azure has no configured cookie-duration setting. | | gRPC backends | Backends | Out of scope | Most usage | This option does not provide gRPC to backends. | | Load balancer address | Consumers | Supported | Common | Clients use the Azure address. Supported references in an infrastructure translation are updated during the build. | | Traffic forwarding | Data plane | Supported | Common | Azure Application Gateway v2 receives HTTP or HTTPS traffic and forwards it to the backends. | | HTTPS / TLS termination | Listeners | Supported | Common | The gateway uses Azure Key Vault certificates, including multi-site setups. | | Listeners & target groups | Listeners | Supported | Common | Application Gateway listeners and backend pools represent AWS listeners and target groups. | | Routing rules (path / host) | Routing | Partial | Most usage | Host and path conditions map to multi-site listeners and path rules. Header, method, query, and source-IP conditions are outside this mapping. | | Weighted target groups | Routing | Out of scope | Most usage | Weighted target-group forwarding is outside the Application Gateway mapping. | #### How it works When a deployment provides the runtime AWS load-balancing API, your application and Terraform keep using that API. The Tensor9 adapter answers those calls (`CreateLoadBalancer`, `CreateListener`, `RegisterTargets` and the rest), keeps the AWS load balancer, listener and target group identities, saves each change and applies it to Azure Application Gateway. A target group is the set of backends a listener forwards traffic to. That runtime design is separate from translating a stack to native load-balancer resources. A designed runtime model does not establish that the deployment can serve it, and a missing native mapping does not silently select a runtime fallback. Confirm the selected deployment supports the required path. Client traffic does not pass through the adapter. Clients connect to the cloud load balancer, which forwards requests to your backends. A management call can return success before the cloud change has finished; the adapter keeps the requested configuration and finishes applying it in the background. Wait until the load balancer is available and check the cloud resources before sending production traffic. ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIj48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojY2JkNWUxIj48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZWNmZGY1Ii8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2VjZmRmNSIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojMGYxNzJhIj48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ij48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojNDc1NTY5Ij48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzZlZTdiNyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMDY0ZTNiIi8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzA2NGUzYiIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojZjFmNWY5Ij48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) Management calls go through the adapter; client traffic goes straight to the cloud load balancer. #### Application Gateway resources An ALB maps to Application Gateway v2. Its listeners accept HTTP or HTTPS, backend pools stand in for target groups, and routing rules choose a pool: host conditions become multi-site listeners and path conditions become path rules. The gateway runs in its own subnet. An ALB does not also need an Azure Standard Load Balancer. HTTPS uses a certificate stored in Azure Key Vault. Multi-site setups, Server Name Indication (SNI) and Application Gateway's mutual TLS work with it. Each backend setting has a health probe, which keeps the target group's path, expected status codes, interval, timeout, unhealthy threshold and explicit port. Application Gateway can also match on the response body; that is an extra Azure option, not an AWS setting you need to recreate. #### Client access The adapter enforces the supported rules of the security groups on the load balancer through a network security group (NSG) on the gateway's subnet. The NSG allows the security groups' IPv4 client ranges on the listener ports. Azure also requires the subnet to allow GatewayManager traffic on ports 65200-65535, AzureLoadBalancer health traffic, and unrestricted outbound access. Because the subnet holds only the gateway, these rules do not change any other workload's access. A security group rule the NSG cannot express is rejected. The gateway becomes available only after its NSG is in place. #### Deployment availability This runtime design does not establish a working native stack translation or an available runtime deployment. A stack combining this load balancer, EC2 instances and a VPC is not currently available on this target. A missing native mapping does not automatically enable the runtime API. Use a supported configuration or author the native load-balancer resources separately. #### Targets and health checks For a deployment that serves the runtime API, `RegisterTargets` and `DeregisterTargets` add and remove backends from a target group. An instance ID is resolved from the EC2 instances the adapter knows about; an IP registration names the backend's address and port. The target group, the load balancer and the backend must be on networks that can reach each other. The adapter applies a listener only after its target group and network are ready. The cloud load balancer's own health checks decide which backends receive traffic. A registered target is not proof that its application is ready: check the cloud provider's health status and send a real application request first. `DescribeTargetHealth` reports the cloud load balancer's probe results, read once per health-check interval, in AWS's states and reason codes: `initial` while checks start, then `healthy` or `unhealthy`. If the adapter has not been able to read health for three intervals, it reports `unavailable`. Drain connections before you deregister backends or delete a load balancer. Removing configuration does not move active connections to a replacement. #### Limitations * **Header, method, query and source-IP conditions are not supported.** Only host and path conditions are mapped to Application Gateway routing rules. * **Weighted target groups and fixed responses are not supported.** A listener rule that splits traffic between target groups by weight, or answers with a fixed response, has no Application Gateway mapping. * **gRPC to backends is not supported.** Application Gateway forwards HTTP and HTTPS to the backend pools; gRPC backends are not part of this mapping. * **Cookie stickiness behaves differently: affinity lasts for the browser session.** Application Gateway has no setting for the cookie's lifetime, so an AWS stickiness duration is not kept. * **Login at the load balancer is not supported.** Listener OIDC or OAuth authenticate actions are not mapped. Handle login in your application or an identity-aware proxy. * **You must put the certificate in Azure Key Vault.** An ACM certificate ARN is only a reference; it does not carry the certificate and private key. Import or issue the certificate in Key Vault for the gateway to use. * **You must give the gateway its own subnet.** The subnet must allow the Azure management and health traffic above and unrestricted outbound access, so it cannot be shared with other workloads. #### Other considerations **Before going live.** Deploy the adapter with permission to manage load balancers and their network resources in the customer's cloud account. Your AWS credentials authorize the management calls; the adapter uses the target cloud's credentials to apply them. Set public or private exposure, client access rules, backend access and health-check access together. **Moving from AWS.** Prepare DNS records and firewall allowlists for the new address. In an infrastructure-only deployment, references inside the translated stack are updated during the build, but external DNS and clients still need to be switched. At the Max tier the adapter also keeps the AWS identities your management calls use. Check certificates, routing, health checks and a complete client request before changing DNS, and keep the old load balancer running while existing connections drain. Application sessions and active connections are not copied. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Load balancer data plane (ALB) · Processed load-balancer GiB per month Feature: Load balancer data plane (ALB). Estimated monthly service charges by Processed load-balancer GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: Global; currency: USD. ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/0a42883dd9ca4c10aa8450c257b5587cc566a82f0075d65ae224e86bcf5935bf-light.svg) ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/a27bb090a1e1db526dd8c2e5c5af5a9fec687b847750f8b7d6363f7f4668b585-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Processed load-balancer GiB per month (GiB/month) | Application Load Balancer | Azure Load Balancer | Difference | | -: | -: | -: | -: | | 0 | 16.43 | 18.25 | 1.83 | | 100 | 17.23 | 18.75 | 1.53 | | 1,000 | 24.43 | 23.25 | -1.18 | | 10,000 | 96.43 | 68.25 | -28.18 | | 100,000 | 816.43 | 518.25 | -298.18 | | 1,000,000 | 8,016.43 | 5,018.25 | -2,998.18 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.005 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.025 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → Global, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. The base hour includes 5 rules; each additional rule lists USD 0.01/hour. * AWS Price List API, AWSELB offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json) * Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-7ab742b570a9e0cea8d6cac36a5f6827160a3584` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices). **Load balancer data plane (ALB) → Azure Load Balancer: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: Global. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Allocated load-balancer hours | 16.43 | | Origin: Load-balancer processed bytes | 8.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 5.00 | | Target: Independent native resources | 18.25 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **24.43** | | **Target service subtotal** | **23.25** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.005 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.025 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Allocated load-balancer hours | 730 | load-balancer-hour | | Load-balancer processed bytes | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 0 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. The base hour includes 5 rules; each additional rule lists USD 0.01/hour. List prices read: 2026-10-22. Model: `plan-7ab742b570a9e0cea8d6cac36a5f6827160a3584` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices). ## On DigitalOcean ### DigitalOcean Load Balancer | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Health checks | Backends | Partial | Common | One health check serves the entire load balancer. The mapping uses the first target group and reports conflicts with other checks. | | Session stickiness | Backends | Supported | Most usage | Cookie stickiness is supported on the shared backend pool. | | Target registration | Backends | Partial | Most usage | Translated instance attachments populate one Droplet pool. Referenced target groups must have identical members, and every listener needs one uniform effective target port, including attachment overrides. Fleet attachments are not supported; runtime registration requires a deployment serving that API. | | Access logs / WAF / reserved IPs | Configuration | Out of scope | Full surface | These AWS settings are outside this load-balancer mapping. | | Network placement | Configuration | Partial | Full surface | DigitalOcean offers internal load balancers. Confirm the target VPC and public or internal setting; this mapping requires exposure review. | | Load balancer address | Consumers | Partial | Common | Clients use the load balancer's IP. The infrastructure translation updates supported hostname references and rejects identifiers without an equivalent. | | Traffic forwarding | Data plane | Supported | Common | DigitalOcean forwards traffic through one native load balancer, with a rule per listener. | | HTTPS / TLS termination | Listeners | Supported | Common | Terminate TLS with a managed certificate, including automatic Let's Encrypt issuance, or pass the encrypted connection through to a backend that terminates it. | | Routing rules (path / host / header) | Routing | Out of scope | Most usage | This option forwards by port and retains the default backend. Content-based listener rules are outside the mapping. | #### How it works When a deployment provides the runtime AWS load-balancing API, your application and Terraform keep using that API. The Tensor9 adapter answers those calls (`CreateLoadBalancer`, `CreateListener`, `RegisterTargets` and the rest), keeps the AWS load balancer, listener and target group identities, saves each change and applies it to a DigitalOcean Load Balancer. A target group is the set of backends a listener forwards traffic to. That runtime design is separate from translating a stack to native load-balancer resources. A designed runtime model does not establish that the deployment can serve it, and a missing native mapping does not silently select a runtime fallback. Confirm the selected deployment supports the required path. Client traffic does not pass through the adapter. Clients connect to the cloud load balancer, which forwards requests to your backends. A management call can return success before the cloud change has finished; the adapter keeps the requested configuration and finishes applying it in the background. Wait until the load balancer is available and check the cloud resources before sending production traffic. ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIj48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojY2JkNWUxIj48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZWNmZGY1Ii8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2VjZmRmNSIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojMGYxNzJhIj48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ij48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojNDc1NTY5Ij48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzZlZTdiNyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMDY0ZTNiIi8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzA2NGUzYiIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojZjFmNWY5Ij48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) Management calls go through the adapter; client traffic goes straight to the cloud load balancer. #### Forwarding rules and the Droplet pool Each listener becomes a forwarding rule from a frontend protocol and port to a backend port, and keeps the listener's default forwarding. All rules send traffic to one Droplet pool, selected by tag or ID. The load balancer runs in one region and is sized by node count. It gets a stable IP address, and cookie stickiness is supported on the shared pool. TLS can end at the load balancer, with a DigitalOcean managed certificate (including automatic Let's Encrypt issuance), or pass through to a backend that terminates it. An ACM certificate cannot be copied, so when your stack is translated an HTTPS listener starts as TLS passthrough. To end TLS at the load balancer, add a DigitalOcean certificate and the DNS it needs. DigitalOcean offers public and internal load balancers. Confirm the VPC and the internal setting before cutover; the AWS setting alone does not make the translated load balancer private. #### Targets in a translated stack Supported instance attachments add the migrated Droplets to one native pool. All referenced target groups must have identical members. Each listener can keep one uniform effective backend port, including a shared attachment override; mixed target ports or different target-group membership are refused. The whole load balancer still has one health check, selected from the first target group, so its protocol, path and port must work for every Droplet. Auto Scaling replicas are not attached by this mapping. A supported target is a direct reference to the ID of an instance translated in this stack. IP and Lambda targets, conditional or computed target selection, unmapped instances and unsupported fleet attachments are reported and left unwired; those targets receive no traffic or health checks. A computed or invalid attachment or health-check port is refused rather than replaced with a default. Check every warning and send a complete application request before switching traffic. Scaleway load balancers and Akamai NodeBalancers do not receive translated instance targets through this mapping. Their missing attachments are reported; configure the native backends before expecting them to serve traffic. #### Targets and health checks For a deployment that serves the runtime API, `RegisterTargets` and `DeregisterTargets` add and remove backends from a target group. An instance ID is resolved from the EC2 instances the adapter knows about; an IP registration names the backend's address and port. The target group, the load balancer and the backend must be on networks that can reach each other. The adapter applies a listener only after its target group and network are ready. The cloud load balancer's own health checks decide which backends receive traffic. A registered target is not proof that its application is ready: check the cloud provider's health status and send a real application request first. `DescribeTargetHealth` answers from the adapter's saved records of registration and zone eligibility. A `healthy` result does not mean the cloud load balancer's probe succeeded, so check the backend health in the cloud provider's console or API as well. Drain connections before you deregister backends or delete a load balancer. Removing configuration does not move active connections to a replacement. #### Limitations * **Path, host, header and query routing is not supported.** Listener rules that route by request content, and weighted target groups, are not reproduced. Move content-based routing into your application or an ingress proxy before using this load balancer. * **Health checks behave differently: one check for the whole load balancer.** The check is taken from the first target group, and conflicting checks on other groups are reported. Its protocol, port and path must work for every backend in the pool. * **A pre-reserved Elastic IP is not supported.** The address is allocated when the load balancer is created. Update client DNS and allowlists to it afterwards. * **Access logs, WAF attachment and reserved-IP mappings are not supported.** These AWS settings are not part of this mapping. Set up logging and request filtering separately if you need them. * **You must check that session behaviour still fits.** All forwarding rules share one Droplet pool. Confirm that the forwarding mode and the shared pool keep the cookie stickiness your application expects. #### Other considerations **Before going live.** Deploy the adapter with permission to manage load balancers and their network resources in the customer's cloud account. Your AWS credentials authorize the management calls; the adapter uses the target cloud's credentials to apply them. Set public or private exposure, client access rules, backend access and health-check access together. **Moving from AWS.** Prepare DNS records and firewall allowlists for the new address. In an infrastructure-only deployment, references inside the translated stack are updated during the build, but external DNS and clients still need to be switched. At the Max tier the adapter also keeps the AWS identities your management calls use. Check certificates, routing, health checks and a complete client request before changing DNS, and keep the old load balancer running while existing connections drain. Application sessions and active connections are not copied. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Load balancer data plane (ALB) · Processed load-balancer GiB per month Feature: Load balancer data plane (ALB). Estimated monthly service charges by Processed load-balancer GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: nyc; currency: USD. ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/4bc1da8a26f4fd6e4b4dbfd2d140a961558bde6286d7c41feb6b2a69aacdd45e-light.svg) ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/7f48d47a2f5465af24c8d897758df8e2738588dc18eec1490c48a97f42816310-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Processed load-balancer GiB per month (GiB/month) | Application Load Balancer | DigitalOcean Load Balancer | Difference | | -: | -: | -: | -: | | 0 | 16.43 | 12.00 | -4.43 | | 100 | 17.23 | 12.00 | -5.23 | | 1,000 | 24.43 | 12.00 | -12.43 | | 10,000 | 96.43 | 12.00 | -84.43 | | 100,000 | 816.43 | 12.00 | -804.43 | | 1,000,000 | 8,016.43 | 12.00 | -8,004.43 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.0164384 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → nyc, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. Each regional node adds 10,000 requests/s and 10,000 connections; there is no per-GB processing charge. * AWS Price List API, AWSELB offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json) * DigitalOcean Load Balancer pricing: [https://www.digitalocean.com/pricing/load-balancers](https://www.digitalocean.com/pricing/load-balancers) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-60be0870af3aa0807cf9b65605c60e7849ee00fb` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [DigitalOcean Load Balancer pricing](https://www.digitalocean.com/pricing/load-balancers). **Load balancer data plane (ALB) → DigitalOcean Load Balancer: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: nyc. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Allocated load-balancer hours | 16.43 | | Origin: Load-balancer processed bytes | 8.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 0.00 | | Target: Independent native resources | 12.00 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **24.43** | | **Target service subtotal** | **12.00** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.0164384 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Allocated load-balancer hours | 730 | load-balancer-hour | | Load-balancer processed bytes | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 0 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. Each regional node adds 10,000 requests/s and 10,000 connections; there is no per-GB processing charge. List prices read: 2026-10-22. Model: `plan-60be0870af3aa0807cf9b65605c60e7849ee00fb` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [DigitalOcean Load Balancer pricing](https://www.digitalocean.com/pricing/load-balancers). ## On Google Cloud ### Cloud Load Balancing | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Authentication (OIDC / OAuth) | Access control | Partial | Most usage | Listener authentication maps to Identity-Aware Proxy on the backend service. External identity providers and Cognito need the Identity Platform arrangement. | | Health checks | Backends | Supported | Common | Checks belong to each backend service. Google HTTP(S) checks require status 200; AWS matchers accepting other codes need a compatible health endpoint. | | Session stickiness | Backends | Supported | Most usage | Generated-cookie affinity is supported, with a maximum duration of one day. | | Load balancer address | Consumers | Supported | Common | Clients use the Google address. Supported references in an infrastructure translation are updated during the build. | | Traffic forwarding | Data plane | Supported | Common | Google Cloud Load Balancing receives client connections and forwards requests to the backends. | | HTTPS / TLS termination | Listeners | Supported | Common | Google-managed certificates provide HTTPS, including multiple domains. | | Listeners & target groups | Listeners | Supported | Common | Listeners map to forwarding rules and proxies; target groups map to backend services selected by URL maps. | | Routing rules (path / host / header / query) | Routing | Partial | Most usage | URL maps handle path, host, header, query, and method conditions. Source-IP conditions and fixed responses are outside this mapping. | | Weighted target groups | Routing | Supported | Most usage | Weighted target groups become weighted backend services. | #### How it works When a deployment provides the runtime AWS load-balancing API, your application and Terraform keep using that API. The Tensor9 adapter answers those calls (`CreateLoadBalancer`, `CreateListener`, `RegisterTargets` and the rest), keeps the AWS load balancer, listener and target group identities, saves each change and applies it to Google Cloud Load Balancing. A target group is the set of backends a listener forwards traffic to. That runtime design is separate from translating a stack to native load-balancer resources. A designed runtime model does not establish that the deployment can serve it, and a missing native mapping does not silently select a runtime fallback. Confirm the selected deployment supports the required path. Client traffic does not pass through the adapter. Clients connect to the cloud load balancer, which forwards requests to your backends. A management call can return success before the cloud change has finished; the adapter keeps the requested configuration and finishes applying it in the background. Wait until the load balancer is available and check the cloud resources before sending production traffic. ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIj48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojY2JkNWUxIj48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZWNmZGY1Ii8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2VjZmRmNSIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojMGYxNzJhIj48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ij48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojNDc1NTY5Ij48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzZlZTdiNyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMDY0ZTNiIi8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzA2NGUzYiIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojZjFmNWY5Ij48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) Management calls go through the adapter; client traffic goes straight to the cloud load balancer. #### Google resources and routing A forwarding rule receives traffic at the frontend address. A target proxy handles HTTP or HTTPS, a URL map chooses the backend, and a backend service stands in for each target group, with its own health check. HTTPS uses a Google-managed certificate for your DNS names, including certificates for several domains and the load balancer's mutual TLS. Path, host, header, query and method conditions become URL-map rules, matched in rule-priority order. Weighted target groups become weighted backend services. Cookie stickiness becomes generated-cookie affinity. Health checks keep the target group's path, port, interval, timeout and thresholds. Listener authentication maps to Identity-Aware Proxy on the backend service. Google sign-in works directly; an external identity provider or a Cognito user pool needs Google Identity Platform. Test the login flow as well as the load balancer's health. #### Client access and Cloud Armor Security groups on an ALB have no direct Google equivalent, so you choose how they are handled. Either opt in to Cloud Armor, a separately billed Google service, by tagging the load balancer `t9:ack:degradation` = `load-balancer.firewall-cloud-armor`; or choose to leave the security groups unenforced with `load-balancer.firewall-policy-attachment` and provide access control yourself. If a security group is attached and you choose neither, or both, the request is rejected. With Cloud Armor, the adapter turns the security groups' IPv4 client ranges into one Cloud Armor policy per listener. The policy is attached and confirmed before the frontend becomes available. #### Deployment availability This runtime design does not establish a working native stack translation or an available runtime deployment. A stack combining this load balancer, EC2 instances and a VPC is not currently available on this target. A missing native mapping does not automatically enable the runtime API. Use a supported configuration or author the native load-balancer resources separately. #### Targets and health checks For a deployment that serves the runtime API, `RegisterTargets` and `DeregisterTargets` add and remove backends from a target group. An instance ID is resolved from the EC2 instances the adapter knows about; an IP registration names the backend's address and port. The target group, the load balancer and the backend must be on networks that can reach each other. The adapter applies a listener only after its target group and network are ready. The cloud load balancer's own health checks decide which backends receive traffic. A registered target is not proof that its application is ready: check the cloud provider's health status and send a real application request first. `DescribeTargetHealth` reports the cloud load balancer's probe results, read once per health-check interval, in AWS's states and reason codes: `initial` while checks start, then `healthy` or `unhealthy`. If the adapter has not been able to read health for three intervals, it reports `unavailable`. Drain connections before you deregister backends or delete a load balancer. Removing configuration does not move active connections to a replacement. #### Limitations * **Source-IP conditions and fixed-response actions are not supported.** Listener rules that match on the client address, or answer with a fixed response, have no URL-map mapping. * **Lambda target groups are not supported.** A function deployed behind a separate HTTP or serverless backend does not become an AWS Lambda target registration. * **Cookie stickiness behaves differently: affinity lasts at most one day.** Generated-cookie affinity has a one-day maximum. Review any longer AWS cookie lifetime before moving. * **Health checks behave differently: Google requires status 200.** An AWS matcher that accepts other codes, or a range of codes, needs a health endpoint that returns 200 when healthy. Response-body matching does not replace the status requirement. * **Blocked clients behave differently: Cloud Armor answers HTTP 403.** An AWS security group drops the connection; a request outside the allowed ranges here receives a 403 response instead. * **Cloud Armor enforcement supports only IPv4 HTTP listeners and 10 client ranges.** Each listener may allow at most 10 client CIDR ranges. Redirect actions are rejected on a protected listener, because a redirect would be answered without the policy being checked. * **You must provide access control if you leave security groups unenforced.** With that choice, the security groups do not filter clients at the load balancer. Supply and verify the access control you need separately. #### Other considerations **Before going live.** Deploy the adapter with permission to manage load balancers and their network resources in the customer's cloud account. Your AWS credentials authorize the management calls; the adapter uses the target cloud's credentials to apply them. Set public or private exposure, client access rules, backend access and health-check access together. **Moving from AWS.** Prepare DNS records and firewall allowlists for the new address. In an infrastructure-only deployment, references inside the translated stack are updated during the build, but external DNS and clients still need to be switched. At the Max tier the adapter also keeps the AWS identities your management calls use. Check certificates, routing, health checks and a complete client request before changing DNS, and keep the old load balancer running while existing connections drain. Application sessions and active connections are not copied. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Load balancer data plane (ALB) · Processed load-balancer GiB per month Feature: Load balancer data plane (ALB). Estimated monthly service charges by Processed load-balancer GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD. ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/dec0766519b720a6abe6ea2c3fb7d081d35494feea66320cf1cc2c46b3bb8663-light.svg) ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/3bab83936f291db4974ea6b54251ef057b6abf285d67cc91c1154f3f8f7fac73-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Processed load-balancer GiB per month (GiB/month) | Application Load Balancer | Cloud Load Balancing | Difference | | -: | -: | -: | -: | | 0 | 16.43 | 18.25 | 1.83 | | 100 | 17.23 | 19.05 | 1.83 | | 1,000 | 24.43 | 26.25 | 1.83 | | 10,000 | 96.43 | 98.25 | 1.83 | | 100,000 | 816.43 | 818.25 | 1.83 | | 1,000,000 | 8,016.43 | 8,018.25 | 1.83 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.008 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.025 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. The base hour covers the first 5 forwarding rules (0.01/hour each after); Google bills processed GiB both inbound and outbound, so count both directions. Regional Application Load Balancers add 0.025/hour per proxy instance. * AWS Price List API, AWSELB offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json) * Cloud Load Balancing pricing: [https://cloud.google.com/load-balancing/pricing](https://cloud.google.com/load-balancing/pricing) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-22dda3d1cf87f24c8e4d619aea8e5b01902ddd3c` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [Cloud Load Balancing pricing](https://cloud.google.com/load-balancing/pricing). **Load balancer data plane (ALB) → Cloud Load Balancing: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Allocated load-balancer hours | 16.43 | | Origin: Load-balancer processed bytes | 8.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 8.00 | | Target: Independent native resources | 18.25 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **24.43** | | **Target service subtotal** | **26.25** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.008 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.025 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Allocated load-balancer hours | 730 | load-balancer-hour | | Load-balancer processed bytes | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 0 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. The base hour covers the first 5 forwarding rules (0.01/hour each after); Google bills processed GiB both inbound and outbound, so count both directions. Regional Application Load Balancers add 0.025/hour per proxy instance. List prices read: 2026-10-22. Model: `plan-22dda3d1cf87f24c8e4d619aea8e5b01902ddd3c` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [Cloud Load Balancing pricing](https://cloud.google.com/load-balancing/pricing). ## On OCI ### OCI Load Balancer | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Authentication (OIDC / OAuth) | Access control | Out of scope | Most usage | Listener authentication is outside this option. Handle login in the application or an identity-aware proxy. | | WAF attachment | Access control | Out of scope | Most usage | WAF attachment is outside this option. | | Health checks | Backends | Supported | Common | The backend-set check uses the path, expected status, timeout, interval, port, and consecutive-failure count. | | Session stickiness | Backends | Supported | Most usage | Cookie persistence on the backend set includes the configured duration. | | Target registration | Backends | Partial | Most usage | Translated instance attachments register native backends at their private addresses and effective ports. Health checks following traffic use each registered backend's port. Fleet attachments are not supported. Runtime registration requires a deployment serving that API. | | Access logs / idle timeout / deletion protection | Configuration | Out of scope | Full surface | These AWS settings are outside the mapping and are reported for review. | | Bandwidth | Configuration | Partial | Full surface | The flexible load balancer starts with a 10-100 Mbps bandwidth range, adjustable for the deployment. | | Network placement | Configuration | Partial | Full surface | The target network replaces the AWS multi-subnet layout. Verify public or private exposure and backend connectivity. | | Load balancer address | Consumers | Partial | Common | Clients use the OCI load-balancer address. The original AWS-managed hostname is not retained; infrastructure references to AWS-specific identifiers without an OCI equivalent are rejected or removed from outputs with a reported issue. | | Traffic forwarding | Data plane | Supported | Common | Oracle operates the native load balancer that receives client requests. | | HTTPS / TLS termination | Listeners | Partial | Common | HTTPS requires an OCI listener certificate and its TLS configuration. Supply or provision that certificate; an ACM reference alone does not provide it. The mapping does not reproduce the AWS SNI certificate list. | | Listeners & target groups | Listeners | Supported | Common | Each listener selects an OCI backend set representing its target group. An unresolved default target group is rejected. | | Routing rules (path / host / header / query) | Routing | Partial | Most usage | Path, host, header, and query conditions map to OCI routing policies. Method and source-IP conditions, weighted target groups, and fixed responses are outside this mapping. | #### How it works When a deployment provides the runtime AWS load-balancing API, your application and Terraform keep using that API. The Tensor9 adapter answers those calls (`CreateLoadBalancer`, `CreateListener`, `RegisterTargets` and the rest), keeps the AWS load balancer, listener and target group identities, saves each change and applies it to an OCI Flexible Load Balancer. A target group is the set of backends a listener forwards traffic to. That runtime design is separate from translating a stack to native load-balancer resources. A designed runtime model does not establish that the deployment can serve it, and a missing native mapping does not silently select a runtime fallback. Confirm the selected deployment supports the required path. Client traffic does not pass through the adapter. Clients connect to the cloud load balancer, which forwards requests to your backends. A management call can return success before the cloud change has finished; the adapter keeps the requested configuration and finishes applying it in the background. Wait until the load balancer is available and check the cloud resources before sending production traffic. ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIj48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojY2JkNWUxIj48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmYiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZWNmZGY1Ii8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2VjZmRmNSIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojMGYxNzJhIj48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) ![Your AWS load-balancing API calls go to the Tensor9 adapter, which saves them and applies them to the cloud resources. Client traffic goes straight to the cloud load balancer, which forwards it to your backends.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI3NjAiIGhlaWdodD0iMjM2IiB2aWV3Qm94PSIwIDAgNzYwIDIzNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIEFXUyBsb2FkLWJhbGFuY2luZyBBUEkgY2FsbHMgZ28gdG8gdGhlIFRlbnNvcjkgYWRhcHRlciwgd2hpY2ggc2F2ZXMgdGhlbSBhbmQgYXBwbGllcyB0aGVtIHRvIHRoZSBjbG91ZCByZXNvdXJjZXMuIENsaWVudCB0cmFmZmljIGdvZXMgc3RyYWlnaHQgdG8gdGhlIGNsb3VkIGxvYWQgYmFsYW5jZXIsIHdoaWNoIGZvcndhcmRzIGl0IHRvIHlvdXIgYmFja2VuZHMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImxiLXJ1bnRpbWUtYXJyb3ciIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIHJlZlg9IjYiIHJlZlk9IjMiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAgMCBMNiAzIEwwIDYiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxnIGZpbGw9Im5vbmUiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNsYi1ydW50aW1lLWFycm93KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ij48cGF0aCBkPSJNMjIyIDY2IEgyNzAiLz48cGF0aCBkPSJNNDkwIDY2IEg1MzgiLz48cGF0aCBkPSJNMjIyIDE3NiBIMjcwIi8+PHBhdGggZD0iTTQ5MCAxNzYgSDUzOCIvPjwvZz4KPGcgc3R5bGU9InN0cm9rZTojNDc1NTY5Ij48cmVjdCB4PSIxNiIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMzIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjE2IiB5PSIxNDIiIHdpZHRoPSIyMDYiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjUzOCIgeT0iMTQyIiB3aWR0aD0iMjA2IiBoZWlnaHQ9IjY4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2IiLz48L2c+CjxnIHN0eWxlPSJzdHJva2U6IzZlZTdiNyI+PHJlY3QgeD0iMjcwIiB5PSIzMiIgd2lkdGg9IjIyMCIgaGVpZ2h0PSI2OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMDY0ZTNiIi8+PHJlY3QgeD0iMjcwIiB5PSIxNDIiIHdpZHRoPSIyMjAiIGhlaWdodD0iNjgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzA2NGUzYiIvPjwvZz4KPGcgZm9udC1mYW1pbHk9IkludGVyLCBzYW5zLXNlcmlmIiBmb250LXNpemU9IjEzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZmlsbDojZjFmNWY5Ij48dGV4dCB4PSIxMTkiIHk9IjYwIj5BcHBsaWNhdGlvbiAvIFRlcnJhZm9ybTwvdGV4dD48dGV4dCB4PSIxMTkiIHk9IjgxIj5BV1MgbG9hZC1iYWxhbmNpbmcgQVBJPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iNjAiPlRlbnNvcjkgYWRhcHRlcjwvdGV4dD48dGV4dCB4PSIzODAiIHk9IjgxIj5TYXZlcyBhbmQgYXBwbGllcyBjaGFuZ2VzPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iNjAiPkNsb3VkIHJlc291cmNlczwvdGV4dD48dGV4dCB4PSI2NDEiIHk9IjgxIj5MaXN0ZW5lcnMgYW5kIGJhY2tlbmRzPC90ZXh0Pjx0ZXh0IHg9IjExOSIgeT0iMTgxIj5DbGllbnRzPC90ZXh0Pjx0ZXh0IHg9IjM4MCIgeT0iMTgxIj5DbG91ZCBsb2FkIGJhbGFuY2VyPC90ZXh0Pjx0ZXh0IHg9IjY0MSIgeT0iMTgxIj5BcHBsaWNhdGlvbiBiYWNrZW5kczwvdGV4dD48L2c+Cjwvc3ZnPg==) Management calls go through the adapter; client traffic goes straight to the cloud load balancer. #### Listeners, backend sets and routing Each ALB listener becomes an OCI listener, and each target group becomes a backend set. The listener's default action selects its backend set. Path, host, header and query conditions become a routing policy per listener, matched in rule-priority order. The load balancer's bandwidth starts at a range of 10-100 Mbps; adjust it for your traffic. The target network replaces the AWS multi-subnet layout, so confirm whether the load balancer is public or private and that its subnet and security rules let the intended clients and backends through. Backend sets keep the health-check path, response codes, interval, timeout, port and consecutive-failure count; the default path is `/`. Cookie persistence keeps the configured duration. #### HTTPS and certificates An ACM certificate ARN identifies an AWS certificate; it does not carry the certificate and private key that OCI needs. When your stack is translated, an HTTPS listener is therefore created as an HTTP listener. To serve HTTPS, provision or import the certificate in OCI (OCI Certificates or the load balancer's certificate settings) and attach it to the listener before you send HTTPS traffic. Backend TLS is a separate setting: enabling it does not secure a frontend that is still HTTP. Test the client TLS handshake and the backend connection before cutover. #### Targets in a translated stack Supported instance attachments become native OCI backends using each migrated instance's private address and effective registered port. The load balancer uses the compiled subnet where that network mapping is available; otherwise review the supplied native subnet and reachability. A health check set to follow traffic uses each registered backend's traffic port, while an explicit literal health port is kept. Auto Scaling replicas are not attached by this mapping. A supported target is a direct reference to the ID of an instance translated in this stack. IP and Lambda targets, conditional or computed target selection, unmapped instances and unsupported fleet attachments are reported and left unwired; those targets receive no traffic or health checks. A computed or invalid attachment or health-check port is refused rather than replaced with a default. Check every warning and send a complete application request before switching traffic. Scaleway load balancers and Akamai NodeBalancers do not receive translated instance targets through this mapping. Their missing attachments are reported; configure the native backends before expecting them to serve traffic. #### Targets and health checks For a deployment that serves the runtime API, `RegisterTargets` and `DeregisterTargets` add and remove backends from a target group. An instance ID is resolved from the EC2 instances the adapter knows about; an IP registration names the backend's address and port. The target group, the load balancer and the backend must be on networks that can reach each other. The adapter applies a listener only after its target group and network are ready. The cloud load balancer's own health checks decide which backends receive traffic. A registered target is not proof that its application is ready: check the cloud provider's health status and send a real application request first. `DescribeTargetHealth` answers from the adapter's saved records of registration and zone eligibility. A `healthy` result does not mean the cloud load balancer's probe succeeded, so check the backend health in the cloud provider's console or API as well. Drain connections before you deregister backends or delete a load balancer. Removing configuration does not move active connections to a replacement. #### Limitations * **HTTPS listeners behave differently: they start as HTTP.** An HTTP listener cannot accept a TLS connection. HTTPS works only after you attach an OCI certificate to the listener. * **SNI certificate lists are not supported.** Each listener uses one certificate. Additional certificates on an AWS listener are reported and not carried over. * **Method and source-IP conditions, weighted target groups and fixed responses are not supported.** OCI backend-set server weights do not reproduce a listener rule that splits traffic between target groups. * **Login at the load balancer is not supported.** Listener OIDC and OAuth authenticate actions are not mapped. Handle login in your application or an identity-aware proxy. * **HTTPS health checks behave differently: they probe over HTTP.** HTTP and HTTPS health checks become HTTP probes; other checks use TCP. * **Access logs, idle timeout, deletion protection and WAF attachment are not supported.** These AWS settings are reported for review. Set up logging and the other settings on the OCI side yourself. * **The AWS hostname is not kept.** Clients must resolve to the OCI address. An AWS hosted-zone ID is not an OCI identifier, and stack references to AWS-specific identifiers with no OCI equivalent are rejected or removed with a reported issue. #### Other considerations **Before going live.** Deploy the adapter with permission to manage load balancers and their network resources in the customer's cloud account. Your AWS credentials authorize the management calls; the adapter uses the target cloud's credentials to apply them. Set public or private exposure, client access rules, backend access and health-check access together. **Moving from AWS.** Prepare DNS records and firewall allowlists for the new address. In an infrastructure-only deployment, references inside the translated stack are updated during the build, but external DNS and clients still need to be switched. At the Max tier the adapter also keeps the AWS identities your management calls use. Check certificates, routing, health checks and a complete client request before changing DNS, and keep the old load balancer running while existing connections drain. Application sessions and active connections are not copied. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Load balancer data plane (ALB) · Processed load-balancer GiB per month Feature: Load balancer data plane (ALB). Estimated monthly service charges by Processed load-balancer GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD. ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/8f4c3adef0c898e146734b3cffa6e7a1ae82299ca01d5f8250021d2b8218dbd1-light.svg) ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/f87fd296e4c8e0ebb0f20efb2c904b67ce35862cc572980e08c3e436480f67fc-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Processed load-balancer GiB per month (GiB/month) | Application Load Balancer | OCI Load Balancer | Difference | | -: | -: | -: | -: | | 0 | 16.43 | 8.98 | -7.45 | | 100 | 17.23 | 8.98 | -8.25 | | 1,000 | 24.43 | 8.98 | -15.45 | | 10,000 | 96.43 | 8.98 | -87.45 | | 100,000 | 816.43 | 8.98 | -807.45 | | 1,000,000 | 8,016.43 | 8.98 | -8,007.45 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.0123 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. OCI bills no per-GB data on the load balancer; one Always Free load balancer (744 hours, 10 Mbps) is not applied. * AWS Price List API, AWSELB offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json) * OCI price list API: [https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/) * OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-0f66cd013083c87f34306b14f0781fe947bf1e76` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/), [OCI price list](https://www.oracle.com/cloud/price-list/). **Load balancer data plane (ALB) → OCI Load Balancer: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: us-ashburn-1. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Allocated load-balancer hours | 16.43 | | Origin: Load-balancer processed bytes | 8.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 0.00 | | Target: Independent native resources | 8.98 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **24.43** | | **Target service subtotal** | **8.98** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.0123 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Allocated load-balancer hours | 730 | load-balancer-hour | | Load-balancer processed bytes | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 0 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. OCI bills no per-GB data on the load balancer; one Always Free load balancer (744 hours, 10 Mbps) is not applied. List prices read: 2026-10-22. Model: `plan-0f66cd013083c87f34306b14f0781fe947bf1e76` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/), [OCI price list](https://www.oracle.com/cloud/price-list/). ## On Scaleway ### Scaleway Load Balancer | Operation | Area | Support | Depth | Notes | | - | - | - | - | - | | Instance targets | Backends | Out of scope | Common | Translated instance attachments are not registered on Scaleway; the build names each missing target. Configure native backends before expecting traffic or health checks. | | Sizing | Capacity | Partial | Common | This needs a decision from you. An ALB or NLB autoscales by capacity unit and carries no fixed size, and a Scaleway LB REQUIRES a type with no default. The build picks the SMALLEST and reports it; tune it to your expected bandwidth rather than assuming the default is sized for your traffic. | | A single origin check across several listeners | Health | Partial | Most usage | If your origin declares one health check and several listeners, that check is applied to every emitted backend and reported. Because the checks are now per-backend, you can tune them independently after cutover -- which you could not do on the origin. | | Per-target-group health checks | Health | Supported | Common | Each listener keeps its OWN health check, because the check lives on the backend. That matches what an AWS target group actually models -- on a cloud whose load balancer allows only one check for the whole thing, the checks after the first are lost. Here they are not. | | Exposure of an internal load balancer | Security | Partial | Common | An INTERNAL ALB (internal = true) becomes a PUBLIC Scaleway load balancer: it takes a flexible IP so that references to its DNS name have an address to resolve to, and nothing restricts who can reach its frontends. A private Scaleway load balancer is a different shape -- no flexible IP, attached to a Private Network the workload also sits on -- and this mapping does not build it. The build reports the widening; restrict exposure at the frontend or replace the load balancer with a private one before cutover. | | TLS termination | Security | Partial | Common | An HTTPS or TLS listener is carried as TCP PASSTHROUGH -- encrypted end to end, with the BACKEND terminating TLS. ACM certificates are not moved onto the load balancer (scaleway\_lb\_certificate is out of scope), so a listener that terminated TLS at the ALB now expects the target to hold the certificate. The build reports the collapse (one row per load balancer, not per listener). | | A load balancer built with count or for\_each | Topology | Out of scope | Most usage | Stops the build. A generated load balancer, target group or listener would silently collapse a fleet of N into one, and emitting one load balancer where you declared several is worse than refusing. | | Listeners | Topology | Supported | Common | Each listener becomes its own frontend and backend pair. Scaleway decomposes a load balancer into separate frontend and backend resources rather than inlining rules, so your listeners stay separate objects you can address individually. | | Placement | Topology | Supported | Common | A Scaleway load balancer is ZONAL rather than regional -- fr-par-1, not fr-par. The zone is derived from the region your Cloud Adapter deployment runs in; a bare region is never passed through, because it is rejected at apply rather than at build. | | Public address | Topology | Supported | Common | The load balancer takes a flexible IP, which is what the origin's DNS name references resolve to after translation. | | The load balancer | Topology | Supported | Common | Your ALB becomes a Scaleway Load Balancer. One Scaleway LB serves both layer 4 and layer 7, so an application and a network load balancer map onto the same product. | #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. **Native or deployment mapping.** This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. Cost estimates describe the selected service resources; operation coverage remains separate. ##### Load balancer data plane (ALB) · Processed load-balancer GiB per month Feature: Load balancer data plane (ALB). Estimated monthly service charges by Processed load-balancer GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: fr-par; currency: USD. ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/55d172d754ddd35fe657e7ad860018a48a81681bf51f109553a047cc3552916c-light.svg) ![Load balancer data plane (ALB) · Processed load-balancer GiB per month: monthly service charges by Processed load-balancer GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/6f6c8c53d221a2039bde6a64c1e28ed4bb4651ec5ada836de63931b1d1b65984-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Processed load-balancer GiB per month (GiB/month) | Application Load Balancer | Scaleway Load Balancer | Difference | | -: | -: | -: | -: | | 0 | 16.43 | 18.81 | 2.39 | | 100 | 17.23 | 18.81 | 1.59 | | 1,000 | 24.43 | 18.81 | -5.61 | | 10,000 | 96.43 | 18.81 | -77.61 | | 100,000 | 816.43 | 18.81 | -797.61 | | 1,000,000 | 8,016.43 | 18.81 | -7,997.61 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.0257715 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → fr-par, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Native/deployment comparison scope: This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. LB-S (200 Mbps) traffic is unlimited with no per-GB charge. * AWS Price List API, AWSELB offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json) * Scaleway Network pricing: [https://www.scaleway.com/en/pricing/network/](https://www.scaleway.com/en/pricing/network/) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-d5fbcb0c06ca8f73333e059ec67e44ce26158d16` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [Scaleway Network pricing](https://www.scaleway.com/en/pricing/network/). **Load balancer data plane (ALB) → Scaleway Load Balancer: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: fr-par. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Allocated load-balancer hours | 16.43 | | Origin: Load-balancer processed bytes | 8.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 0.00 | | Target: Independent native resources | 18.81 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **24.43** | | **Target service subtotal** | **18.81** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Connection/rule-driven capacity premiums, certificates, DNS, WAF, backend compute and separate internet egress. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Allocated load-balancer hours | 0.0225 | USD/load-balancer-hour | | Origin list price · Load-balancer processed bytes | 0.008 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.0257715 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Allocated load-balancer hours | 730 | load-balancer-hour | | Load-balancer processed bytes | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 0 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Native/deployment comparison scope: This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * This is an explicit data-plane workload comparison; the ELB management adapter alone cannot measure traffic. * The selected per-GiB rate is a traffic-dominated ALB/NLB capacity assumption and does not reproduce multi-dimensional AWS LCU/NLCU billing. * Load-balancer hours and processed GiB are billed as listed; connection, rule and capacity-unit dimensions beyond the base allocation need separate qualification. LB-S (200 Mbps) traffic is unlimited with no per-GB charge. List prices read: 2026-10-22. Model: `plan-d5fbcb0c06ca8f73333e059ec67e44ce26158d16` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [AWS Price List API, AWSELB offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSELB/current/us-east-1/index.json), [Scaleway Network pricing](https://www.scaleway.com/en/pricing/network/). ## Costs Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications. | Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping | | - | - | - | -: | -: | -: | - | | Azure Load Balancer | Processed load-balancer GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 96.43 | 68.25 | -28.18 | Service adapter | | Cloud Load Balancing | Processed load-balancer GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 96.43 | 98.25 | +1.83 | Service adapter | | DigitalOcean Load Balancer | Processed load-balancer GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 96.43 | 12.00 | -84.43 | Service adapter | | OCI Load Balancer | Processed load-balancer GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 96.43 | 8.98 | -87.45 | Service adapter | | Scaleway Load Balancer | Processed load-balancer GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 96.43 | 18.81 | -77.61 | Native or deployment | Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows. Cost curves across workload sizes, with every assumption and exclusion: [Application Load Balancer costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-lb). ## Service level agreements > [!WARNING] > > These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment. Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status. See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md). ### Application Load Balancer to Azure Load Balancer | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Network and load-balancer state reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::elbv2`: `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth` | One resource or at most 100 returned listeners, targets or rules. | | Listener, target and topology mutation adapter-added latency | +18 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateListener`, `CreateTargetGroup`, `ModifyListener`, `ModifyTargetGroup` | One load balancer/network; at most 20 listeners and at most 100 targets; readiness separate. | | Bounded routing and authorization policy adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateRule`, `DeleteRule`, `ModifyRule` | at most 100 routing rules, at most 20 conditions per rule and at most 20 target groups. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::elbv2`: `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth`, `CreateListener`, `CreateTargetGroup`, `ModifyListener`, `ModifyTargetGroup`, `CreateRule`, `DeleteRule`, `ModifyRule` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on azure::1.0.0::lb. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Network and load-balancer state reads: +8 ms monthly p99 (adapter-added).** `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth`. Bounded desired and observed status lookup. **Listener, target and topology mutation: +18 ms monthly p99 (adapter-added).** `CreateListener`, `CreateTargetGroup`, `ModifyListener`, `ModifyTargetGroup`. Validation and durable desired-state mutation. **Bounded routing and authorization policy: +25 ms monthly p99 (adapter-added).** `CreateRule`, `DeleteRule`, `ModifyRule`. Whole-policy validation and generation-ordered reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### Application Load Balancer to DigitalOcean Load Balancer | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Network and load-balancer state reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::elbv2`: `DescribeLoadBalancers`, `DescribeTargetHealth` | One resource or at most 100 returned listeners, targets or rules. | | Listener, target and topology mutation adapter-added latency | +18 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateListener`, `CreateLoadBalancer`, `DeregisterTargets`, `ModifyListener`, `ModifyTargetGroup`, `RegisterTargets` | One load balancer/network; at most 20 listeners and at most 100 targets; readiness separate. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::elbv2`: `DescribeLoadBalancers`, `DescribeTargetHealth`, `CreateListener`, `CreateLoadBalancer`, `DeregisterTargets`, `ModifyListener`, `ModifyTargetGroup`, `RegisterTargets` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on digitalocean::1.0.0::lb. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Network and load-balancer state reads: +8 ms monthly p99 (adapter-added).** `DescribeLoadBalancers`, `DescribeTargetHealth`. Bounded desired and observed status lookup. **Listener, target and topology mutation: +18 ms monthly p99 (adapter-added).** `CreateListener`, `CreateLoadBalancer`, `DeregisterTargets`, `ModifyListener`, `ModifyTargetGroup`, `RegisterTargets`. Validation and durable desired-state mutation. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### Application Load Balancer to Cloud Load Balancing | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Network and load-balancer state reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::elbv2`: `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth` | One resource or at most 100 returned listeners, targets or rules. | | Listener, target and topology mutation adapter-added latency | +18 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateListener`, `CreateTargetGroup`, `ModifyListener`, `ModifyTargetGroup` | One load balancer/network; at most 20 listeners and at most 100 targets; readiness separate. | | Bounded routing and authorization policy adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateRule`, `DeleteRule`, `ModifyRule` | at most 100 routing rules, at most 20 conditions per rule and at most 20 target groups. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::elbv2`: `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth`, `CreateListener`, `CreateTargetGroup`, `ModifyListener`, `ModifyTargetGroup`, `CreateRule`, `DeleteRule`, `ModifyRule` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on google::1.0.0::lb. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Network and load-balancer state reads: +8 ms monthly p99 (adapter-added).** `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth`. Bounded desired and observed status lookup. **Listener, target and topology mutation: +18 ms monthly p99 (adapter-added).** `CreateListener`, `CreateTargetGroup`, `ModifyListener`, `ModifyTargetGroup`. Validation and durable desired-state mutation. **Bounded routing and authorization policy: +25 ms monthly p99 (adapter-added).** `CreateRule`, `DeleteRule`, `ModifyRule`. Whole-policy validation and generation-ordered reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### Application Load Balancer to OCI Load Balancer | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Network and load-balancer state reads adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::elbv2`: `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth` | One resource or at most 100 returned listeners, targets or rules. | | Listener, target and topology mutation adapter-added latency | +18 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateListener`, `CreateLoadBalancer`, `CreateTargetGroup`, `DeregisterTargets`, `ModifyListener`, `ModifyTargetGroup`, `RegisterTargets` | One load balancer/network; at most 20 listeners and at most 100 targets; readiness separate. | | Bounded routing and authorization policy adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::elbv2`: `CreateRule`, `DeleteRule`, `ModifyRule` | at most 100 routing rules, at most 20 conditions per rule and at most 20 target groups. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::elbv2`: `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth`, `CreateListener`, `CreateLoadBalancer`, `CreateTargetGroup`, `DeregisterTargets`, `ModifyListener`, `ModifyTargetGroup`, `RegisterTargets`, `CreateRule`, `DeleteRule`, `ModifyRule` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on oci::1.0.0::lb. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Network and load-balancer state reads: +8 ms monthly p99 (adapter-added).** `DescribeListeners`, `DescribeLoadBalancers`, `DescribeTargetGroups`, `DescribeTargetHealth`. Bounded desired and observed status lookup. **Listener, target and topology mutation: +18 ms monthly p99 (adapter-added).** `CreateListener`, `CreateLoadBalancer`, `CreateTargetGroup`, `DeregisterTargets`, `ModifyListener`, `ModifyTargetGroup`, `RegisterTargets`. Validation and durable desired-state mutation. **Bounded routing and authorization policy: +25 ms monthly p99 (adapter-added).** `CreateRule`, `DeleteRule`, `ModifyRule`. Whole-policy validation and generation-ordered reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### Application Load Balancer to Scaleway Load Balancer **SLA status:** Not applicable This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. ## Install and run The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin: ```sh theme={null} tensor9 adapt svc list \ -origin aws::1.0.0::lb ``` The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request. Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction. ## Existing data and credentials Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target. ## Configure, tune and debug Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction. For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.