> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CloudTrail

> CloudTrail APIs with Cloud Adapter.

Preview

This page describes how CloudTrail maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Akamai
* Azure
* DigitalOcean
* Google Cloud
* Private Kubernetes
* Scaleway

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of CloudTrail with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

#### Runtime surface

| Capability | CloudTrail | Akamai, Azure, DigitalOcean, Private Kubernetes, and Scaleway | Google Cloud |
| - | - | - | - |
| Control-plane audit trail | Yes | Partial - records the original requests your application makes through the Cloud Adapter; activity outside the Cloud Adapter is not recorded | Partial - records the original requests your application makes through the Cloud Adapter; activity outside the Cloud Adapter is not recorded |
| Data-event logging · S3 object / function data-plane access | Yes | Partial - event selectors choose which recorded requests a trail delivers; data events appear in delivery, not in LookupEvents | Partial - event selectors choose which recorded requests a trail delivers; data events appear in delivery, not in LookupEvents |
| Multi-region coverage | Yes | No - a trail covers its own account and region; IsMultiRegionTrail=true is refused | No - a trail covers its own account and region; IsMultiRegionTrail=true is refused |
| Log-file integrity validation | Yes | No - no CloudTrail digest-file chain; EnableLogFileValidation=true is refused | No - no CloudTrail digest-file chain; EnableLogFileValidation=true is refused |
| API coverage | full | partial | partial |

#### Management surface

| Capability | CloudTrail | Akamai, Azure, DigitalOcean, Private Kubernetes, and Scaleway | Google Cloud |
| - | - | - | - |
| Organization trail | Yes | No - IsOrganizationTrail=true is refused | No - IsOrganizationTrail=true is refused |
| Retention and export | Yes | Partial - delivery to the S3 bucket the trail names; KMS, SNS and CloudWatch Logs destinations are refused | Partial - delivery to the S3 bucket the trail names; KMS, SNS and CloudWatch Logs destinations are refused |

## On Akamai, Azure, DigitalOcean, Private Kubernetes, and Scaleway

### Kubernetes Audit Log

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| PutEventSelectors / GetEventSelectors | Data events | Partial | Most usage | stores the trail's selectors, which choose the recorded requests it delivers; only requests made through the Cloud Adapter are recorded |
| LookupEvents | History reads | Partial | Common | answered from Tensor9's own durable history of the original requests your application made through the Cloud Adapter; management events only, filtered by a subset of LookupAttributes |
| PutInsightSelectors / GetInsightSelectors | Insights | Out of scope | Full surface | CloudTrail Insights anomaly detection is not offered |
| ListPublicKeys (log-file validation) | Integrity | Out of scope | Full surface | the CloudTrail digest-file chain is not offered; EnableLogFileValidation=true is refused |
| StartLogging / StopLogging | Logging control | Adapter-served | Most usage | starts or stops delivery for that trail; the account's event history keeps recording |
| AddTags / RemoveTags / ListTags | Tags | Adapter-served | Full surface | stores and returns the trail's tags |
| CreateTrail | Trail config | Partial | Common | creates a trail that delivers to the S3 bucket it names; multi-region, organization, log-file validation, KMS, SNS and CloudWatch Logs settings are refused rather than ignored |
| DeleteTrail | Trail config | Adapter-served | Most usage | removes the trail; the account's event history is kept |
| DescribeTrails | Trail config | Adapter-served | Common | returns the trails stored for this account and region |
| GetTrail | Trail config | Adapter-served | Common | returns the stored trail definition |
| GetTrailStatus | Trail config | Adapter-served | Most usage | reports whether the trail is delivering and when it last delivered |
| UpdateTrail | Trail config | Partial | Most usage | changes the trail's destination and supported settings; the settings CreateTrail refuses are refused here too |

#### How it works

On AWS, CloudTrail records who called which API, when, and from where. When your Install selects CloudTrail, **Tensor9 runs the CloudTrail API itself**. Every AWS request your application makes goes through the Cloud Adapter, which records the original request, its verified caller, its time and its outcome in a **durable history**. `LookupEvents` reads that history, and each trail you create with `CreateTrail` delivers its selected events to the S3 bucket it names.

CloudTrail is **Preview**: it is selected explicitly for an Install and qualified first on Google Cloud. Requests that do not pass through the Cloud Adapter, such as console sign-ins or direct calls to the cloud's own APIs, are not in this history.

* **Your requests, as you made them.** Each event is the original AWS request your application sent through the Cloud Adapter, with the verified caller, not the service account Tensor9 uses underneath.
* **One history, many trails.** The history records continuously. Trails choose what they deliver, and stopping or deleting a trail does not erase the history.
* **Selected explicitly.** CloudTrail runs only in an Install that selects it.

![Your application's AWS SDK calls go through the Tensor9 Cloud Adapter, which records each original request with its verified caller, time and outcome in a durable history. LookupEvents reads that history, and each trail delivers its selected events to the S3 bucket it names. The cloud's own audit log is separate, and you turn it on.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE0IiB2aWV3Qm94PSIwIDAgODM2IDIxNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uJ3MgQVdTIFNESyBjYWxscyBnbyB0aHJvdWdoIHRoZSBUZW5zb3I5IENsb3VkIEFkYXB0ZXIsIHdoaWNoIHJlY29yZHMgZWFjaCBvcmlnaW5hbCByZXF1ZXN0IHdpdGggaXRzIHZlcmlmaWVkIGNhbGxlciwgdGltZSBhbmQgb3V0Y29tZSBpbiBhIGR1cmFibGUgaGlzdG9yeS4gTG9va3VwRXZlbnRzIHJlYWRzIHRoYXQgaGlzdG9yeSwgYW5kIGVhY2ggdHJhaWwgZGVsaXZlcnMgaXRzIHNlbGVjdGVkIGV2ZW50cyB0byB0aGUgUzMgYnVja2V0IGl0IG5hbWVzLiBUaGUgY2xvdWQncyBvd24gYXVkaXQgbG9nIGlzIHNlcGFyYXRlLCBhbmQgeW91IHR1cm4gaXQgb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImN0LWh3IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI2NCIgd2lkdGg9IjEzMiIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4MiIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij55b3VyIGFwcGxpY2F0aW9uPC90ZXh0Pgo8dGV4dCB4PSI4MiIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPkFXUyBTREsgY2FsbHM8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSI5NCIgeDI9IjIwMCIgeTI9Ijk0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjA0IiB5PSI0MCIgd2lkdGg9IjQwNCIgaGVpZ2h0PSIxMTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjIwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+VEVOU09SOSBDTE9VRCBBREFQVEVSIMK3IElOU0lERSBZT1VSIElOU1RBTEw8L3RleHQ+CjxyZWN0IHg9IjIyMCIgeT0iNzIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iMjk1IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMXB4Ij5yZWNvcmRzIHRoZSBvcmlnaW5hbDwvdGV4dD4KPHRleHQgeD0iMjk1IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmNhbGxlciDCtyB0aW1lIMK3IG91dGNvbWU8L3RleHQ+CjxsaW5lIHgxPSIzNzAiIHkxPSIxMDMiIHgyPSI0MjIiIHkyPSIxMDMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjdC1odykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI0MjYiIHk9IjcyIiB3aWR0aD0iMTY2IiBoZWlnaHQ9IjYyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjUwOSIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTFweCI+ZHVyYWJsZSBoaXN0b3J5PC90ZXh0Pgo8dGV4dCB4PSI1MDkiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Q2xvdWRUcmFpbCBldmVudHM8L3RleHQ+CjxsaW5lIHgxPSI1OTIiIHkxPSI4OCIgeDI9IjY1MCIgeTI9IjcwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPGxpbmUgeDE9IjU5MiIgeTE9IjExOCIgeDI9IjY1MCIgeTI9IjEzNiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2N0LWh3KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjY1NCIgeT0iNDAiIHdpZHRoPSIxNjYiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzM3IiB5PSI2MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4Ij5Mb29rdXBFdmVudHM8L3RleHQ+Cjx0ZXh0IHg9IjczNyIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnJlYWRzIHRoZSBoaXN0b3J5PC90ZXh0Pgo8cmVjdCB4PSI2NTQiIHk9IjExMiIgd2lkdGg9IjE2NiIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3MzciIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4Ij50cmFpbCBkZWxpdmVyeTwvdGV4dD4KPHRleHQgeD0iNzM3IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnRvIHRoZSBTMyBidWNrZXQgaXQgbmFtZXM8L3RleHQ+CjxyZWN0IHg9IjIwNCIgeT0iMTcwIiB3aWR0aD0iNDA0IiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDA2IiB5PSIxOTEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+dGhlIGNsb3VkJ3Mgb3duIGF1ZGl0IGxvZyDCtyBzZXBhcmF0ZSDCtyB0dXJuZWQgb24gYnkgeW91IHdpdGggdGhhdCBjbG91ZCdzIHRvb2xzPC90ZXh0Pgo8L3N2Zz4=)

![Your application's AWS SDK calls go through the Tensor9 Cloud Adapter, which records each original request with its verified caller, time and outcome in a durable history. LookupEvents reads that history, and each trail delivers its selected events to the S3 bucket it names. The cloud's own audit log is separate, and you turn it on.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE0IiB2aWV3Qm94PSIwIDAgODM2IDIxNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uJ3MgQVdTIFNESyBjYWxscyBnbyB0aHJvdWdoIHRoZSBUZW5zb3I5IENsb3VkIEFkYXB0ZXIsIHdoaWNoIHJlY29yZHMgZWFjaCBvcmlnaW5hbCByZXF1ZXN0IHdpdGggaXRzIHZlcmlmaWVkIGNhbGxlciwgdGltZSBhbmQgb3V0Y29tZSBpbiBhIGR1cmFibGUgaGlzdG9yeS4gTG9va3VwRXZlbnRzIHJlYWRzIHRoYXQgaGlzdG9yeSwgYW5kIGVhY2ggdHJhaWwgZGVsaXZlcnMgaXRzIHNlbGVjdGVkIGV2ZW50cyB0byB0aGUgUzMgYnVja2V0IGl0IG5hbWVzLiBUaGUgY2xvdWQncyBvd24gYXVkaXQgbG9nIGlzIHNlcGFyYXRlLCBhbmQgeW91IHR1cm4gaXQgb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImN0LWh3IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI2NCIgd2lkdGg9IjEzMiIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4MiIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij55b3VyIGFwcGxpY2F0aW9uPC90ZXh0Pgo8dGV4dCB4PSI4MiIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPkFXUyBTREsgY2FsbHM8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSI5NCIgeDI9IjIwMCIgeTI9Ijk0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjA0IiB5PSI0MCIgd2lkdGg9IjQwNCIgaGVpZ2h0PSIxMTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMjIwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+VEVOU09SOSBDTE9VRCBBREFQVEVSIMK3IElOU0lERSBZT1VSIElOU1RBTEw8L3RleHQ+CjxyZWN0IHg9IjIyMCIgeT0iNzIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjk1IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMXB4Ij5yZWNvcmRzIHRoZSBvcmlnaW5hbDwvdGV4dD4KPHRleHQgeD0iMjk1IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmNhbGxlciDCtyB0aW1lIMK3IG91dGNvbWU8L3RleHQ+CjxsaW5lIHgxPSIzNzAiIHkxPSIxMDMiIHgyPSI0MjIiIHkyPSIxMDMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjdC1odykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI0MjYiIHk9IjcyIiB3aWR0aD0iMTY2IiBoZWlnaHQ9IjYyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjUwOSIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTFweCI+ZHVyYWJsZSBoaXN0b3J5PC90ZXh0Pgo8dGV4dCB4PSI1MDkiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Q2xvdWRUcmFpbCBldmVudHM8L3RleHQ+CjxsaW5lIHgxPSI1OTIiIHkxPSI4OCIgeDI9IjY1MCIgeTI9IjcwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPGxpbmUgeDE9IjU5MiIgeTE9IjExOCIgeDI9IjY1MCIgeTI9IjEzNiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2N0LWh3KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjY1NCIgeT0iNDAiIHdpZHRoPSIxNjYiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzM3IiB5PSI2MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4Ij5Mb29rdXBFdmVudHM8L3RleHQ+Cjx0ZXh0IHg9IjczNyIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnJlYWRzIHRoZSBoaXN0b3J5PC90ZXh0Pgo8cmVjdCB4PSI2NTQiIHk9IjExMiIgd2lkdGg9IjE2NiIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3MzciIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4Ij50cmFpbCBkZWxpdmVyeTwvdGV4dD4KPHRleHQgeD0iNzM3IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnRvIHRoZSBTMyBidWNrZXQgaXQgbmFtZXM8L3RleHQ+CjxyZWN0IHg9IjIwNCIgeT0iMTcwIiB3aWR0aD0iNDA0IiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDA2IiB5PSIxOTEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+dGhlIGNsb3VkJ3Mgb3duIGF1ZGl0IGxvZyDCtyBzZXBhcmF0ZSDCtyB0dXJuZWQgb24gYnkgeW91IHdpdGggdGhhdCBjbG91ZCdzIHRvb2xzPC90ZXh0Pgo8L3N2Zz4=)

Tensor9 records the requests made through the Cloud Adapter and answers CloudTrail from that history; the cloud's own audit log is separate.

#### Reading history (LookupEvents)

`LookupEvents` answers from Tensor9's history in the CloudTrail response shape: event ID, name, source, time, caller and the resources involved. It returns management events and supports a subset of `LookupAttributes`, paging with a `NextToken` that stays bound to your account and region. Data events are delivered by trails rather than returned by `LookupEvents`, as on AWS.

If the history could not record some requests, for example while its database was unreachable, those requests are reported as a gap instead of silently missing, and `LookupEvents` does not present the history as complete across that gap.

* **Caller identity is the verified one.** An unauthenticated or rejected request is recorded with an unknown caller, not the identity it asserted.
* **Gaps are explicit.** Your other services keep working while CloudTrail records a gap.

#### Trails, logging and delivery

`CreateTrail` stores a trail that delivers to the S3 bucket it names; that bucket is provided by your Install like any other S3 bucket. `StartLogging` and `StopLogging` start and stop that trail's delivery, `GetTrailStatus` reports whether it is delivering, and `PutEventSelectors` chooses which recorded requests it delivers. `DescribeTrails`, `GetTrail`, `ListTrails`, `UpdateTrail`, `DeleteTrail` and the trail tag calls work on the stored trails.

Each delivered batch has a fixed object key, so if the delivery restarts partway it writes the same object again instead of a duplicate.

* **Rejected, not ignored.** Multi-region and organization trails, log-file validation, and KMS, SNS or CloudWatch Logs settings are rejected with an error.
* **StopLogging stops one trail.** The history keeps recording, and other trails keep delivering.

#### Your cloud's own audit log

Each cloud also keeps its own audit log of calls made to its APIs, such as Google Cloud Audit Logs or a Kubernetes cluster's API-server audit log. That log is separate from Tensor9's CloudTrail history and records the cloud's own API calls under the cloud's own identities. Customers who want it turn it on directly with that cloud's normal tools, for example the Google Cloud Audit Logs Data Access settings. Tensor9 does not read or configure it.

#### Limitations

Check these differences from AWS CloudTrail against your workload.

Where Tensor9's CloudTrail differs from AWS

* **Activity outside the Cloud Adapter is not recorded.** Console sign-ins, direct calls to the cloud's own APIs and other non-API activity do not appear in the history.
* **LookupEvents behaves differently: it supports a subset of filters.** A subset of `LookupAttributes` is supported, and only management events are returned.
* **Multi-region and organization trails are not supported.** A trail covers its own account and region; `IsMultiRegionTrail` or `IsOrganizationTrail` set to true is rejected.
* **Only S3 delivery is supported.** KMS encryption, SNS notification and CloudWatch Logs delivery settings are rejected.
* **CloudTrail Insights and Lake are not supported.** `PutInsightSelectors` / `GetInsightSelectors` anomaly detection and event data stores are not offered.
* **Log-file integrity validation is not supported.** `EnableLogFileValidation` set to true is rejected, and `ListPublicKeys` is not offered.
* **Existing AWS history is not migrated.** Your AWS trail history stays in its S3 bucket on AWS; Tensor9's history starts when the Install selects CloudTrail.
* **CloudTrail is in Preview.** It is qualified first on Google Cloud; delivery over TLS, other clouds and the service levels are still being qualified.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### CloudTrail management audit records · Management audit events

Feature: CloudTrail management audit records.

Estimated monthly service charges by Management audit events. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![CloudTrail management audit records · Management audit events: monthly service charges by Management audit events. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/99b98e35c2dfd98b55cd3ef08f5613a24d863586dd0be7344e0e8bf85b06f9e2-light.svg)

![CloudTrail management audit records · Management audit events: monthly service charges by Management audit events. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/9752721da5a2e1c40687538c339f57103fb2ab7a965611aa02f8dc26576d0ae5-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Management audit events (events/s) | CloudTrail | Target scenario | Kubernetes Audit Log | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.02 | Kubernetes Audit Log (one copy) | 80.90 | 80.87 |
| 0 | 0.02 | Kubernetes Audit Log (two copies) | 161.79 | 161.77 |
| 1 | 0.02 | Kubernetes Audit Log (one copy) | 80.97 | 80.94 |
| 1 | 0.02 | Kubernetes Audit Log (two copies) | 161.86 | 161.84 |
| 10 | 0.02 | Kubernetes Audit Log (one copy) | 81.60 | 81.58 |
| 10 | 0.02 | Kubernetes Audit Log (two copies) | 162.50 | 162.48 |
| 100 | 0.02 | Kubernetes Audit Log (one copy) | 412.31 | 412.29 |
| 100 | 0.02 | Kubernetes Audit Log (two copies) | 817.54 | 817.52 |
| 1,000 | 0.02 | Kubernetes Audit Log (one copy) | 4,466.33 | 4,466.30 |
| 1,000 | 0.02 | Kubernetes Audit Log (two copies) | 8,861.87 | 8,861.85 |
| 10,000 | 0.02 | Kubernetes Audit Log (one copy) | 11,121.38 | 11,121.35 |
| 10,000 | 0.02 | Kubernetes Audit Log (two copies) | 21,534.91 | 21,534.89 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 events/s to 96 vCPU, 624 GiB memory and 62,682 GiB SSD at 10,000 events/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Audit Log (one copy) | Origin list price · Selected logical management audit events | 0 | USD/events |
| Kubernetes Audit Log (one copy) | Origin list price · Paid management-event delivery copies | 0.00002 | USD/copy-events |
| Kubernetes Audit Log (one copy) | Origin list price · Native management-event history lookups | 0 | USD/requests |
| Kubernetes Audit Log (one copy) | Origin list price · Selected source audit archive storage | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Representative management event | 1,024 | bytes/event |
| Kubernetes Audit Log (one copy) | Log-store writes per management event | 1 | operations/event |
| Kubernetes Audit Log (one copy) | Log-store records scanned per native lookup | 1,000 | records/lookup |
| Kubernetes Audit Log (one copy) | Kubernetes active log/index window | 730 | hours |
| Kubernetes Audit Log (one copy) | Physical log/index bytes per payload byte | 2 | multiplier |
| Kubernetes Audit Log (one copy) | Selected dependent archive fraction | 1 | fraction |
| Kubernetes Audit Log (one copy) | Selected dependent archive retention | 730 | hours |
| Kubernetes Audit Log (one copy) | Management records per archive object | 1,000 | records/object |
| Kubernetes Audit Log (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Audit Log (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Audit Log (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Audit Log (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Audit Log (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Audit Log (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Audit Log (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Audit Log (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Audit Log (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Audit Log (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Audit Log (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Audit Log (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Audit Log (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Audit Log (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Audit Log (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Audit Log (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Audit Log (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Audit Log (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Audit Log (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Audit Log (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Audit Log (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Audit Log (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Audit Log (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Audit Log (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Audit Log (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Audit Log (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Audit Log (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Audit Log (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Audit Log (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Audit Log (two copies) | Origin list price · Selected logical management audit events | 0 | USD/events |
| Kubernetes Audit Log (two copies) | Origin list price · Paid management-event delivery copies | 0.00002 | USD/copy-events |
| Kubernetes Audit Log (two copies) | Origin list price · Native management-event history lookups | 0 | USD/requests |
| Kubernetes Audit Log (two copies) | Origin list price · Selected source audit archive storage | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Representative management event | 1,024 | bytes/event |
| Kubernetes Audit Log (two copies) | Log-store writes per management event | 1 | operations/event |
| Kubernetes Audit Log (two copies) | Log-store records scanned per native lookup | 1,000 | records/lookup |
| Kubernetes Audit Log (two copies) | Kubernetes active log/index window | 730 | hours |
| Kubernetes Audit Log (two copies) | Physical log/index bytes per payload byte | 2 | multiplier |
| Kubernetes Audit Log (two copies) | Selected dependent archive fraction | 1 | fraction |
| Kubernetes Audit Log (two copies) | Selected dependent archive retention | 730 | hours |
| Kubernetes Audit Log (two copies) | Management records per archive object | 1,000 | records/object |
| Kubernetes Audit Log (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Audit Log (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Audit Log (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Audit Log (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Audit Log (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Audit Log (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Audit Log (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Audit Log (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Audit Log (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Audit Log (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Audit Log (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Audit Log (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Audit Log (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Audit Log (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Audit Log (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Audit Log (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Audit Log (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Audit Log (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Audit Log (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Audit Log (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Audit Log (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Audit Log (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Audit Log (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Audit Log (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Audit Log (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Audit Log (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Audit Log (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Audit Log (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Audit Log (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* Declared native management-audit comparison: the estimate covers selected native log resources and dependent archives. It establishes no runtime adapter, compiled-deployment availability or full CloudTrail feature equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* This recipe accepts management events and native history lookups only. Free first-copy events remain physical workload even with zero paid copies.
* Kubernetes audit policy and its selected log/index backend own the self-operated allocation, which is not a SQL service. The optional PostgreSQL history store prices CloudTrail's own audit-family database; neither is the runtime adapter-state database.
* CloudTrail is a free foundation in the default license profiles, so its Tensor9 fee is zero when entered; selection stays explicit. Target resources are cost of goods for installations that select it. Since the 2026-10-20 fold the history store runs inside sipsvr: adapter hosting is a share of sipsvr, with no separate worker or placement-controller allocation.
* Source archive GiB-months, native event quantities, paid delivery-copy units, primary retained state and dependent archives are independent resource roles.
* Retained data assumes steady average arrivals over a 730-hour month; event mix, burst concentration and retention policy require separate workload qualification.
* The default includes one selected dependent archive copy. Disabling it does not establish a free all-inclusive installation; hosting and fees remain separately supplied or unknown.
* Self-operated Kubernetes management-audit log/index allocation (Kubernetes, Apache-2.0): bounded CPU, RAM and retained physical disk, not a SQL service or adapter-state database. Audit policy, event payload and native-history scan work are explicit hypotheses; no cluster, log backend or query-capacity qualification is implied. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSCloudTrail offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json)
* AWS CloudTrail pricing: [https://aws.amazon.com/cloudtrail/pricing/](https://aws.amazon.com/cloudtrail/pricing/)
* AWS Price List API, AmazonS3 offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Data-event collection, CloudTrail Insights, digest validation and custom SIEM queries.
* Source archive PUT/retrieval charges, archive queries, network egress, archive encryption, source/target cluster workloads and cross-region aggregation.
* Native feature fidelity and query behavior remain the directed profile's separate qualifications; no recipe promotes a declared mapping to delivered support.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-335870c96376023a59ef2519b714864964e29890` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AWSCloudTrail offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json), [AWS CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/), [AWS Price List API, AmazonS3 offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

##### CloudTrail management audit records · Native event-history lookups

Feature: CloudTrail management audit records.

Estimated monthly service charges by Native event-history lookups. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![CloudTrail management audit records · Native event-history lookups: monthly service charges by Native event-history lookups. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/162aef9fab54064c07b98fecbf442fb68ec2529fc0970ad2c084342e37e7db1a-light.svg)

![CloudTrail management audit records · Native event-history lookups: monthly service charges by Native event-history lookups. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/edfe7243bcd1f840fbc3d9906d7422cedbe57614cb30d890e357869b1d3c20bf-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Native event-history lookups (lookups/s) | CloudTrail | Target scenario | Kubernetes Audit Log | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.02 | Kubernetes Audit Log (one copy) | 80.92 | 80.90 |
| 0 | 0.02 | Kubernetes Audit Log (two copies) | 161.82 | 161.80 |
| 1 | 0.02 | Kubernetes Audit Log (one copy) | 80.92 | 80.90 |
| 1 | 0.02 | Kubernetes Audit Log (two copies) | 161.82 | 161.80 |
| 10 | 0.02 | Kubernetes Audit Log (one copy) | 1,144.37 | 1,144.34 |
| 10 | 0.02 | Kubernetes Audit Log (two copies) | 2,288.70 | 2,288.68 |
| 100 | 0.02 | Kubernetes Audit Log (one copy) | Unpriced | Unavailable |
| 100 | 0.02 | Kubernetes Audit Log (two copies) | Unpriced | Unavailable |
| 1,000 | 0.02 | Kubernetes Audit Log (one copy) | Unpriced | Unavailable |
| 1,000 | 0.02 | Kubernetes Audit Log (two copies) | Unpriced | Unavailable |
| 10,000 | 0.02 | Kubernetes Audit Log (one copy) | Unpriced | Unavailable |
| 10,000 | 0.02 | Kubernetes Audit Log (two copies) | Unpriced | Unavailable |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 lookups/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10 lookups/s. From 100 lookups/s the workload exceeds the planning range and the target is unpriced.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Kubernetes Audit Log (one copy) | Origin list price · Selected logical management audit events | 0 | USD/events |
| Kubernetes Audit Log (one copy) | Origin list price · Paid management-event delivery copies | 0.00002 | USD/copy-events |
| Kubernetes Audit Log (one copy) | Origin list price · Native management-event history lookups | 0 | USD/requests |
| Kubernetes Audit Log (one copy) | Origin list price · Selected source audit archive storage | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Representative management event | 1,024 | bytes/event |
| Kubernetes Audit Log (one copy) | Log-store writes per management event | 1 | operations/event |
| Kubernetes Audit Log (one copy) | Log-store records scanned per native lookup | 1,000 | records/lookup |
| Kubernetes Audit Log (one copy) | Kubernetes active log/index window | 730 | hours |
| Kubernetes Audit Log (one copy) | Physical log/index bytes per payload byte | 2 | multiplier |
| Kubernetes Audit Log (one copy) | Selected dependent archive fraction | 1 | fraction |
| Kubernetes Audit Log (one copy) | Selected dependent archive retention | 730 | hours |
| Kubernetes Audit Log (one copy) | Management records per archive object | 1,000 | records/object |
| Kubernetes Audit Log (one copy) | Target price guess · read | 0 | USD/read |
| Kubernetes Audit Log (one copy) | Target price guess · write | 0 | USD/write |
| Kubernetes Audit Log (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Audit Log (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Audit Log (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Audit Log (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Audit Log (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Audit Log (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Audit Log (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Audit Log (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Audit Log (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Audit Log (one copy) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Audit Log (one copy) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Audit Log (one copy) | Target monthly base charge | 0 | USD/month |
| Kubernetes Audit Log (one copy) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Audit Log (one copy) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Audit Log (one copy) | Minimum primary RAM | 8 | GiB |
| Kubernetes Audit Log (one copy) | Minimum primary disk | 100 | GiB |
| Kubernetes Audit Log (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Kubernetes Audit Log (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Audit Log (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Audit Log (one copy) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Audit Log (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Audit Log (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Audit Log (one copy) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Audit Log (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Audit Log (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Audit Log (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Audit Log (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Kubernetes Audit Log (two copies) | Origin list price · Selected logical management audit events | 0 | USD/events |
| Kubernetes Audit Log (two copies) | Origin list price · Paid management-event delivery copies | 0.00002 | USD/copy-events |
| Kubernetes Audit Log (two copies) | Origin list price · Native management-event history lookups | 0 | USD/requests |
| Kubernetes Audit Log (two copies) | Origin list price · Selected source audit archive storage | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Representative management event | 1,024 | bytes/event |
| Kubernetes Audit Log (two copies) | Log-store writes per management event | 1 | operations/event |
| Kubernetes Audit Log (two copies) | Log-store records scanned per native lookup | 1,000 | records/lookup |
| Kubernetes Audit Log (two copies) | Kubernetes active log/index window | 730 | hours |
| Kubernetes Audit Log (two copies) | Physical log/index bytes per payload byte | 2 | multiplier |
| Kubernetes Audit Log (two copies) | Selected dependent archive fraction | 1 | fraction |
| Kubernetes Audit Log (two copies) | Selected dependent archive retention | 730 | hours |
| Kubernetes Audit Log (two copies) | Management records per archive object | 1,000 | records/object |
| Kubernetes Audit Log (two copies) | Target price guess · read | 0 | USD/read |
| Kubernetes Audit Log (two copies) | Target price guess · write | 0 | USD/write |
| Kubernetes Audit Log (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Kubernetes Audit Log (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Kubernetes Audit Log (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Kubernetes Audit Log (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Kubernetes Audit Log (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Kubernetes Audit Log (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Kubernetes Audit Log (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Kubernetes Audit Log (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Kubernetes Audit Log (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Kubernetes Audit Log (two copies) | Target price guess · input token | 0 | USD/input token |
| Kubernetes Audit Log (two copies) | Target price guess · output token | 0 | USD/output token |
| Kubernetes Audit Log (two copies) | Target monthly base charge | 0 | USD/month |
| Kubernetes Audit Log (two copies) | Approximate target service minimum | 0 | USD/month |
| Kubernetes Audit Log (two copies) | Minimum primary CPU | 2 | vCPU |
| Kubernetes Audit Log (two copies) | Minimum primary RAM | 8 | GiB |
| Kubernetes Audit Log (two copies) | Minimum primary disk | 100 | GiB |
| Kubernetes Audit Log (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Kubernetes Audit Log (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Kubernetes Audit Log (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Kubernetes Audit Log (two copies) | Planning peak / mean work | 2 | multiplier |
| Kubernetes Audit Log (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Kubernetes Audit Log (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Kubernetes Audit Log (two copies) | Planning disk utilization | 0.8 | fraction |
| Kubernetes Audit Log (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Kubernetes Audit Log (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Kubernetes Audit Log (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Kubernetes Audit Log (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Kubernetes Audit Log (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* Declared native management-audit comparison: the estimate covers selected native log resources and dependent archives. It establishes no runtime adapter, compiled-deployment availability or full CloudTrail feature equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* This recipe accepts management events and native history lookups only. Free first-copy events remain physical workload even with zero paid copies.
* Kubernetes audit policy and its selected log/index backend own the self-operated allocation, which is not a SQL service. The optional PostgreSQL history store prices CloudTrail's own audit-family database; neither is the runtime adapter-state database.
* CloudTrail is a free foundation in the default license profiles, so its Tensor9 fee is zero when entered; selection stays explicit. Target resources are cost of goods for installations that select it. Since the 2026-10-20 fold the history store runs inside sipsvr: adapter hosting is a share of sipsvr, with no separate worker or placement-controller allocation.
* Source archive GiB-months, native event quantities, paid delivery-copy units, primary retained state and dependent archives are independent resource roles.
* Retained data assumes steady average arrivals over a 730-hour month; event mix, burst concentration and retention policy require separate workload qualification.
* The default includes one selected dependent archive copy. Disabling it does not establish a free all-inclusive installation; hosting and fees remain separately supplied or unknown.
* Self-operated Kubernetes management-audit log/index allocation (Kubernetes, Apache-2.0): bounded CPU, RAM and retained physical disk, not a SQL service or adapter-state database. Audit policy, event payload and native-history scan work are explicit hypotheses; no cluster, log backend or query-capacity qualification is implied. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AWSCloudTrail offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json)
* AWS CloudTrail pricing: [https://aws.amazon.com/cloudtrail/pricing/](https://aws.amazon.com/cloudtrail/pricing/)
* AWS Price List API, AmazonS3 offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Data-event collection, CloudTrail Insights, digest validation and custom SIEM queries.
* Source archive PUT/retrieval charges, archive queries, network egress, archive encryption, source/target cluster workloads and cross-region aggregation.
* Native feature fidelity and query behavior remain the directed profile's separate qualifications; no recipe promotes a declared mapping to delivered support.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-335870c96376023a59ef2519b714864964e29890` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, AWSCloudTrail offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json), [AWS CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/), [AWS Price List API, AmazonS3 offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

**CloudTrail management audit records → Kubernetes Audit Log: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Selected logical management audit events | 0.00 |
| Origin: Paid management-event delivery copies | 0.00 |
| Origin: Native management-event history lookups | 0.00 |
| Origin: Selected source audit archive storage | 0.02 |
| Target: Provisioned primary CPU | 46.15 |
| Target: Provisioned primary RAM | 24.74 |
| Target: Provisioned primary disk | 10.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent provisioned resources | 0.00 |
| Target: Independent managed resources | 0.00 |
| Target: Dependent object sink retained data | 0.02 |
| Target: Dependent object sink writes | 0.01 |
| **Origin service subtotal** | **0.02** |
| **Target service subtotal** | **80.92** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Data-event collection, CloudTrail Insights, digest validation and custom SIEM queries.
* Source archive PUT/retrieval charges, archive queries, network egress, archive encryption, source/target cluster workloads and cross-region aggregation.
* Native feature fidelity and query behavior remain the directed profile's separate qualifications; no recipe promotes a declared mapping to delivered support.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Selected logical management audit events | 0 | USD/events |
| Origin list price · Paid management-event delivery copies | 0.00002 | USD/copy-events |
| Origin list price · Native management-event history lookups | 0 | USD/requests |
| Origin list price · Selected source audit archive storage | 0.023 | USD/GiB-month |
| Representative management event | 1,024 | bytes/event |
| Log-store writes per management event | 1 | operations/event |
| Log-store records scanned per native lookup | 1,000 | records/lookup |
| Kubernetes active log/index window | 730 | hours |
| Physical log/index bytes per payload byte | 2 | multiplier |
| Selected dependent archive fraction | 1 | fraction |
| Selected dependent archive retention | 730 | hours |
| Management records per archive object | 1,000 | records/object |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Selected logical management audit events | 1,000,000 | events |
| Paid management-event delivery copies | 0 | copy-events |
| Native management-event history lookups | 1,000 | requests |
| Selected source audit archive storage | 1 | GiB-month |

* Translated reads: 1,000,000 operations.

* Translated writes: 1,000,000 operations.

* Translated resident physical data: 1.907 GiB-month.

* Native provider operations: 0 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0.9537 GiB-month.

* Dependent object sink writes: 1,000 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* Declared native management-audit comparison: the estimate covers selected native log resources and dependent archives. It establishes no runtime adapter, compiled-deployment availability or full CloudTrail feature equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* This recipe accepts management events and native history lookups only. Free first-copy events remain physical workload even with zero paid copies.

* Kubernetes audit policy and its selected log/index backend own the self-operated allocation, which is not a SQL service. The optional PostgreSQL history store prices CloudTrail's own audit-family database; neither is the runtime adapter-state database.

* CloudTrail is a free foundation in the default license profiles, so its Tensor9 fee is zero when entered; selection stays explicit. Target resources are cost of goods for installations that select it. Since the 2026-10-20 fold the history store runs inside sipsvr: adapter hosting is a share of sipsvr, with no separate worker or placement-controller allocation.

* Source archive GiB-months, native event quantities, paid delivery-copy units, primary retained state and dependent archives are independent resource roles.

* Retained data assumes steady average arrivals over a 730-hour month; event mix, burst concentration and retention policy require separate workload qualification.

* The default includes one selected dependent archive copy. Disabling it does not establish a free all-inclusive installation; hosting and fees remain separately supplied or unknown.

* Self-operated Kubernetes management-audit log/index allocation (Kubernetes, Apache-2.0): bounded CPU, RAM and retained physical disk, not a SQL service or adapter-state database. Audit policy, event payload and native-history scan work are explicit hypotheses; no cluster, log backend or query-capacity qualification is implied. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-335870c96376023a59ef2519b714864964e29890` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AWSCloudTrail offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AWSCloudTrail/current/us-east-1/index.json), [AWS CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/), [AWS Price List API, AmazonS3 offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## On Google Cloud

### Cloud Audit Logs

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| PutEventSelectors / GetEventSelectors | Data events | Partial | Most usage | stores the trail's selectors, which choose the recorded requests it delivers; only requests made through the Cloud Adapter are recorded |
| LookupEvents | History reads | Partial | Common | answered from Tensor9's own durable history of the original requests your application made through the Cloud Adapter; management events only, filtered by a subset of LookupAttributes |
| PutInsightSelectors / GetInsightSelectors | Insights | Out of scope | Full surface | CloudTrail Insights anomaly detection is not offered |
| ListPublicKeys (log-file validation) | Integrity | Out of scope | Full surface | the CloudTrail digest-file chain is not offered; EnableLogFileValidation=true is refused |
| StartLogging / StopLogging | Logging control | Adapter-served | Most usage | starts or stops delivery for that trail; the account's event history keeps recording |
| AddTags / RemoveTags / ListTags | Tags | Adapter-served | Full surface | stores and returns the trail's tags |
| CreateTrail | Trail config | Partial | Common | creates a trail that delivers to the S3 bucket it names; multi-region, organization, log-file validation, KMS, SNS and CloudWatch Logs settings are refused rather than ignored |
| DeleteTrail | Trail config | Adapter-served | Most usage | removes the trail; the account's event history is kept |
| DescribeTrails | Trail config | Adapter-served | Common | returns the trails stored for this account and region |
| GetTrail | Trail config | Adapter-served | Common | returns the stored trail definition |
| GetTrailStatus | Trail config | Adapter-served | Most usage | reports whether the trail is delivering and when it last delivered |
| UpdateTrail | Trail config | Partial | Most usage | changes the trail's destination and supported settings; the settings CreateTrail refuses are refused here too |

#### How it works

On AWS, CloudTrail records who called which API, when, and from where. When your Install selects CloudTrail, **Tensor9 runs the CloudTrail API itself**. Every AWS request your application makes goes through the Cloud Adapter, which records the original request, its verified caller, its time and its outcome in a **durable history**. `LookupEvents` reads that history, and each trail you create with `CreateTrail` delivers its selected events to the S3 bucket it names.

CloudTrail is **Preview**: it is selected explicitly for an Install and qualified first on Google Cloud. Requests that do not pass through the Cloud Adapter, such as console sign-ins or direct calls to the cloud's own APIs, are not in this history.

* **Your requests, as you made them.** Each event is the original AWS request your application sent through the Cloud Adapter, with the verified caller, not the service account Tensor9 uses underneath.
* **One history, many trails.** The history records continuously. Trails choose what they deliver, and stopping or deleting a trail does not erase the history.
* **Selected explicitly.** CloudTrail runs only in an Install that selects it.

![Your application's AWS SDK calls go through the Tensor9 Cloud Adapter, which records each original request with its verified caller, time and outcome in a durable history. LookupEvents reads that history, and each trail delivers its selected events to the S3 bucket it names. The cloud's own audit log is separate, and you turn it on.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE0IiB2aWV3Qm94PSIwIDAgODM2IDIxNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uJ3MgQVdTIFNESyBjYWxscyBnbyB0aHJvdWdoIHRoZSBUZW5zb3I5IENsb3VkIEFkYXB0ZXIsIHdoaWNoIHJlY29yZHMgZWFjaCBvcmlnaW5hbCByZXF1ZXN0IHdpdGggaXRzIHZlcmlmaWVkIGNhbGxlciwgdGltZSBhbmQgb3V0Y29tZSBpbiBhIGR1cmFibGUgaGlzdG9yeS4gTG9va3VwRXZlbnRzIHJlYWRzIHRoYXQgaGlzdG9yeSwgYW5kIGVhY2ggdHJhaWwgZGVsaXZlcnMgaXRzIHNlbGVjdGVkIGV2ZW50cyB0byB0aGUgUzMgYnVja2V0IGl0IG5hbWVzLiBUaGUgY2xvdWQncyBvd24gYXVkaXQgbG9nIGlzIHNlcGFyYXRlLCBhbmQgeW91IHR1cm4gaXQgb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImN0LWh3IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI2NCIgd2lkdGg9IjEzMiIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI4MiIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTEuNXB4Ij55b3VyIGFwcGxpY2F0aW9uPC90ZXh0Pgo8dGV4dCB4PSI4MiIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPkFXUyBTREsgY2FsbHM8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSI5NCIgeDI9IjIwMCIgeTI9Ijk0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iMjA0IiB5PSI0MCIgd2lkdGg9IjQwNCIgaGVpZ2h0PSIxMTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjIwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+VEVOU09SOSBDTE9VRCBBREFQVEVSIMK3IElOU0lERSBZT1VSIElOU1RBTEw8L3RleHQ+CjxyZWN0IHg9IjIyMCIgeT0iNzIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iMjk1IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMXB4Ij5yZWNvcmRzIHRoZSBvcmlnaW5hbDwvdGV4dD4KPHRleHQgeD0iMjk1IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPmNhbGxlciDCtyB0aW1lIMK3IG91dGNvbWU8L3RleHQ+CjxsaW5lIHgxPSIzNzAiIHkxPSIxMDMiIHgyPSI0MjIiIHkyPSIxMDMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjdC1odykiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI0MjYiIHk9IjcyIiB3aWR0aD0iMTY2IiBoZWlnaHQ9IjYyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojYTdmM2QwIi8+Cjx0ZXh0IHg9IjUwOSIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTFweCI+ZHVyYWJsZSBoaXN0b3J5PC90ZXh0Pgo8dGV4dCB4PSI1MDkiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Q2xvdWRUcmFpbCBldmVudHM8L3RleHQ+CjxsaW5lIHgxPSI1OTIiIHkxPSI4OCIgeDI9IjY1MCIgeTI9IjcwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPGxpbmUgeDE9IjU5MiIgeTE9IjExOCIgeDI9IjY1MCIgeTI9IjEzNiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2N0LWh3KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjY1NCIgeT0iNDAiIHdpZHRoPSIxNjYiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzM3IiB5PSI2MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4Ij5Mb29rdXBFdmVudHM8L3RleHQ+Cjx0ZXh0IHg9IjczNyIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnJlYWRzIHRoZSBoaXN0b3J5PC90ZXh0Pgo8cmVjdCB4PSI2NTQiIHk9IjExMiIgd2lkdGg9IjE2NiIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3MzciIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4Ij50cmFpbCBkZWxpdmVyeTwvdGV4dD4KPHRleHQgeD0iNzM3IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnRvIHRoZSBTMyBidWNrZXQgaXQgbmFtZXM8L3RleHQ+CjxyZWN0IHg9IjIwNCIgeT0iMTcwIiB3aWR0aD0iNDA0IiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDA2IiB5PSIxOTEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+dGhlIGNsb3VkJ3Mgb3duIGF1ZGl0IGxvZyDCtyBzZXBhcmF0ZSDCtyB0dXJuZWQgb24gYnkgeW91IHdpdGggdGhhdCBjbG91ZCdzIHRvb2xzPC90ZXh0Pgo8L3N2Zz4=)

![Your application's AWS SDK calls go through the Tensor9 Cloud Adapter, which records each original request with its verified caller, time and outcome in a durable history. LookupEvents reads that history, and each trail delivers its selected events to the S3 bucket it names. The cloud's own audit log is separate, and you turn it on.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjE0IiB2aWV3Qm94PSIwIDAgODM2IDIxNCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uJ3MgQVdTIFNESyBjYWxscyBnbyB0aHJvdWdoIHRoZSBUZW5zb3I5IENsb3VkIEFkYXB0ZXIsIHdoaWNoIHJlY29yZHMgZWFjaCBvcmlnaW5hbCByZXF1ZXN0IHdpdGggaXRzIHZlcmlmaWVkIGNhbGxlciwgdGltZSBhbmQgb3V0Y29tZSBpbiBhIGR1cmFibGUgaGlzdG9yeS4gTG9va3VwRXZlbnRzIHJlYWRzIHRoYXQgaGlzdG9yeSwgYW5kIGVhY2ggdHJhaWwgZGVsaXZlcnMgaXRzIHNlbGVjdGVkIGV2ZW50cyB0byB0aGUgUzMgYnVja2V0IGl0IG5hbWVzLiBUaGUgY2xvdWQncyBvd24gYXVkaXQgbG9nIGlzIHNlcGFyYXRlLCBhbmQgeW91IHR1cm4gaXQgb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImN0LWh3IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+CjxyZWN0IHg9IjE2IiB5PSI2NCIgd2lkdGg9IjEzMiIgaGVpZ2h0PSI2MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI4MiIgeT0iOTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTEuNXB4Ij55b3VyIGFwcGxpY2F0aW9uPC90ZXh0Pgo8dGV4dCB4PSI4MiIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPkFXUyBTREsgY2FsbHM8L3RleHQ+CjxsaW5lIHgxPSIxNDgiIHkxPSI5NCIgeDI9IjIwMCIgeTI9Ijk0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iMjA0IiB5PSI0MCIgd2lkdGg9IjQwNCIgaGVpZ2h0PSIxMTIiIHJ4PSIxNCIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMjIwIiB5PSI2MCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+VEVOU09SOSBDTE9VRCBBREFQVEVSIMK3IElOU0lERSBZT1VSIElOU1RBTEw8L3RleHQ+CjxyZWN0IHg9IjIyMCIgeT0iNzIiIHdpZHRoPSIxNTAiIGhlaWdodD0iNjIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjk1IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMXB4Ij5yZWNvcmRzIHRoZSBvcmlnaW5hbDwvdGV4dD4KPHRleHQgeD0iMjk1IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPmNhbGxlciDCtyB0aW1lIMK3IG91dGNvbWU8L3RleHQ+CjxsaW5lIHgxPSIzNzAiIHkxPSIxMDMiIHgyPSI0MjIiIHkyPSIxMDMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNjdC1odykiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI0MjYiIHk9IjcyIiB3aWR0aD0iMTY2IiBoZWlnaHQ9IjYyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjUwOSIgeT0iOTgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTFweCI+ZHVyYWJsZSBoaXN0b3J5PC90ZXh0Pgo8dGV4dCB4PSI1MDkiIHk9IjExNSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Q2xvdWRUcmFpbCBldmVudHM8L3RleHQ+CjxsaW5lIHgxPSI1OTIiIHkxPSI4OCIgeDI9IjY1MCIgeTI9IjcwIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjY3QtaHcpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPGxpbmUgeDE9IjU5MiIgeTE9IjExOCIgeDI9IjY1MCIgeTI9IjEzNiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2N0LWh3KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjY1NCIgeT0iNDAiIHdpZHRoPSIxNjYiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzM3IiB5PSI2MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4Ij5Mb29rdXBFdmVudHM8L3RleHQ+Cjx0ZXh0IHg9IjczNyIgeT0iNzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnJlYWRzIHRoZSBoaXN0b3J5PC90ZXh0Pgo8cmVjdCB4PSI2NTQiIHk9IjExMiIgd2lkdGg9IjE2NiIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3MzciIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4Ij50cmFpbCBkZWxpdmVyeTwvdGV4dD4KPHRleHQgeD0iNzM3IiB5PSIxNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnRvIHRoZSBTMyBidWNrZXQgaXQgbmFtZXM8L3RleHQ+CjxyZWN0IHg9IjIwNCIgeT0iMTcwIiB3aWR0aD0iNDA0IiBoZWlnaHQ9IjM0IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4yIiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDA2IiB5PSIxOTEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+dGhlIGNsb3VkJ3Mgb3duIGF1ZGl0IGxvZyDCtyBzZXBhcmF0ZSDCtyB0dXJuZWQgb24gYnkgeW91IHdpdGggdGhhdCBjbG91ZCdzIHRvb2xzPC90ZXh0Pgo8L3N2Zz4=)

Tensor9 records the requests made through the Cloud Adapter and answers CloudTrail from that history; the cloud's own audit log is separate.

#### Reading history (LookupEvents)

`LookupEvents` answers from Tensor9's history in the CloudTrail response shape: event ID, name, source, time, caller and the resources involved. It returns management events and supports a subset of `LookupAttributes`, paging with a `NextToken` that stays bound to your account and region. Data events are delivered by trails rather than returned by `LookupEvents`, as on AWS.

If the history could not record some requests, for example while its database was unreachable, those requests are reported as a gap instead of silently missing, and `LookupEvents` does not present the history as complete across that gap.

* **Caller identity is the verified one.** An unauthenticated or rejected request is recorded with an unknown caller, not the identity it asserted.
* **Gaps are explicit.** Your other services keep working while CloudTrail records a gap.

#### Trails, logging and delivery

`CreateTrail` stores a trail that delivers to the S3 bucket it names; that bucket is provided by your Install like any other S3 bucket. `StartLogging` and `StopLogging` start and stop that trail's delivery, `GetTrailStatus` reports whether it is delivering, and `PutEventSelectors` chooses which recorded requests it delivers. `DescribeTrails`, `GetTrail`, `ListTrails`, `UpdateTrail`, `DeleteTrail` and the trail tag calls work on the stored trails.

Each delivered batch has a fixed object key, so if the delivery restarts partway it writes the same object again instead of a duplicate.

* **Rejected, not ignored.** Multi-region and organization trails, log-file validation, and KMS, SNS or CloudWatch Logs settings are rejected with an error.
* **StopLogging stops one trail.** The history keeps recording, and other trails keep delivering.

#### Your cloud's own audit log

Each cloud also keeps its own audit log of calls made to its APIs, such as Google Cloud Audit Logs or a Kubernetes cluster's API-server audit log. That log is separate from Tensor9's CloudTrail history and records the cloud's own API calls under the cloud's own identities. Customers who want it turn it on directly with that cloud's normal tools, for example the Google Cloud Audit Logs Data Access settings. Tensor9 does not read or configure it.

#### Limitations

Check these differences from AWS CloudTrail against your workload.

Where Tensor9's CloudTrail differs from AWS

* **Activity outside the Cloud Adapter is not recorded.** Console sign-ins, direct calls to the cloud's own APIs and other non-API activity do not appear in the history.
* **LookupEvents behaves differently: it supports a subset of filters.** A subset of `LookupAttributes` is supported, and only management events are returned.
* **Multi-region and organization trails are not supported.** A trail covers its own account and region; `IsMultiRegionTrail` or `IsOrganizationTrail` set to true is rejected.
* **Only S3 delivery is supported.** KMS encryption, SNS notification and CloudWatch Logs delivery settings are rejected.
* **CloudTrail Insights and Lake are not supported.** `PutInsightSelectors` / `GetInsightSelectors` anomaly detection and event data stores are not offered.
* **Log-file integrity validation is not supported.** `EnableLogFileValidation` set to true is rejected, and `ListPublicKeys` is not offered.
* **Existing AWS history is not migrated.** Your AWS trail history stays in its S3 bucket on AWS; Tensor9's history starts when the Install selects CloudTrail.
* **CloudTrail is in Preview.** It is qualified first on Google Cloud; delivery over TLS, other clouds and the service levels are still being qualified.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::cloudtrail
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.