> ## Documentation Index > Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt > Use this file to discover all available pages before exploring further. # VPC > VPC APIs with Cloud Adapter. This page describes how VPC maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior. ## Supported environments * Azure * Google Cloud * OCI * Private Kubernetes * Scaleway Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available. ## How the backends compare Each row compares a capability of VPC with its adaptation on each backend. A dash means this profile does not state the capability for that backend. ### Cloud Adapter | Capability | VPC | Azure | Google Cloud | OCI | Private Kubernetes | Scaleway | | - | - | - | - | - | - | - | | Network management | AWS EC2 VPC APIs | AWS-compatible adapter + Azure Virtual Network | AWS-compatible adapter + Google Cloud VPC | AWS-compatible adapter + OCI Virtual Cloud Network | customer's existing cluster network | - | | Traffic rules | security groups and subnet ACLs | target rules and membership | target rules and membership | target rules and membership | configured separately on the cluster | - | | Routing and connectivity | route tables, gateways, and peering | target routes and gateways | target routes and gateways | target routes and gateways | existing cluster and customer network configuration | - | | Public addresses | AWS Elastic IP | new target-cloud public IP | new target-cloud public IP | new target-cloud public IP | - | - | | Network interfaces | AWS ENI identity and configuration | interface created with the VM | interface created with the VM | interface created with the VM | - | - | | API coverage | full | partial | partial | partial | minimal | partial | ## On Azure ### Virtual Network | Capability | Area | Support | Operations | Notes | | - | - | - | - | - | | DHCP options | Addressing | Out of scope | - | custom AWS DHCP option sets are outside this mapping; configure target DNS servers, search domains, and other required settings separately | | IPv6 / secondary CIDR | Addressing | Partial | AssociateSubnetCidrBlock, AssociateVpcCidrBlock, DisassociateSubnetCidrBlock, DisassociateVpcCidrBlock | IPv4 VNet and subnet ranges are preserved. The runtime API can manage additional IPv4 VPC ranges; AWS IPAM allocation and Amazon-provided IPv6 blocks are outside this mapping | | VPC endpoints (PrivateLink) | Connectivity | Out of scope | - | private service endpoints require a service-specific target configuration; this VPC mapping does not create an equivalent private endpoint automatically | | VPC peering | Connectivity | Supported | AcceptVpcPeeringConnection, CreateVpcPeeringConnection, DeleteVpcPeeringConnection, DescribeVpcPeeringConnections, ModifyVpcPeeringConnectionOptions, RejectVpcPeeringConnection | Create/Accept/Describe/Delete manage two directional VNet peerings. Cross-account and cross-region requests are outside the adapter binding; AWS peering DNS options are not translated | | Subnets | Network | Supported | CreateDefaultSubnet, CreateSubnet, DeleteSubnet, DescribeSubnets, ModifySubnetAttribute | subnet APIs preserve IPv4 ranges and AWS-facing identifiers; the adapter creates the corresponding target subnets and tracks their state | | Virtual network (VPC) | Network | Supported | CreateDefaultVpc, CreateVpc, DeleteVpc, DescribeVpcAttribute, DescribeVpcs, ModifyVpcAttribute, ModifyVpcTenancy | VPC APIs manage an Azure VNet and its address spaces; the adapter preserves AWS-facing identities while tracking Azure resource IDs | | Flow logs | Observability | Adapter-served | CreateFlowLogs, DeleteFlowLogs, DescribeFlowLogs, GetFlowLogsIntegrationTemplate | flow telemetry uses Azure logging fields and destinations; AWS-format records and AWS destinations are not preserved | | Availability-zone placement | Placement | Partial | DescribeAvailabilityZones, ModifyAvailabilityZoneGroup | target subnets are regional; choose availability zones or domains on workloads that need separation, rather than relying on an AWS subnet zone | | Internet gateway | Routing | Supported | AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, DescribeInternetGateways, DetachInternetGateway | AWS gateway and attachment records map to Azure internet connectivity. Public access needs an explicit outbound method or public frontend plus suitable security rules; a default route alone is insufficient | | NAT gateway | Routing | Supported | CreateNatGateway, DeleteNatGateway, DescribeNatGateways | public NAT requests configure Azure NAT Gateway with a public IP and the required subnet associations. Private NAT and multiple-address NAT requests are outside this mapping | | Route tables | Routing | Partial | AssociateRouteTable, CreateRoute, CreateRouteTable, DeleteRoute, DeleteRouteTable, DescribeRouteTables, DisableVgwRoutePropagation, DisassociateRouteTable, EnableVgwRoutePropagation, ReplaceRoute | route APIs manage Azure route tables and subnet associations for supported next hops. Peering uses Azure-installed routes; transit-gateway, interface, instance, and other unsupported next hops are rejected | | Network ACLs | Security | Adapter-served | CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, DescribeNetworkAcls, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry | ordered subnet ACL rules are composed with NSG rules. Azure connection tracking differs from AWS stateless filtering; reduced behavior requires acknowledgement, and unrepresentable selector or ordering combinations are rejected | | Security groups | Security | Supported | AssociateSecurityGroupVpc, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateSecurityGroup, DeleteSecurityGroup, DescribeSecurityGroupRules, DescribeSecurityGroups, DisassociateSecurityGroupVpc, GetSecurityGroupsForVpc, ModifySecurityGroupRules, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress | rules become Azure NSG rules with direction, ports, protocols, and address ranges. Same-VPC group references use Application Security Groups and interface membership; unsupported selector combinations are rejected | | VPC-wide encryption enforcement | Security | Out of scope | GetVpcResourcesBlockingEncryptionEnforcement | the AWS enforcement setting is not applied to the target network; requests are rejected unless that difference is explicitly acknowledged. Use target cloud controls to meet an encryption requirement | #### How it works Your application and Terraform's AWS provider keep using the AWS EC2 APIs to create VPCs, subnets, security groups and the other supported VPC resources in the customer's environment. The Tensor9 service adapter accepts those requests and manages the matching Azure resources. The adapter checks each request and its permissions, gives the resource an AWS-format ID and saves the requested configuration. The ID is for API callers; it is not the Azure resource's name. A background worker then applies the configuration to Azure and tracks the result. For example, `CreateVpc` records the VPC with its default security group, main route table and default network ACL, and `DescribeVpcs` reports `pending` until the network exists in Azure, then `available`. A successful create call does not mean the network is ready. Application traffic runs on the customer's cloud network. The adapter handles network-management calls only; it does not carry your application's packets. ![The AWS SDK or Terraform sends network-management requests to the Tensor9 adapter, which saves the requested configuration and applies it through the target cloud API. Application traffic runs on the customer's cloud network, not through the adapter.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM4IiB2aWV3Qm94PSIwIDAgODM2IDIzOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgQVdTIFNESyBvciBUZXJyYWZvcm0gc2VuZHMgbmV0d29yay1tYW5hZ2VtZW50IHJlcXVlc3RzIHRvIHRoZSBUZW5zb3I5IGFkYXB0ZXIsIHdoaWNoIHNhdmVzIHRoZSByZXF1ZXN0ZWQgY29uZmlndXJhdGlvbiBhbmQgYXBwbGllcyBpdCB0aHJvdWdoIHRoZSB0YXJnZXQgY2xvdWQgQVBJLiBBcHBsaWNhdGlvbiB0cmFmZmljIHJ1bnMgb24gdGhlIGN1c3RvbWVyJ3MgY2xvdWQgbmV0d29yaywgbm90IHRocm91Z2ggdGhlIGFkYXB0ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InZwYy1ydW50aW1lLWFycm93IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5ORVRXT1JLIE1BTkFHRU1FTlQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE4MCIgaGVpZ2h0PSI3OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExNCIgeT0iNzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5BV1MgU0RLIC8gVGVycmFmb3JtPC90ZXh0Pgo8dGV4dCB4PSIxMTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RUMyIEFQSSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjIwNSIgeTE9IjgwIiB4Mj0iMjcxIiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyNzYiIHk9IjQyIiB3aWR0aD0iMjY0IiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDA4IiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPlRlbnNvcjkgc2VydmljZSBhZGFwdGVyPC90ZXh0Pgo8dGV4dCB4PSI0MDgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+U2F2ZXMsIGFwcGxpZXMsIHRyYWNrczwvdGV4dD4KPGxpbmUgeDE9IjU0MSIgeTE9IjgwIiB4Mj0iNjA3IiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2MTIiIHk9IjQyIiB3aWR0aD0iMjAwIiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzEyIiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkN1c3RvbWVyJ3MgY2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5uYXRpdmUgbmV0d29yayBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5BUFBMSUNBVElPTiBUUkFGRklDPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTc0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ0IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDE4IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Xb3JrbG9hZCDihpIgY3VzdG9tZXIncyBjbG91ZCBuZXR3b3JrIOKGkiBkZXN0aW5hdGlvbjwvdGV4dD4KPC9zdmc+) ![The AWS SDK or Terraform sends network-management requests to the Tensor9 adapter, which saves the requested configuration and applies it through the target cloud API. Application traffic runs on the customer's cloud network, not through the adapter.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM4IiB2aWV3Qm94PSIwIDAgODM2IDIzOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgQVdTIFNESyBvciBUZXJyYWZvcm0gc2VuZHMgbmV0d29yay1tYW5hZ2VtZW50IHJlcXVlc3RzIHRvIHRoZSBUZW5zb3I5IGFkYXB0ZXIsIHdoaWNoIHNhdmVzIHRoZSByZXF1ZXN0ZWQgY29uZmlndXJhdGlvbiBhbmQgYXBwbGllcyBpdCB0aHJvdWdoIHRoZSB0YXJnZXQgY2xvdWQgQVBJLiBBcHBsaWNhdGlvbiB0cmFmZmljIHJ1bnMgb24gdGhlIGN1c3RvbWVyJ3MgY2xvdWQgbmV0d29yaywgbm90IHRocm91Z2ggdGhlIGFkYXB0ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InZwYy1ydW50aW1lLWFycm93IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5ORVRXT1JLIE1BTkFHRU1FTlQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE4MCIgaGVpZ2h0PSI3OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExNCIgeT0iNzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5BV1MgU0RLIC8gVGVycmFmb3JtPC90ZXh0Pgo8dGV4dCB4PSIxMTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RUMyIEFQSSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjIwNSIgeTE9IjgwIiB4Mj0iMjcxIiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyNzYiIHk9IjQyIiB3aWR0aD0iMjY0IiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDA4IiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPlRlbnNvcjkgc2VydmljZSBhZGFwdGVyPC90ZXh0Pgo8dGV4dCB4PSI0MDgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+U2F2ZXMsIGFwcGxpZXMsIHRyYWNrczwvdGV4dD4KPGxpbmUgeDE9IjU0MSIgeTE9IjgwIiB4Mj0iNjA3IiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2MTIiIHk9IjQyIiB3aWR0aD0iMjAwIiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzEyIiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkN1c3RvbWVyJ3MgY2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5uYXRpdmUgbmV0d29yayBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5BUFBMSUNBVElPTiBUUkFGRklDPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTc0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ0IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDE4IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Xb3JrbG9hZCDihpIgY3VzdG9tZXIncyBjbG91ZCBuZXR3b3JrIOKGkiBkZXN0aW5hdGlvbjwvdGV4dD4KPC9zdmc+) #### Network layout The VPC becomes an Azure Virtual Network (VNet), and each subnet keeps its requested IPv4 range. The adapter keeps the AWS subnet IDs, so your application can use them in later requests. The VNet's address spaces hold the network's CIDR ranges, and subnet ranges must fit inside them. Azure subnets are regional. Set availability zones on the workloads that need them instead of relying on an AWS subnet's zone, and review the VNet and workload placement together. Subnet `count` and `for_each` declarations keep their instance keys and address expressions. ![Azure Virtual Network contains regional subnets. Workloads attach to those subnets, with access controlled by NSGs and application groups.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBenVyZSBWaXJ0dWFsIE5ldHdvcmsgY29udGFpbnMgcmVnaW9uYWwgc3VibmV0cy4gV29ya2xvYWRzIGF0dGFjaCB0byB0aG9zZSBzdWJuZXRzLCB3aXRoIGFjY2VzcyBjb250cm9sbGVkIGJ5IE5TR3MgYW5kIGFwcGxpY2F0aW9uIGdyb3Vwcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHJlY3QgeD0iMjQiIHk9IjI0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjEzMiIgcng9IjEyIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ0IiB5PSI1MCIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkF6dXJlIFZpcnR1YWwgTmV0d29yazwvdGV4dD4KPHJlY3QgeD0iNDQiIHk9IjcwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjYyIiByeD0iOCIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIyMDkiIHk9Ijk2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+UmVnaW9uYWwgc3VibmV0czwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj53b3JrbG9hZCBpbnRlcmZhY2VzICsgSVB2NCByYW5nZXM8L3RleHQ+CjxyZWN0IHg9IjQxNCIgeT0iNzAiIHdpZHRoPSIzNzgiIGhlaWdodD0iNjIiIHJ4PSI4IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjYwMyIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5OU0dzIGFuZCBhcHBsaWNhdGlvbiBncm91cHM8L3RleHQ+Cjx0ZXh0IHg9IjYwMyIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dHJhZmZpYyBydWxlcyBhbmQgd29ya2xvYWQgbWVtYmVyc2hpcDwvdGV4dD4KPC9zdmc+) ![Azure Virtual Network contains regional subnets. Workloads attach to those subnets, with access controlled by NSGs and application groups.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBenVyZSBWaXJ0dWFsIE5ldHdvcmsgY29udGFpbnMgcmVnaW9uYWwgc3VibmV0cy4gV29ya2xvYWRzIGF0dGFjaCB0byB0aG9zZSBzdWJuZXRzLCB3aXRoIGFjY2VzcyBjb250cm9sbGVkIGJ5IE5TR3MgYW5kIGFwcGxpY2F0aW9uIGdyb3Vwcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHJlY3QgeD0iMjQiIHk9IjI0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjEzMiIgcng9IjEyIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ0IiB5PSI1MCIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkF6dXJlIFZpcnR1YWwgTmV0d29yazwvdGV4dD4KPHJlY3QgeD0iNDQiIHk9IjcwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjYyIiByeD0iOCIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIyMDkiIHk9Ijk2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+UmVnaW9uYWwgc3VibmV0czwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij53b3JrbG9hZCBpbnRlcmZhY2VzICsgSVB2NCByYW5nZXM8L3RleHQ+CjxyZWN0IHg9IjQxNCIgeT0iNzAiIHdpZHRoPSIzNzgiIGhlaWdodD0iNjIiIHJ4PSI4IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjYwMyIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5OU0dzIGFuZCBhcHBsaWNhdGlvbiBncm91cHM8L3RleHQ+Cjx0ZXh0IHg9IjYwMyIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dHJhZmZpYyBydWxlcyBhbmQgd29ya2xvYWQgbWVtYmVyc2hpcDwvdGV4dD4KPC9zdmc+) #### Security groups and subnet filters Azure network security groups (NSGs) enforce your allow and deny rules, keeping protocols, ports, direction and address ranges, in Azure's priority order. A rule that names another security group in the same VPC uses an **Application Security Group**, which selects the member interfaces. The adapter updates that membership when an instance's security groups change. Review rules that combine group membership with subnet network ACLs (ordered, stateless traffic filters): Azure limits which selectors one rule can combine. For network ACLs, the adapter combines ordered subnet filters with the security-group rules. A rule order or selector Azure cannot express is rejected. #### Routes and connectivity Supported route-table operations set Azure routes and subnet associations. Internet access needs an explicit outbound method or a suitable public frontend; do not rely on Azure's default outbound access. Private-subnet egress uses an Azure NAT Gateway with a public IP, attached to the subnets that need it. VPC peering in the same account and region becomes two one-way VNet peerings. The AWS API keeps the peering's lifecycle and the routes that refer to it, while Azure adds routes to the peered address spaces. #### Limitations Where AWS VPC and this target differ * **Network ACLs behave differently: Azure filters are stateful.** Azure NSGs track connections, so AWS's stateless handling of return traffic is not guaranteed. A reduced, stateful mapping needs your explicit acknowledgement. * **Group rules behave differently on AKS-managed nodes.** AKS-managed node interfaces cannot join Application Security Groups. Where a subnet mixes managed nodes with other interfaces, a subnet-wide rule needs your explicit acknowledgement, because it changes which traffic the rule selects. * **Private NAT gateways are not supported.** NAT gateway requests with more than one address are not supported either. * **Cross-account and cross-region VPC peering are not supported.** Azure supports broader peering, but the adapter does not map it. AWS peering DNS options need a separate private-DNS design. * **Routes to unsupported next hops are rejected.** Routes to transit gateways, instances, network interfaces and other unsupported next hops are rejected. * **VPC endpoints do not create Azure private connectivity.** Azure Private Endpoint, Private Link, VPN and custom DNS services each need their own configuration; a VPC endpoint declaration does not create them. * **IPAM, Amazon-provided IPv6 and custom DHCP options are not supported.** Use explicit IPv4 subnet ranges. Azure's multiple VNet address ranges do not reproduce AWS address allocation. * **You must express VPC-wide encryption through Azure controls.** A VPC-wide encryption requirement is not kept as such; use the supported Azure controls. * **Flow logs behave differently: they use Azure's format.** Flow records use Azure's logging, fields and destinations. Update collectors and queries that expect AWS flow-log records or destinations, and check coverage for the subnets and interfaces your application uses. * **Existing Elastic IP addresses are not kept.** `AllocateAddress` gets a new public IP in the target cloud and returns once it is allocated. An existing AWS Elastic IP does not move. * **Attaching and detaching network interfaces is not supported.** A standalone `CreateNetworkInterface` records the subnet, private address and security groups; the interface is created when a VM launch names it. Launches with more than one interface are not supported. #### Other considerations **Credentials.** Your application signs its EC2 requests with credentials that the Cloud Adapter deployment's IAM and STS service accepts. The adapter checks the action and resource before changing anything. It holds the target-cloud credentials, so your application needs no second set of cloud API calls. **What to watch.** Keep using the normal status checks after a create or update. The adapter keeps the requested configuration and the observed cloud state separately, retries changes that can be retried, and reports an error when a setting cannot be applied. A `Describe` response shows the saved AWS IDs and configuration, with current cloud-assigned values where needed. Deletes check dependencies: for example, a subnet stays in use while its NAT gateway is still being removed. **Before moving traffic.** Check subnet ranges and placement, test allowed and denied connections, and confirm that private-subnet egress uses the intended NAT gateway. Review peering, private service access, DNS and log destinations separately. **Moving from AWS.** Public IP addresses change, so update DNS records and external allowlists. Existing connections do not survive the move to the new network. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Virtual network and NAT allocation (VPC) · Selected network GiB per month Feature: Virtual network and NAT allocation (VPC). Estimated monthly service charges by Selected network GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: Global; currency: USD. ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/e88e58572e5e6ef56ca1357174c388c576b092642d68ab98e507993ce7c1939c-light.svg) ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/a52a0caf0e1a5353a231ae263d764cd2e9fc01480c43d809b87232f356fef48e-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Selected network GiB per month (GiB/month) | VPC | Virtual Network | Difference | | -: | -: | -: | -: | | 0 | 32.85 | 32.85 | 0.00 | | 100 | 37.35 | 37.35 | 0.00 | | 1,000 | 77.85 | 77.85 | 0.00 | | 10,000 | 482.85 | 482.85 | 0.00 | | 100,000 | 4,532.85 | 4,532.85 | 0.00 | | 1,000,000 | 45,032.85 | 45,032.85 | 0.00 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.045 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.045 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → Global, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. * Amazon VPC pricing: [https://aws.amazon.com/vpc/pricing/](https://aws.amazon.com/vpc/pricing/) * AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv) * Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-34eea51598bf0f8620a54e3566f90ac9abbc71fb` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices). **Virtual network and NAT allocation (VPC) → Virtual Network: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: Global. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Network management requests | 0.00 | | Origin: Allocated NAT gateway hours | 32.85 | | Origin: Selected billable network transfer | 45.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 45.00 | | Target: Independent native resources | 32.85 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **77.85** | | **Target service subtotal** | **77.85** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.045 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.045 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Network management requests | 1,000,000 | Requests | | Allocated NAT gateway hours | 730 | gateway-hour | | Selected billable network transfer | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 1,000,000 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. List prices read: 2026-10-22. Model: `plan-34eea51598bf0f8620a54e3566f90ac9abbc71fb` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices). ## On Google Cloud ### Virtual Private Cloud (VPC) | Capability | Area | Support | Operations | Notes | | - | - | - | - | - | | DHCP options | Addressing | Out of scope | - | custom AWS DHCP option sets are outside this mapping; configure target DNS servers, search domains, and other required settings separately | | Elastic IP | Addressing | Partial | AllocateAddress, AssociateAddress, DescribeAddresses, DescribeAddressesAttribute, DisassociateAddress, ReleaseAddress | AllocateAddress reserves a regional static external IP address on Google Cloud's Standard network tier and returns its assigned value. AssociateAddress makes that address the VM interface's external IP, in place of any ephemeral one; associating it with another VM moves it once the first VM has released it. DisassociateAddress removes it, and a VM launched with a public IP receives a new ephemeral address, as on AWS. AWS-format allocation and association IDs remain available to callers; the public IP itself changes when moving clouds. Customer-owned address pools are outside this mapping | | IP Address Manager (IPAM) | Addressing | Out of scope | GetIpamAddressHistory | AWS IPAM pool allocation and automatic CIDR allocation are outside this mapping; use explicit address ranges | | IPv6 / secondary CIDR | Addressing | Partial | AssociateSubnetCidrBlock, AssociateVpcCidrBlock, DisassociateSubnetCidrBlock, DisassociateVpcCidrBlock | IPv4 address ranges are preserved in the AWS model and target subnetworks. AWS IPAM and Amazon-provided IPv6 aggregates are outside this mapping; Google assigns public IPv6 ranges at a different level | | Client VPN | Connectivity | Out of scope | ApplySecurityGroupsToClientVpnTargetNetwork | AWS Client VPN endpoints and their authorization rules are outside this VPC mapping | | EC2-Classic / ClassicLink | Connectivity | Out of scope | AttachClassicLinkVpc, DescribeMovingAddresses, DetachClassicLinkVpc, MoveAddressToVpc, RestoreAddressToClassic | the retired EC2-Classic and ClassicLink operations are outside this VPC mapping | | Site-to-Site VPN | Connectivity | Out of scope | CreateVpnConnectionRoute, DeleteVpnConnectionRoute | VPN tunnels and their gateway configuration are outside this VPC mapping; configure the customer connection on the target cloud separately | | VPC endpoints (PrivateLink) | Connectivity | Out of scope | - | private service endpoints require a service-specific target configuration; this VPC mapping does not create an equivalent private endpoint automatically | | VPC peering | Connectivity | Partial | AcceptVpcPeeringConnection, CreateVpcPeeringConnection, DeleteVpcPeeringConnection, DescribeVpcPeeringConnections, ModifyVpcPeeringConnectionOptions, RejectVpcPeeringConnection | Create/Accept/Describe/Delete manage both directions of Google VPC Network Peering. The adapter is bound to one account and region; cross-account, cross-region, and AWS peering DNS options are outside this mapping | | Network interface (ENI) | Network | Partial | AssignIpv6Addresses, AssignPrivateIpAddresses, AttachNetworkInterface, CreateNetworkInterface, DeleteNetworkInterface, DescribeNetworkInterfaceAttribute, DescribeNetworkInterfaces, DetachNetworkInterface, ModifyNetworkInterfaceAttribute, ResetNetworkInterfaceAttribute, UnassignIpv6Addresses, UnassignPrivateIpAddresses | CreateNetworkInterface records the subnet, private address, and groups. A VM launch naming that interface creates the attached target interface. Standalone attach/detach and multiple-interface launches are outside this mapping | | Subnets | Network | Supported | CreateDefaultSubnet, CreateSubnet, DeleteSubnet, DescribeSubnets, ModifySubnetAttribute | subnet APIs preserve IPv4 ranges and AWS-facing identifiers; the adapter creates the corresponding target subnets and tracks their state | | Virtual network (VPC) | Network | Supported | CreateDefaultVpc, CreateVpc, DeleteVpc, DescribeVpcAttribute, DescribeVpcs, ModifyVpcAttribute, ModifyVpcTenancy | VPC APIs manage a custom-mode Google Cloud network; the AWS VPC CIDR stays in the API model, while native address ranges belong to subnetworks | | Flow logs | Observability | Adapter-served | CreateFlowLogs, DeleteFlowLogs, DescribeFlowLogs, GetFlowLogsIntegrationTemplate | native subnet flow logging uses Google fields and destinations. The 60s and 600s aggregation windows are preserved. AWS destinations require acknowledgement of the destination difference; single-interface capture, AWS filter expressions, and ACCEPT-only or REJECT-only capture are not represented | | Resource tagging | Operations | Partial | CreateTags, DeleteTags, DescribeTags | creation tags and CreateTags/DeleteTags/DescribeTags operate on the AWS-facing resource record; review tag readback and filtering behavior for the operations your application uses | | Availability-zone placement | Placement | Partial | DescribeAvailabilityZones, ModifyAvailabilityZoneGroup | target subnets are regional; choose availability zones or domains on workloads that need separation, rather than relying on an AWS subnet zone | | Internet gateway | Routing | Supported | AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, DescribeInternetGateways, DetachInternetGateway | the adapter manages the AWS gateway and attachment lifecycle using Google internet routing; public reachability also requires the appropriate addresses and firewall rules | | NAT gateway | Routing | Supported | CreateNatGateway, DeleteNatGateway, DescribeNatGateways | public NAT requests configure Cloud Router and Cloud NAT for the selected subnetworks. Private NAT and multiple-address NAT requests are outside this mapping | | Route tables | Routing | Partial | AssociateRouteTable, CreateRoute, CreateRouteTable, DeleteRoute, DeleteRouteTable, DescribeRouteTables, DisableVgwRoutePropagation, DisassociateRouteTable, EnableVgwRoutePropagation, ReplaceRoute | route APIs preserve subnet associations and internet-gateway, NAT, and peering next hops. Google supplies peered-network routes; unsupported next hops, including transit gateways and network interfaces, are rejected | | Network ACLs | Security | Adapter-served | CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, DescribeNetworkAcls, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry | ACL operations maintain ordered subnet rules. Google connection tracking differs from AWS stateless filtering; applying the reduced behavior requires an explicit acknowledgement | | Security groups | Security | Supported | AssociateSecurityGroupVpc, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateSecurityGroup, DeleteSecurityGroup, DescribeSecurityGroupRules, DescribeSecurityGroups, DisassociateSecurityGroupVpc, GetSecurityGroupsForVpc, ModifySecurityGroupRules, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress | CIDR rules become Google firewall rules. Same-VPC group references use instance network tags, with membership updated as groups change. Cross-VPC group references cannot use those tags and are rejected during backend configuration | | VPC-wide encryption enforcement | Security | Out of scope | GetVpcResourcesBlockingEncryptionEnforcement | the AWS enforcement setting is not applied to the target network; requests are rejected unless that difference is explicitly acknowledged. Use target cloud controls to meet an encryption requirement | #### How it works Your application and Terraform's AWS provider keep using the AWS EC2 APIs to create VPCs, subnets, security groups and the other supported VPC resources in the customer's environment. The Tensor9 service adapter accepts those requests and manages the matching Google Cloud resources. The adapter checks each request and its permissions, gives the resource an AWS-format ID and saves the requested configuration. The ID is for API callers; it is not the Google Cloud resource's name. A background worker then applies the configuration to Google Cloud and tracks the result. For example, `CreateVpc` records the VPC with its default security group, main route table and default network ACL, and `DescribeVpcs` reports `pending` until the network exists in Google Cloud, then `available`. A successful create call does not mean the network is ready. Application traffic runs on the customer's cloud network. The adapter handles network-management calls only; it does not carry your application's packets. ![The AWS SDK or Terraform sends network-management requests to the Tensor9 adapter, which saves the requested configuration and applies it through the target cloud API. Application traffic runs on the customer's cloud network, not through the adapter.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM4IiB2aWV3Qm94PSIwIDAgODM2IDIzOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgQVdTIFNESyBvciBUZXJyYWZvcm0gc2VuZHMgbmV0d29yay1tYW5hZ2VtZW50IHJlcXVlc3RzIHRvIHRoZSBUZW5zb3I5IGFkYXB0ZXIsIHdoaWNoIHNhdmVzIHRoZSByZXF1ZXN0ZWQgY29uZmlndXJhdGlvbiBhbmQgYXBwbGllcyBpdCB0aHJvdWdoIHRoZSB0YXJnZXQgY2xvdWQgQVBJLiBBcHBsaWNhdGlvbiB0cmFmZmljIHJ1bnMgb24gdGhlIGN1c3RvbWVyJ3MgY2xvdWQgbmV0d29yaywgbm90IHRocm91Z2ggdGhlIGFkYXB0ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InZwYy1ydW50aW1lLWFycm93IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5ORVRXT1JLIE1BTkFHRU1FTlQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE4MCIgaGVpZ2h0PSI3OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExNCIgeT0iNzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5BV1MgU0RLIC8gVGVycmFmb3JtPC90ZXh0Pgo8dGV4dCB4PSIxMTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RUMyIEFQSSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjIwNSIgeTE9IjgwIiB4Mj0iMjcxIiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyNzYiIHk9IjQyIiB3aWR0aD0iMjY0IiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDA4IiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPlRlbnNvcjkgc2VydmljZSBhZGFwdGVyPC90ZXh0Pgo8dGV4dCB4PSI0MDgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+U2F2ZXMsIGFwcGxpZXMsIHRyYWNrczwvdGV4dD4KPGxpbmUgeDE9IjU0MSIgeTE9IjgwIiB4Mj0iNjA3IiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2MTIiIHk9IjQyIiB3aWR0aD0iMjAwIiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzEyIiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkN1c3RvbWVyJ3MgY2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5uYXRpdmUgbmV0d29yayBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5BUFBMSUNBVElPTiBUUkFGRklDPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTc0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ0IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDE4IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Xb3JrbG9hZCDihpIgY3VzdG9tZXIncyBjbG91ZCBuZXR3b3JrIOKGkiBkZXN0aW5hdGlvbjwvdGV4dD4KPC9zdmc+) ![The AWS SDK or Terraform sends network-management requests to the Tensor9 adapter, which saves the requested configuration and applies it through the target cloud API. Application traffic runs on the customer's cloud network, not through the adapter.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM4IiB2aWV3Qm94PSIwIDAgODM2IDIzOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgQVdTIFNESyBvciBUZXJyYWZvcm0gc2VuZHMgbmV0d29yay1tYW5hZ2VtZW50IHJlcXVlc3RzIHRvIHRoZSBUZW5zb3I5IGFkYXB0ZXIsIHdoaWNoIHNhdmVzIHRoZSByZXF1ZXN0ZWQgY29uZmlndXJhdGlvbiBhbmQgYXBwbGllcyBpdCB0aHJvdWdoIHRoZSB0YXJnZXQgY2xvdWQgQVBJLiBBcHBsaWNhdGlvbiB0cmFmZmljIHJ1bnMgb24gdGhlIGN1c3RvbWVyJ3MgY2xvdWQgbmV0d29yaywgbm90IHRocm91Z2ggdGhlIGFkYXB0ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InZwYy1ydW50aW1lLWFycm93IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5ORVRXT1JLIE1BTkFHRU1FTlQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE4MCIgaGVpZ2h0PSI3OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExNCIgeT0iNzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5BV1MgU0RLIC8gVGVycmFmb3JtPC90ZXh0Pgo8dGV4dCB4PSIxMTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RUMyIEFQSSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjIwNSIgeTE9IjgwIiB4Mj0iMjcxIiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyNzYiIHk9IjQyIiB3aWR0aD0iMjY0IiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDA4IiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPlRlbnNvcjkgc2VydmljZSBhZGFwdGVyPC90ZXh0Pgo8dGV4dCB4PSI0MDgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+U2F2ZXMsIGFwcGxpZXMsIHRyYWNrczwvdGV4dD4KPGxpbmUgeDE9IjU0MSIgeTE9IjgwIiB4Mj0iNjA3IiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2MTIiIHk9IjQyIiB3aWR0aD0iMjAwIiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzEyIiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkN1c3RvbWVyJ3MgY2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5uYXRpdmUgbmV0d29yayBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5BUFBMSUNBVElPTiBUUkFGRklDPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTc0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ0IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDE4IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Xb3JrbG9hZCDihpIgY3VzdG9tZXIncyBjbG91ZCBuZXR3b3JrIOKGkiBkZXN0aW5hdGlvbjwvdGV4dD4KPC9zdmc+) #### Network layout The VPC becomes a custom-mode Google Cloud network. Google puts address ranges on subnetworks, so the AWS VPC's overall CIDR stays part of the API view while each subnet's IPv4 range becomes a subnetwork range. Subnet references keep pointing to the matching subnetwork. A Google subnetwork is regional. An AWS subnet's Availability Zone does not set the instance's zone, so review instance placement if your application depends on zone separation. Terraform subnet declarations using `count` or `for_each` keep their instance keys and address expressions. ![Google Cloud VPC contains regional subnetworks. Workloads attach to those subnets, with access controlled by firewall rules.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHb29nbGUgQ2xvdWQgVlBDIGNvbnRhaW5zIHJlZ2lvbmFsIHN1Ym5ldHdvcmtzLiBXb3JrbG9hZHMgYXR0YWNoIHRvIHRob3NlIHN1Ym5ldHMsIHdpdGggYWNjZXNzIGNvbnRyb2xsZWQgYnkgZmlyZXdhbGwgcnVsZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIyNCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIxMzIiIHJ4PSIxMiIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NCIgeT0iNTAiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Hb29nbGUgQ2xvdWQgVlBDPC90ZXh0Pgo8cmVjdCB4PSI0NCIgeT0iNzAiIHdpZHRoPSIzMzAiIGhlaWdodD0iNjIiIHJ4PSI4IiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjIwOSIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5SZWdpb25hbCBzdWJuZXR3b3JrczwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj53b3JrbG9hZCBpbnRlcmZhY2VzICsgSVB2NCByYW5nZXM8L3RleHQ+CjxyZWN0IHg9IjQxNCIgeT0iNzAiIHdpZHRoPSIzNzgiIGhlaWdodD0iNjIiIHJ4PSI4IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjYwMyIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5GaXJld2FsbCBydWxlczwvdGV4dD4KPHRleHQgeD0iNjAzIiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj50cmFmZmljIHJ1bGVzIGFuZCB3b3JrbG9hZCBtZW1iZXJzaGlwPC90ZXh0Pgo8L3N2Zz4=) ![Google Cloud VPC contains regional subnetworks. Workloads attach to those subnets, with access controlled by firewall rules.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJHb29nbGUgQ2xvdWQgVlBDIGNvbnRhaW5zIHJlZ2lvbmFsIHN1Ym5ldHdvcmtzLiBXb3JrbG9hZHMgYXR0YWNoIHRvIHRob3NlIHN1Ym5ldHMsIHdpdGggYWNjZXNzIGNvbnRyb2xsZWQgYnkgZmlyZXdhbGwgcnVsZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxyZWN0IHg9IjI0IiB5PSIyNCIgd2lkdGg9Ijc4OCIgaGVpZ2h0PSIxMzIiIHJ4PSIxMiIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NCIgeT0iNTAiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Hb29nbGUgQ2xvdWQgVlBDPC90ZXh0Pgo8cmVjdCB4PSI0NCIgeT0iNzAiIHdpZHRoPSIzMzAiIGhlaWdodD0iNjIiIHJ4PSI4IiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjIwOSIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5SZWdpb25hbCBzdWJuZXR3b3JrczwvdGV4dD4KPHRleHQgeD0iMjA5IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij53b3JrbG9hZCBpbnRlcmZhY2VzICsgSVB2NCByYW5nZXM8L3RleHQ+CjxyZWN0IHg9IjQxNCIgeT0iNzAiIHdpZHRoPSIzNzgiIGhlaWdodD0iNjIiIHJ4PSI4IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjYwMyIgeT0iOTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5GaXJld2FsbCBydWxlczwvdGV4dD4KPHRleHQgeD0iNjAzIiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij50cmFmZmljIHJ1bGVzIGFuZCB3b3JrbG9hZCBtZW1iZXJzaGlwPC90ZXh0Pgo8L3N2Zz4=) #### Security groups and subnet filters Security-group rules become Google Cloud firewall rules with the same direction, protocol, ports and address ranges. Group membership uses network tags: a rule that names another group in the same VPC selects instances that have that group's tag. A membership change therefore updates the instance tags as well as the AWS group record. Google source tags match within their own network and against primary internal addresses; review secondary and alias IP behaviour separately. Network ACL operations keep ordered subnet rules, but an accepted ACL request alone does not give equivalent packet filtering. #### Routes and connectivity Route-table APIs keep subnet associations and supported next hops. Internet-gateway routes use Google's internet gateway, and private-subnet egress uses a Cloud Router and Cloud NAT for the selected subnetworks. A default internet route alone does not make an instance reachable from the internet: addresses and firewall rules matter too. VPC peering in the same account and region creates both directions of Google VPC Network Peering once it is accepted. Routes that name the peering stay visible through the AWS API, while Google adds the peered subnet routes. If the peering is deleted, a route that names it can stay in the route table, but no traffic uses it. Private Google Access lets eligible private workloads reach Google APIs. #### Limitations Where AWS VPC and this target differ * **Network ACLs behave differently: Google's firewall is stateful.** Google's firewall tracks connections and cannot keep AWS's stateless filtering exactly. Applying that reduced behaviour needs your explicit acknowledgement. * **Security-group rules that use prefix lists are not supported.** They are left out and the limitation is recorded, so less traffic is allowed than on AWS. * **Rules that name a security group in a peered VPC are not supported.** Google source tags cannot express them, so such a rule is rejected when the configuration is applied. * **Private NAT gateways are not supported.** NAT gateway requests with more than one address are not supported either. * **Cross-account and cross-region VPC peering are not supported.** AWS peering DNS options are not supported either. * **Routes to unsupported next hops are rejected.** Routes to transit gateways, instances, network interfaces and other unsupported next hops are rejected. * **PrivateLink endpoints are not created.** Private services you publish need a separate Private Service Connect setup. * **IPAM, Amazon-provided IPv6, custom DHCP options and VPC-wide encryption are not supported.** Use explicit IPv4 subnet ranges. The public IPv6 range AWS gives a VPC differs from Google's separately allocated public subnet ranges. * **Flow logs behave differently: they use Google's format.** Flow-log requests turn on Google subnet logging, with Google's records and destination; the 60- and 600-second aggregation windows are kept. An S3 or CloudWatch destination needs your acknowledgement that it will receive no records. * **Some flow-log options are not supported.** Single-interface capture, AWS log filter expressions, and ACCEPT-only or REJECT-only capture are not supported. * **Existing Elastic IP addresses are not kept.** `AllocateAddress` gets a new public IP in the target cloud and returns once it is allocated. An existing AWS Elastic IP does not move. * **Attaching and detaching network interfaces is not supported.** A standalone `CreateNetworkInterface` records the subnet, private address and security groups; the interface is created when a VM launch names it. Launches with more than one interface are not supported. #### Other considerations **Credentials.** Your application signs its EC2 requests with credentials that the Cloud Adapter deployment's IAM and STS service accepts. The adapter checks the action and resource before changing anything. It holds the target-cloud credentials, so your application needs no second set of cloud API calls. **What to watch.** Keep using the normal status checks after a create or update. The adapter keeps the requested configuration and the observed cloud state separately, retries changes that can be retried, and reports an error when a setting cannot be applied. A `Describe` response shows the saved AWS IDs and configuration, with current cloud-assigned values where needed. Deletes check dependencies: for example, a subnet stays in use while its NAT gateway is still being removed. **Before moving traffic.** Check subnet ranges and placement, test allowed and denied connections, and confirm that private-subnet egress uses the intended NAT gateway. Review peering, private service access, DNS and log destinations separately. **Moving from AWS.** Public IP addresses change, so update DNS records and external allowlists. Existing connections do not survive the move to the new network. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Virtual network and NAT allocation (VPC) · Selected network GiB per month Feature: Virtual network and NAT allocation (VPC). Estimated monthly service charges by Selected network GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD. ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/d2cab4a0bd43996bf3be3807cbc712252d20c6bce4209c6a3f899f21cc44e5e5-light.svg) ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/ba81c1ca9cb7beed685de2654aac6724735c1faf893a0e79e7400074972765c1-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Selected network GiB per month (GiB/month) | VPC | Virtual Private Cloud (VPC) | Difference | | -: | -: | -: | -: | | 0 | 32.85 | 32.12 | -0.73 | | 100 | 37.35 | 36.62 | -0.73 | | 1,000 | 77.85 | 77.12 | -0.73 | | 10,000 | 482.85 | 482.12 | -0.73 | | 100,000 | 4,532.85 | 4,532.12 | -0.73 | | 1,000,000 | 45,032.85 | 45,032.12 | -0.73 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.045 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.044 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. Cloud NAT bills USD 0.0014 per assigned VM-hour, capped at 0.044 from 32 VMs, plus 0.005/hour per NAT IP; the default gateway-hour is the 32-VM cap, so lower it for small node pools. * Amazon VPC pricing: [https://aws.amazon.com/vpc/pricing/](https://aws.amazon.com/vpc/pricing/) * AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv) * Cloud NAT pricing: [https://cloud.google.com/nat/pricing](https://cloud.google.com/nat/pricing) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-e3747b96fbaaafb9d5b0a89ae6f48d55edf6ca32` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Cloud NAT pricing](https://cloud.google.com/nat/pricing). **Virtual network and NAT allocation (VPC) → Virtual Private Cloud (VPC): Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Network management requests | 0.00 | | Origin: Allocated NAT gateway hours | 32.85 | | Origin: Selected billable network transfer | 45.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 45.00 | | Target: Independent native resources | 32.12 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **77.85** | | **Target service subtotal** | **77.12** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0.045 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.044 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Network management requests | 1,000,000 | Requests | | Allocated NAT gateway hours | 730 | gateway-hour | | Selected billable network transfer | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 1,000,000 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. Cloud NAT bills USD 0.0014 per assigned VM-hour, capped at 0.044 from 32 VMs, plus 0.005/hour per NAT IP; the default gateway-hour is the 32-VM cap, so lower it for small node pools. List prices read: 2026-10-22. Model: `plan-e3747b96fbaaafb9d5b0a89ae6f48d55edf6ca32` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Cloud NAT pricing](https://cloud.google.com/nat/pricing). ## On OCI ### Virtual Cloud Network | Capability | Area | Support | Operations | Notes | | - | - | - | - | - | | DHCP options | Addressing | Out of scope | - | custom AWS DHCP option sets are outside this mapping; configure target DNS servers, search domains, and other required settings separately | | IPv6 / secondary CIDR | Addressing | Out of scope | AssociateSubnetCidrBlock, AssociateVpcCidrBlock, DisassociateSubnetCidrBlock, DisassociateVpcCidrBlock | the primary IPv4 VCN and subnet ranges are preserved; IPv6 associations and secondary CIDR blocks are outside this profile | | VPC endpoints (PrivateLink) | Connectivity | Out of scope | - | private service endpoints require a service-specific target configuration; this VPC mapping does not create an equivalent private endpoint automatically | | VPC peering | Connectivity | Out of scope | AcceptVpcPeeringConnection, CreateVpcPeeringConnection, DeleteVpcPeeringConnection, DescribeVpcPeeringConnections, ModifyVpcPeeringConnectionOptions, RejectVpcPeeringConnection | OCI Local and Remote Peering require separate configuration and are outside this profile's automatic mapping | | Subnets | Network | Supported | CreateDefaultSubnet, CreateSubnet, DeleteSubnet, DescribeSubnets, ModifySubnetAttribute | subnet APIs preserve IPv4 ranges and AWS-facing identifiers; the adapter creates the corresponding target subnets and tracks their state | | Virtual network (VPC) | Network | Supported | CreateDefaultVpc, CreateVpc, DeleteVpc, DescribeVpcAttribute, DescribeVpcs, ModifyVpcAttribute, ModifyVpcTenancy | the adapter maps the AWS VPC model to an OCI VCN with its IPv4 address range; AWS-facing identities remain separate from OCI resource IDs | | Flow logs | Observability | Adapter-served | CreateFlowLogs, DeleteFlowLogs, DescribeFlowLogs, GetFlowLogsIntegrationTemplate | flow telemetry uses OCI Logging and OCI fields; AWS flow-log format and destinations are not preserved | | Availability-zone placement | Placement | Partial | DescribeAvailabilityZones, ModifyAvailabilityZoneGroup | target subnets are regional; choose availability zones or domains on workloads that need separation, rather than relying on an AWS subnet zone | | Internet gateway | Routing | Partial | AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, DescribeInternetGateways, DetachInternetGateway | public connectivity uses an OCI internet gateway and route, a public address, and security rules permitting the traffic; the adapter preserves the requested gateway and routing configuration | | NAT gateway | Routing | Supported | CreateNatGateway, DeleteNatGateway, DescribeNatGateways | outbound-only subnet access maps to an OCI NAT Gateway and a private route table whose default route names the gateway | | Route tables | Routing | Partial | AssociateRouteTable, CreateRoute, CreateRouteTable, DeleteRoute, DeleteRouteTable, DescribeRouteTables, DisableVgwRoutePropagation, DisassociateRouteTable, EnableVgwRoutePropagation, ReplaceRoute | the VCN uses OCI route tables; internet and NAT routing map to their OCI gateways. Other custom next hops require backend-specific configuration | | Network ACLs | Security | Out of scope | CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, DescribeNetworkAcls, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry | AWS subnet network ACLs are outside this profile; stateful OCI NSG rules do not reproduce their stateless behavior | | Security groups | Security | Supported | AssociateSecurityGroupVpc, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateSecurityGroup, DeleteSecurityGroup, DescribeSecurityGroupRules, DescribeSecurityGroups, DisassociateSecurityGroupVpc, GetSecurityGroupsForVpc, ModifySecurityGroupRules, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress | rules use OCI NSGs attached to VNICs, preserving direction, protocol, ports, and CIDRs. Peer groups use native NSG references. OCI security lists also permit traffic, so review their combined effect | #### How it works Your application and Terraform's AWS provider keep using the AWS EC2 APIs to create VPCs, subnets, security groups and the other supported VPC resources in the customer's environment. The Tensor9 service adapter accepts those requests and manages the matching OCI resources. The adapter checks each request and its permissions, gives the resource an AWS-format ID and saves the requested configuration. The ID is for API callers; it is not the OCI resource's name. A background worker then applies the configuration to OCI and tracks the result. For example, `CreateVpc` records the VPC with its default security group, main route table and default network ACL, and `DescribeVpcs` reports `pending` until the network exists in OCI, then `available`. A successful create call does not mean the network is ready. Application traffic runs on the customer's cloud network. The adapter handles network-management calls only; it does not carry your application's packets. ![The AWS SDK or Terraform sends network-management requests to the Tensor9 adapter, which saves the requested configuration and applies it through the target cloud API. Application traffic runs on the customer's cloud network, not through the adapter.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM4IiB2aWV3Qm94PSIwIDAgODM2IDIzOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgQVdTIFNESyBvciBUZXJyYWZvcm0gc2VuZHMgbmV0d29yay1tYW5hZ2VtZW50IHJlcXVlc3RzIHRvIHRoZSBUZW5zb3I5IGFkYXB0ZXIsIHdoaWNoIHNhdmVzIHRoZSByZXF1ZXN0ZWQgY29uZmlndXJhdGlvbiBhbmQgYXBwbGllcyBpdCB0aHJvdWdoIHRoZSB0YXJnZXQgY2xvdWQgQVBJLiBBcHBsaWNhdGlvbiB0cmFmZmljIHJ1bnMgb24gdGhlIGN1c3RvbWVyJ3MgY2xvdWQgbmV0d29yaywgbm90IHRocm91Z2ggdGhlIGFkYXB0ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InZwYy1ydW50aW1lLWFycm93IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5ORVRXT1JLIE1BTkFHRU1FTlQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE4MCIgaGVpZ2h0PSI3OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExNCIgeT0iNzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5BV1MgU0RLIC8gVGVycmFmb3JtPC90ZXh0Pgo8dGV4dCB4PSIxMTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+RUMyIEFQSSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjIwNSIgeTE9IjgwIiB4Mj0iMjcxIiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyNzYiIHk9IjQyIiB3aWR0aD0iMjY0IiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDA4IiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPlRlbnNvcjkgc2VydmljZSBhZGFwdGVyPC90ZXh0Pgo8dGV4dCB4PSI0MDgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+U2F2ZXMsIGFwcGxpZXMsIHRyYWNrczwvdGV4dD4KPGxpbmUgeDE9IjU0MSIgeTE9IjgwIiB4Mj0iNjA3IiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI2MTIiIHk9IjQyIiB3aWR0aD0iMjAwIiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzEyIiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkN1c3RvbWVyJ3MgY2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5uYXRpdmUgbmV0d29yayBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5BUFBMSUNBVElPTiBUUkFGRklDPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTc0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ0IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDE4IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Xb3JrbG9hZCDihpIgY3VzdG9tZXIncyBjbG91ZCBuZXR3b3JrIOKGkiBkZXN0aW5hdGlvbjwvdGV4dD4KPC9zdmc+) ![The AWS SDK or Terraform sends network-management requests to the Tensor9 adapter, which saves the requested configuration and applies it through the target cloud API. Application traffic runs on the customer's cloud network, not through the adapter.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjM4IiB2aWV3Qm94PSIwIDAgODM2IDIzOCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaGUgQVdTIFNESyBvciBUZXJyYWZvcm0gc2VuZHMgbmV0d29yay1tYW5hZ2VtZW50IHJlcXVlc3RzIHRvIHRoZSBUZW5zb3I5IGFkYXB0ZXIsIHdoaWNoIHNhdmVzIHRoZSByZXF1ZXN0ZWQgY29uZmlndXJhdGlvbiBhbmQgYXBwbGllcyBpdCB0aHJvdWdoIHRoZSB0YXJnZXQgY2xvdWQgQVBJLiBBcHBsaWNhdGlvbiB0cmFmZmljIHJ1bnMgb24gdGhlIGN1c3RvbWVyJ3MgY2xvdWQgbmV0d29yaywgbm90IHRocm91Z2ggdGhlIGFkYXB0ZXIuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9InZwYy1ydW50aW1lLWFycm93IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI2IiBtYXJrZXJIZWlnaHQ9IjYiIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjUiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5ORVRXT1JLIE1BTkFHRU1FTlQ8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MiIgd2lkdGg9IjE4MCIgaGVpZ2h0PSI3OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExNCIgeT0iNzMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5BV1MgU0RLIC8gVGVycmFmb3JtPC90ZXh0Pgo8dGV4dCB4PSIxMTQiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+RUMyIEFQSSByZXF1ZXN0czwvdGV4dD4KPGxpbmUgeDE9IjIwNSIgeTE9IjgwIiB4Mj0iMjcxIiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyNzYiIHk9IjQyIiB3aWR0aD0iMjY0IiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDA4IiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPlRlbnNvcjkgc2VydmljZSBhZGFwdGVyPC90ZXh0Pgo8dGV4dCB4PSI0MDgiIHk9Ijk4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+U2F2ZXMsIGFwcGxpZXMsIHRyYWNrczwvdGV4dD4KPGxpbmUgeDE9IjU0MSIgeTE9IjgwIiB4Mj0iNjA3IiB5Mj0iODAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCN2cGMtcnVudGltZS1hcnJvdykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI2MTIiIHk9IjQyIiB3aWR0aD0iMjAwIiBoZWlnaHQ9Ijc4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzEyIiB5PSI3MyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkN1c3RvbWVyJ3MgY2xvdWQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMiIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5uYXRpdmUgbmV0d29yayBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjI0IiB5PSIxNTYiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5BUFBMSUNBVElPTiBUUkFGRklDPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTc0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjQ0IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDE4IiB5PSIyMDEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Xb3JrbG9hZCDihpIgY3VzdG9tZXIncyBjbG91ZCBuZXR3b3JrIOKGkiBkZXN0aW5hdGlvbjwvdGV4dD4KPC9zdmc+) #### Network layout The VPC becomes an OCI Virtual Cloud Network (VCN): the VPC's IPv4 range goes on the VCN, and each subnet range on an OCI subnet. AWS IDs stay available to later API requests, and the adapter tracks the matching OCI resources separately. The OCI subnets are regional. Availability-domain and fault-domain placement belongs to the workloads that use those subnets, so review it if your application relies on AWS Availability Zone separation. Subnet `count` and `for_each` declarations keep their keys and address expressions. ![OCI Virtual Cloud Network contains regional subnets. Workloads attach to those subnets, with access controlled by network security groups.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPQ0kgVmlydHVhbCBDbG91ZCBOZXR3b3JrIGNvbnRhaW5zIHJlZ2lvbmFsIHN1Ym5ldHMuIFdvcmtsb2FkcyBhdHRhY2ggdG8gdGhvc2Ugc3VibmV0cywgd2l0aCBhY2Nlc3MgY29udHJvbGxlZCBieSBuZXR3b3JrIHNlY3VyaXR5IGdyb3Vwcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPHJlY3QgeD0iMjQiIHk9IjI0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjEzMiIgcng9IjEyIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ0IiB5PSI1MCIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPk9DSSBWaXJ0dWFsIENsb3VkIE5ldHdvcms8L3RleHQ+CjxyZWN0IHg9IjQ0IiB5PSI3MCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI2MiIgcng9IjgiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjA5IiB5PSI5NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPlJlZ2lvbmFsIHN1Ym5ldHM8L3RleHQ+Cjx0ZXh0IHg9IjIwOSIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+d29ya2xvYWQgaW50ZXJmYWNlcyArIElQdjQgcmFuZ2VzPC90ZXh0Pgo8cmVjdCB4PSI0MTQiIHk9IjcwIiB3aWR0aD0iMzc4IiBoZWlnaHQ9IjYyIiByeD0iOCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2MDMiIHk9Ijk2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+TmV0d29yayBzZWN1cml0eSBncm91cHM8L3RleHQ+Cjx0ZXh0IHg9IjYwMyIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+dHJhZmZpYyBydWxlcyBhbmQgd29ya2xvYWQgbWVtYmVyc2hpcDwvdGV4dD4KPC9zdmc+) ![OCI Virtual Cloud Network contains regional subnets. Workloads attach to those subnets, with access controlled by network security groups.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTgwIiB2aWV3Qm94PSIwIDAgODM2IDE4MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJPQ0kgVmlydHVhbCBDbG91ZCBOZXR3b3JrIGNvbnRhaW5zIHJlZ2lvbmFsIHN1Ym5ldHMuIFdvcmtsb2FkcyBhdHRhY2ggdG8gdGhvc2Ugc3VibmV0cywgd2l0aCBhY2Nlc3MgY29udHJvbGxlZCBieSBuZXR3b3JrIHNlY3VyaXR5IGdyb3Vwcy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPHJlY3QgeD0iMjQiIHk9IjI0IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjEzMiIgcng9IjEyIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ0IiB5PSI1MCIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPk9DSSBWaXJ0dWFsIENsb3VkIE5ldHdvcms8L3RleHQ+CjxyZWN0IHg9IjQ0IiB5PSI3MCIgd2lkdGg9IjMzMCIgaGVpZ2h0PSI2MiIgcng9IjgiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMjA5IiB5PSI5NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPlJlZ2lvbmFsIHN1Ym5ldHM8L3RleHQ+Cjx0ZXh0IHg9IjIwOSIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+d29ya2xvYWQgaW50ZXJmYWNlcyArIElQdjQgcmFuZ2VzPC90ZXh0Pgo8cmVjdCB4PSI0MTQiIHk9IjcwIiB3aWR0aD0iMzc4IiBoZWlnaHQ9IjYyIiByeD0iOCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2MDMiIHk9Ijk2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+TmV0d29yayBzZWN1cml0eSBncm91cHM8L3RleHQ+Cjx0ZXh0IHg9IjYwMyIgeT0iMTE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+dHJhZmZpYyBydWxlcyBhbmQgd29ya2xvYWQgbWVtYmVyc2hpcDwvdGV4dD4KPC9zdmc+) #### Security groups and subnet filters Security groups become OCI network security groups (NSGs) attached to the relevant virtual network interfaces. Rules keep direction, protocol, ports and CIDR ranges. A rule that names another group uses OCI's own NSG reference. OCI combines the permissions of subnet security lists and interface NSGs, and the adapter accounts for both when it applies your ingress rules. Adding a restrictive NSG does not cancel an allow rule already in a security list, so review the rules already in the customer's VCN as well as the groups your application creates. Internet access also needs the right route, gateway and public address. #### Routes and connectivity The VCN uses OCI route tables and an internet gateway for public routing. Subnets that need outbound-only access use an OCI NAT Gateway and a private route table whose default route points to it. #### Limitations Where AWS VPC and this target differ * **Network ACLs are not supported.** AWS subnet network ACLs are outside this mapping. Stateful NSG rules are not the same as stateless filters: test both allowed and denied connections after deploying the VCN. * **You must configure references to groups outside this environment.** A rule that names a security group outside the mapped environment needs separate configuration. * **Private service access and VCN peering are not set up for you.** Service Gateway, Private Endpoint, Local Peering and Remote Peering attach and route differently from AWS PrivateLink and VPC peering, and are not mapped automatically. * **Custom route next hops behave differently.** A custom next hop needs a suitable OCI route; the AWS route-table declaration does not cover every OCI routing option. * **IPAM, IPv6, secondary CIDR blocks and custom DHCP options are not supported.** The primary IPv4 VCN and subnet ranges are kept. OCI has related features, but their presence alone does not reproduce the AWS configuration. * **Flow logs behave differently: they use OCI Logging.** Flow records use OCI's format. Update destinations and queries that depend on AWS flow logs. * **Existing Elastic IP addresses are not kept.** `AllocateAddress` gets a new public IP in the target cloud and returns once it is allocated. An existing AWS Elastic IP does not move. * **Attaching and detaching network interfaces is not supported.** A standalone `CreateNetworkInterface` records the subnet, private address and security groups; the interface is created when a VM launch names it. Launches with more than one interface are not supported. #### Other considerations **Credentials.** Your application signs its EC2 requests with credentials that the Cloud Adapter deployment's IAM and STS service accepts. The adapter checks the action and resource before changing anything. It holds the target-cloud credentials, so your application needs no second set of cloud API calls. **What to watch.** Keep using the normal status checks after a create or update. The adapter keeps the requested configuration and the observed cloud state separately, retries changes that can be retried, and reports an error when a setting cannot be applied. A `Describe` response shows the saved AWS IDs and configuration, with current cloud-assigned values where needed. Deletes check dependencies: for example, a subnet stays in use while its NAT gateway is still being removed. **Before moving traffic.** Check subnet ranges and placement, test allowed and denied connections, and confirm that private-subnet egress uses the intended NAT gateway. Review peering, private service access, DNS and log destinations separately. **Moving from AWS.** Public IP addresses change, so update DNS records and external allowlists. Existing connections do not survive the move to the new network. #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. ##### Virtual network and NAT allocation (VPC) · Selected network GiB per month Feature: Virtual network and NAT allocation (VPC). Estimated monthly service charges by Selected network GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD. ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/7589295ae9baa6b7ed84bbc45e1cb7b036760e2cdadfd223280510b59c8a0e36-light.svg) ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/f1973f3e2f06dbbaaf6a9711ec42245c8e7e61b792101e58eafe0ff00cd12223-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Selected network GiB per month (GiB/month) | VPC | Virtual Cloud Network | Difference | | -: | -: | -: | -: | | 0 | 32.85 | 0.00 | -32.85 | | 100 | 37.35 | 0.00 | -37.35 | | 1,000 | 77.85 | 0.00 | -77.85 | | 10,000 | 482.85 | 0.00 | -482.85 | | 100,000 | 4,532.85 | 762.96 | -3,769.89 | | 1,000,000 | 45,032.85 | 8,412.96 | -36,619.89 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. OCI lists no NAT gateway charge; traffic leaving the VCN bills as internet egress after 10 TB a month. * Amazon VPC pricing: [https://aws.amazon.com/vpc/pricing/](https://aws.amazon.com/vpc/pricing/) * AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv) * OCI price list API: [https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-95441666831b4ce50a1ee860569b2535dc66553c` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/). **Virtual network and NAT allocation (VPC) → Virtual Cloud Network: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: us-ashburn-1. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Network management requests | 0.00 | | Origin: Allocated NAT gateway hours | 32.85 | | Origin: Selected billable network transfer | 45.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 0.00 | | Target: Independent native resources | 0.00 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **77.85** | | **Target service subtotal** | **0.00** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Network management requests | 1,000,000 | Requests | | Allocated NAT gateway hours | 730 | gateway-hour | | Selected billable network transfer | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 1,000,000 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. OCI lists no NAT gateway charge; traffic leaving the VCN bills as internet egress after 10 TB a month. List prices read: 2026-10-22. Model: `plan-95441666831b4ce50a1ee860569b2535dc66553c` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [OCI price list API](https://apexapps.oracle.com/pls/apex/cetools/api/v1/products/). ## On Private Kubernetes ### Existing Kubernetes network | Capability | Area | Support | Operations | Notes | | - | - | - | - | - | | Infrastructure references | Compilation | Supported | - | source VPC-family outputs remain resolvable for the translated stack; generated identifiers are not independently provisioned cloud networks | | Runtime VPC management | Network | Out of scope | - | this backend does not provide the AWS VPC create, update, or discovery API for the existing cluster network | | AWS traffic-policy enforcement | Security | Out of scope | - | source security groups and subnet ACLs are not translated into enforced Kubernetes network policy by this backend | #### How it works The customer's Kubernetes cluster already supplies the network used by the application. Tensor9 translates the workload resources to use that cluster. It keeps the source VPC-family references needed by the generated infrastructure, but creates no separate VPC, subnet, NAT gateway, or AWS security-group boundary through this backend. #### What source network outputs mean A source network identifier can feed another resource or module output even though the target cluster has no corresponding AWS network object. Compilation preserves a resolvable value for that reference and records which source resource it came from. The value is not a routable address or proof that a new network was provisioned. Use the deployed workload and Service endpoints to determine actual connectivity. #### Traffic policy and external access The customer platform team must configure the cluster's network plugin, network policies, ingress or load balancer integration, DNS, and outbound routes. This VPC backend does not convert source security groups or stateless subnet ACLs into enforced Kubernetes rules. Verify both allowed and denied connections, including traffic between application components and other workloads sharing the cluster. #### Runtime API and cutover Applications that create or change AWS VPC resources at runtime cannot use this existing-network backend for those operations. The AWS-compatible VPC management described for Google Cloud, Azure, and OCI is a different mapping. Before cutover, prepare cluster connectivity, deploy the translated workloads, and update DNS and external allowlists for their target endpoints. ## On Scaleway ### Scaleway VPC | Capability | Area | Support | Operations | Notes | | - | - | - | - | - | | A range known only at deploy | Addressing | Out of scope | - | a cidr\_block reached through a local or a variable with a literal behind it resolves and is used; a range genuinely unbounded until apply stops the build, because the Private Network needs a concrete subnet and there is nowhere else for the range to go | | A subnet whose range cannot be resolved | Addressing | Partial | - | not silently skipped: it joins the disclosed drops and is named, so you see a gap in the network you declared rather than receiving a quietly smaller one | | IPv6 and dual-stack subnets | Addressing | Partial | - | a Private Network takes an IPv4 range and nothing else, so a dual-stack subnet keeps its v4 range and loses its v6 one -- reported rather than dropped quietly | | The VPC's own address range | Addressing | Partial | DescribeVpcAttribute | a Scaleway VPC carries NO address range at all -- there is no CIDR field on the resource. Each SUBNET's range lands on its Private Network, where a range can live; the VPC's own aggregate range is emitted on no resource at all and survives only so that references to it still resolve. The subnet addresses you declared are preserved; the level they attach at is not, so anything reading the VPC's own range should read the networks instead | | Network ACLs and security groups | Gateways and filtering | Out of scope | CreateNetworkAcl, CreateSecurityGroup | NOT TRANSLATED IN v1, disclosed by address. Scaleway does have filtering primitives -- scaleway\_instance\_security\_group on instances, scaleway\_vpc\_acl and scaleway\_lb\_acl -- but this mapping carries none of your security groups, rules or NACLs onto them, so an instance or load balancer the origin firewalled arrives without those rules and the build names each dropped resource. (This row said 'no analog at this layer' until 2026-09-14, which overstated the gap: the analog exists, the translation does not.) Express filtering on the Scaleway side before cutover | | Route tables, internet gateways, NAT gateways | Gateways and filtering | Out of scope | CreateInternetGateway, CreateNatGateway, CreateRouteTable | Scaleway VPCs route between their own Private Networks and expose no route-table, internet-gateway or NAT-gateway primitive at this layer. None is dropped silently: each is reported BY ADDRESS, so the build names the exact resources it could not carry rather than giving a count | | References to the network | Network | Supported | - | the VPC's id and arn resolve -- Scaleway's srn is the analog of an ARN -- so infrastructure pointing at your VPC keeps pointing at it | | Subnets | Network | Supported | CreateSubnet, DeleteSubnet, DescribeSubnets | each subnet becomes a Scaleway Private Network carrying that subnet's address range -- which is where your addressing ends up, because the VPC itself cannot hold one | | Virtual network (VPC) | Network | Supported | CreateVpc, DeleteVpc, DescribeVpcs, ModifyVpcAttribute | your VPC becomes a Scaleway VPC in the region the Cloud Adapter deployment runs in; Scaleway regions carry real availability zones, so the placement your subnets expressed is expressible here | #### Example monthly charges This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include. **Native or deployment mapping.** This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. Cost estimates describe the selected service resources; operation coverage remains separate. ##### Virtual network and NAT allocation (VPC) · Selected network GiB per month Feature: Virtual network and NAT allocation (VPC). Estimated monthly service charges by Selected network GiB per month. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: fr-par; currency: USD. ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/a568b8d11fb3192d6e1007a657e9ffc3c85efefb2a9c9ad5e34ba0c12d3540f0-light.svg) ![Virtual network and NAT allocation (VPC) · Selected network GiB per month: monthly service charges by Selected network GiB per month. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/edd5302ff0ef4970d5309785b88c0b0914c2b042a206ed853909ae002647fd0e-dark.svg) Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples. Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more. | Selected network GiB per month (GiB/month) | VPC | Scaleway VPC | Difference | | -: | -: | -: | -: | | 0 | 32.85 | 21.27 | -11.58 | | 100 | 37.35 | 21.27 | -16.08 | | 1,000 | 77.85 | 21.27 | -56.58 | | 10,000 | 482.85 | 21.27 | -461.58 | | 100,000 | 4,532.85 | 21.27 | -4,511.58 | | 1,000,000 | 45,032.85 | 21.27 | -45,011.58 | **Curve assumptions** | Assumption | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.029133 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | * Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements. * Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → fr-par, USD/month. * Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded. * Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied. * Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Native/deployment comparison scope: This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. Scaleway Public Gateway egress is included; Private Networks are free. * Amazon VPC pricing: [https://aws.amazon.com/vpc/pricing/](https://aws.amazon.com/vpc/pricing/) * AWS Price List API, AmazonEC2 offer (CSV): [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv) * Scaleway Network pricing: [https://www.scaleway.com/en/pricing/network/](https://www.scaleway.com/en/pricing/network/) Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. List prices read: 2026-10-22. Model: `plan-d0b2d2646d986c913f12976fbf30715785940a5f` / `2026-10-22.planning.2`. Curve: `workload-1`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Scaleway Network pricing](https://www.scaleway.com/en/pricing/network/). **Virtual network and NAT allocation (VPC) → Scaleway VPC: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Scenario source region: us-east-1. Scenario target region: fr-par. Currency: USD. | Monthly component | USD | | - | -: | | Origin: Network management requests | 0.00 | | Origin: Allocated NAT gateway hours | 32.85 | | Origin: Selected billable network transfer | 45.00 | | Target: Target retained physical data | 0.00 | | Target: Additional broker replica storage | 0.00 | | Target: Target native provider operations | 0.00 | | Target: Execution or worker CPU | 0.00 | | Target: Execution or worker RAM | 0.00 | | Target: Selected billable network | 0.00 | | Target: Independent native resources | 21.27 | | Target: Independent native resources | 0.00 | | **Origin service subtotal** | **77.85** | | **Target service subtotal** | **21.27** | Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs. Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied. Excluded costs and workload features: * Public IPv4, VPN/interconnect, firewalls, private endpoints, DNS, peering and traffic outside the selected transfer scope. * Taxes, discounts, credits and free-tier allowances not explicitly listed by this model. * Unmodeled dependent services, task execution and operations outside the selected workload family. **Scenario assumptions** | Input | Value | Unit | | - | -: | - | | Origin list price · Network management requests | 0 | USD/Requests | | Origin list price · Allocated NAT gateway hours | 0.045 | USD/gateway-hour | | Origin list price · Selected billable network transfer | 0.045 | USD/GiB | | Target price guess · read | 0 | USD/read | | Target price guess · write | 0 | USD/write | | Target price guess · provider operation | 0 | USD/provider operation | | Target price guess · GiB-month | 0 | USD/GiB-month | | Target price guess · published GiB | 0 | USD/published GiB | | Target price guess · delivered GiB | 0 | USD/delivered GiB | | Target list price · network GiB | 0 | USD/network GiB | | Target price guess · replica GiB-month | 0 | USD/replica GiB-month | | Target price guess · vCPU-hour | 0 | USD/vCPU-hour | | Target price guess · GiB-hour | 0 | USD/GiB-hour | | Target list price · resource-hour | 0.029133 | USD/resource-hour | | Target price guess · resource-month | 0 | USD/resource-month | | Target price guess · input token | 0 | USD/input token | | Target price guess · output token | 0 | USD/output token | | Target monthly base charge | 0 | USD/month | | Approximate target service minimum | 0 | USD/month | | Minimum primary CPU | 2 | vCPU | | Minimum primary RAM | 8 | GiB | | Minimum primary disk | 100 | GiB | | Additional full-price standby copy | 0 | 0 or 1 | | Allocated share of provisioned cost | 1 | fraction | | Read/write work per vCPU-second | 1,500 | operations/vCPU-second | | Planning peak / mean work | 2 | multiplier | | Planning primary CPU utilization | 0.7 | fraction | | Resident state reserved in RAM | 0.1 | fraction | | Planning disk utilization | 0.8 | fraction | | Maintenance and log disk reserve | 20 | GiB | | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour | | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour | | Staging database disk unit-price guess | 0.17 | USD/GiB-month | | Dependent object sink storage price guess | 0.023 | USD/GiB-month | | Dependent object sink write price guess | 0.000005 | USD/write | | Network management requests | 1,000,000 | Requests | | Allocated NAT gateway hours | 730 | gateway-hour | | Selected billable network transfer | 1,000 | GiB | * Translated reads: 0 operations. * Translated writes: 0 operations. * Translated resident physical data: 0 GiB-month. * Native provider operations: 1,000,000 operations. * Published payload: 0 GiB. * Delivered payload: 0 GiB. * Allocated execution CPU: 0 vCPU-hour. * Allocated execution RAM: 0 GiB-hour. * Independent resource allocation: 730 resource-hour. * Independent inventory: 0 resource-month. * Input tokens: 0 tokens. * Output tokens: 0 tokens. * Billable network: 1,000 GiB. * Dependent object sink retained data: 0 GiB-month. * Dependent object sink writes: 0 writes. * Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote. * Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free. * Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified. * Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity. * A declared adapter mapping and cost model do not establish implementation availability or service equivalence. * This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support. * Native/deployment comparison scope: This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. * Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote. * Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs. * Resource-hours represent selected gateway allocation, not a claim that the network object has an hourly fee. * Use matching source and target traffic scope: NAT processing, inter-zone transfer and internet egress are different meters. * Resource-hours are the selected NAT/gateway allocation, not a fee for the network object; network GiB is the gateway's processed or transferred traffic. Free management API calls do not reveal network traffic. Scaleway Public Gateway egress is included; Private Networks are free. List prices read: 2026-10-22. Model: `plan-d0b2d2646d986c913f12976fbf30715785940a5f` / `2026-10-22.planning.2`. Scenario: `planning-example`. Sources: [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/), [AWS Price List API, AmazonEC2 offer (CSV)](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/current/us-east-1/index.csv), [Scaleway Network pricing](https://www.scaleway.com/en/pricing/network/). ## Costs Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications. | Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping | | - | - | - | -: | -: | -: | - | | Scaleway VPC | Selected network GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 482.85 | 21.27 | -461.58 | Native or deployment | | Virtual Cloud Network | Selected network GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 482.85 | 0.00 | -482.85 | Service adapter | | Virtual Network | Selected network GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 482.85 | 482.85 | 0.00 | Service adapter | | Virtual Private Cloud (VPC) | Selected network GiB per month: 10,000 GiB/month | Cited list prices, 2026-10-22 | 482.85 | 482.12 | -0.73 | Service adapter | Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows. Cost curves across workload sizes, with every assumption and exclusion: [VPC costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-vpc). ## Service level agreements > [!WARNING] > > These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment. Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status. See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md). ### VPC to Virtual Network | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Bounded VPC management reads adapter-added latency | +10 ms monthly p99 | `aws::1.0.0::ec2`: `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeNetworkAcls`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeVpcAttribute`, `DescribeVpcPeeringConnections`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc` | One point read or at most 100 returned network objects and at most 20 filters. | | VPC topology and policy mutation adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::ec2`: `AcceptVpcPeeringConnection`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AssociateSubnetCidrBlock`, `AssociateVpcCidrBlock`, `AttachInternetGateway`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateNetworkAcl`, `CreateNetworkAclEntry`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateVpc`, `CreateVpcPeeringConnection`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteVpc`, `DeleteVpcPeeringConnection`, `DetachInternetGateway`, `DisableVgwRoutePropagation`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `DisassociateSubnetCidrBlock`, `DisassociateVpcCidrBlock`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcPeeringConnectionOptions`, `ModifyVpcTenancy`, `RejectVpcPeeringConnection`, `ReplaceNetworkAclAssociation`, `ReplaceNetworkAclEntry`, `ReplaceRoute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress` | One object or at most 100 security, route, ACL, address, interface or tag entries; target readiness separate. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::ec2`: `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeNetworkAcls`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeVpcAttribute`, `DescribeVpcPeeringConnections`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc`, `AcceptVpcPeeringConnection`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AssociateSubnetCidrBlock`, `AssociateVpcCidrBlock`, `AttachInternetGateway`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateNetworkAcl`, `CreateNetworkAclEntry`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateVpc`, `CreateVpcPeeringConnection`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteVpc`, `DeleteVpcPeeringConnection`, `DetachInternetGateway`, `DisableVgwRoutePropagation`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `DisassociateSubnetCidrBlock`, `DisassociateVpcCidrBlock`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcPeeringConnectionOptions`, `ModifyVpcTenancy`, `RejectVpcPeeringConnection`, `ReplaceNetworkAclAssociation`, `ReplaceNetworkAclEntry`, `ReplaceRoute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on azure::1.0.0::vnet. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Bounded VPC management reads: +10 ms monthly p99 (adapter-added).** `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeNetworkAcls`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeVpcAttribute`, `DescribeVpcPeeringConnections`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc`. Bounded adapter state lookup and AWS response mapping; packet forwarding is excluded. **VPC topology and policy mutation: +25 ms monthly p99 (adapter-added).** `AcceptVpcPeeringConnection`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AssociateSubnetCidrBlock`, `AssociateVpcCidrBlock`, `AttachInternetGateway`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateNetworkAcl`, `CreateNetworkAclEntry`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateVpc`, `CreateVpcPeeringConnection`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteVpc`, `DeleteVpcPeeringConnection`, `DetachInternetGateway`, `DisableVgwRoutePropagation`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `DisassociateSubnetCidrBlock`, `DisassociateVpcCidrBlock`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcPeeringConnectionOptions`, `ModifyVpcTenancy`, `RejectVpcPeeringConnection`, `ReplaceNetworkAclAssociation`, `ReplaceNetworkAclEntry`, `ReplaceRoute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress`. Whole-request validation, durable desired-state admission and reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### VPC to Virtual Private Cloud (VPC) | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Bounded VPC management reads adapter-added latency | +10 ms monthly p99 | `aws::1.0.0::ec2`: `DescribeAddresses`, `DescribeAddressesAttribute`, `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeNetworkAcls`, `DescribeNetworkInterfaceAttribute`, `DescribeNetworkInterfaces`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeTags`, `DescribeVpcAttribute`, `DescribeVpcPeeringConnections`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc` | One point read or at most 100 returned network objects and at most 20 filters. | | VPC topology and policy mutation adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::ec2`: `AcceptVpcPeeringConnection`, `AllocateAddress`, `AssignIpv6Addresses`, `AssignPrivateIpAddresses`, `AssociateAddress`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AssociateSubnetCidrBlock`, `AssociateVpcCidrBlock`, `AttachInternetGateway`, `AttachNetworkInterface`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateNetworkAcl`, `CreateNetworkAclEntry`, `CreateNetworkInterface`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateTags`, `CreateVpc`, `CreateVpcPeeringConnection`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `DeleteNetworkInterface`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteTags`, `DeleteVpc`, `DeleteVpcPeeringConnection`, `DetachInternetGateway`, `DetachNetworkInterface`, `DisableVgwRoutePropagation`, `DisassociateAddress`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `DisassociateSubnetCidrBlock`, `DisassociateVpcCidrBlock`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifyNetworkInterfaceAttribute`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcPeeringConnectionOptions`, `ModifyVpcTenancy`, `RejectVpcPeeringConnection`, `ReleaseAddress`, `ReplaceNetworkAclAssociation`, `ReplaceNetworkAclEntry`, `ReplaceRoute`, `ResetNetworkInterfaceAttribute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress`, `UnassignIpv6Addresses`, `UnassignPrivateIpAddresses` | One object or at most 100 security, route, ACL, address, interface or tag entries; target readiness separate. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::ec2`: `DescribeAddresses`, `DescribeAddressesAttribute`, `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeNetworkAcls`, `DescribeNetworkInterfaceAttribute`, `DescribeNetworkInterfaces`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeTags`, `DescribeVpcAttribute`, `DescribeVpcPeeringConnections`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc`, `AcceptVpcPeeringConnection`, `AllocateAddress`, `AssignIpv6Addresses`, `AssignPrivateIpAddresses`, `AssociateAddress`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AssociateSubnetCidrBlock`, `AssociateVpcCidrBlock`, `AttachInternetGateway`, `AttachNetworkInterface`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateNetworkAcl`, `CreateNetworkAclEntry`, `CreateNetworkInterface`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateTags`, `CreateVpc`, `CreateVpcPeeringConnection`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `DeleteNetworkInterface`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteTags`, `DeleteVpc`, `DeleteVpcPeeringConnection`, `DetachInternetGateway`, `DetachNetworkInterface`, `DisableVgwRoutePropagation`, `DisassociateAddress`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `DisassociateSubnetCidrBlock`, `DisassociateVpcCidrBlock`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifyNetworkInterfaceAttribute`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcPeeringConnectionOptions`, `ModifyVpcTenancy`, `RejectVpcPeeringConnection`, `ReleaseAddress`, `ReplaceNetworkAclAssociation`, `ReplaceNetworkAclEntry`, `ReplaceRoute`, `ResetNetworkInterfaceAttribute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress`, `UnassignIpv6Addresses`, `UnassignPrivateIpAddresses` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on google::1.0.0::compute::network. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Bounded VPC management reads: +10 ms monthly p99 (adapter-added).** `DescribeAddresses`, `DescribeAddressesAttribute`, `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeNetworkAcls`, `DescribeNetworkInterfaceAttribute`, `DescribeNetworkInterfaces`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeTags`, `DescribeVpcAttribute`, `DescribeVpcPeeringConnections`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc`. Bounded adapter state lookup and AWS response mapping; packet forwarding is excluded. **VPC topology and policy mutation: +25 ms monthly p99 (adapter-added).** `AcceptVpcPeeringConnection`, `AllocateAddress`, `AssignIpv6Addresses`, `AssignPrivateIpAddresses`, `AssociateAddress`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AssociateSubnetCidrBlock`, `AssociateVpcCidrBlock`, `AttachInternetGateway`, `AttachNetworkInterface`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateNetworkAcl`, `CreateNetworkAclEntry`, `CreateNetworkInterface`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateTags`, `CreateVpc`, `CreateVpcPeeringConnection`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `DeleteNetworkInterface`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteTags`, `DeleteVpc`, `DeleteVpcPeeringConnection`, `DetachInternetGateway`, `DetachNetworkInterface`, `DisableVgwRoutePropagation`, `DisassociateAddress`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `DisassociateSubnetCidrBlock`, `DisassociateVpcCidrBlock`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifyNetworkInterfaceAttribute`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcPeeringConnectionOptions`, `ModifyVpcTenancy`, `RejectVpcPeeringConnection`, `ReleaseAddress`, `ReplaceNetworkAclAssociation`, `ReplaceNetworkAclEntry`, `ReplaceRoute`, `ResetNetworkInterfaceAttribute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress`, `UnassignIpv6Addresses`, `UnassignPrivateIpAddresses`. Whole-request validation, durable desired-state admission and reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### VPC to Virtual Cloud Network | SLA | Service level | What is covered | Conditions | | - | - | - | - | | Bounded VPC management reads adapter-added latency | +10 ms monthly p99 | `aws::1.0.0::ec2`: `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeVpcAttribute`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc` | One point read or at most 100 returned network objects and at most 20 filters. | | VPC topology and policy mutation adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::ec2`: `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AttachInternetGateway`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateVpc`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteVpc`, `DetachInternetGateway`, `DisableVgwRoutePropagation`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcTenancy`, `ReplaceRoute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress` | One object or at most 100 security, route, ACL, address, interface or tag entries; target readiness separate. | | Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::ec2`: `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeVpcAttribute`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc`, `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AttachInternetGateway`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateVpc`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteVpc`, `DetachInternetGateway`, `DisableVgwRoutePropagation`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcTenancy`, `ReplaceRoute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress` | The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. | | Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. | | Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. | **Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values. **What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA. **How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded. **Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment. #### What this adapter does Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on oci::1.0.0::vcn. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered. #### How the latency targets were chosen **Bounded VPC management reads: +10 ms monthly p99 (adapter-added).** `DescribeAvailabilityZones`, `DescribeFlowLogs`, `DescribeInternetGateways`, `DescribeNatGateways`, `DescribeRouteTables`, `DescribeSecurityGroupRules`, `DescribeSecurityGroups`, `DescribeSubnets`, `DescribeVpcAttribute`, `DescribeVpcs`, `GetFlowLogsIntegrationTemplate`, `GetSecurityGroupsForVpc`. Bounded adapter state lookup and AWS response mapping; packet forwarding is excluded. **VPC topology and policy mutation: +25 ms monthly p99 (adapter-added).** `AssociateRouteTable`, `AssociateSecurityGroupVpc`, `AttachInternetGateway`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDefaultSubnet`, `CreateDefaultVpc`, `CreateFlowLogs`, `CreateInternetGateway`, `CreateNatGateway`, `CreateRoute`, `CreateRouteTable`, `CreateSecurityGroup`, `CreateSubnet`, `CreateVpc`, `DeleteFlowLogs`, `DeleteInternetGateway`, `DeleteNatGateway`, `DeleteRoute`, `DeleteRouteTable`, `DeleteSecurityGroup`, `DeleteSubnet`, `DeleteVpc`, `DetachInternetGateway`, `DisableVgwRoutePropagation`, `DisassociateRouteTable`, `DisassociateSecurityGroupVpc`, `EnableVgwRoutePropagation`, `ModifyAvailabilityZoneGroup`, `ModifySecurityGroupRules`, `ModifySubnetAttribute`, `ModifyVpcAttribute`, `ModifyVpcTenancy`, `ReplaceRoute`, `RevokeSecurityGroupEgress`, `RevokeSecurityGroupIngress`. Whole-request validation, durable desired-state admission and reconciliation scheduling. Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable. #### What counts toward latency For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded. #### Endpoint reachability and request failures The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy. Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results. #### Scaling and target-service capacity Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA. #### Data and behavior guarantees The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state. #### Example and diagnosis Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed. ### VPC to Scaleway VPC **SLA status:** Not applicable This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. ### VPC to Tensor9 Trivial **SLA status:** Not applicable This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider's networking terms apply. ## Install and run The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin: ```sh theme={null} tensor9 adapt svc list \ -origin aws::1.0.0::vpc ``` The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request. Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction. ## Existing data and credentials Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target. ## Configure, tune and debug Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction. For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.