> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM

> AWS IAM APIs with Cloud Adapter.

This page describes how AWS IAM maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Akamai
* Azure
* DigitalOcean
* Google Cloud
* OCI
* Private Kubernetes
* Scaleway

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of IAM with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | IAM | Akamai, Azure, DigitalOcean, Google Cloud, OCI, Private Kubernetes, and Scaleway · Cedar | Azure · IAM | Google Cloud · IAM | OCI · OCI IAM |
| - | - | - | - | - | - |
| Adaptation mechanism | AWS-managed IAM and STS | Cloud Adapter: IAM and STS requests | Infrastructure only: native permission translation | Infrastructure only: native permission translation | Infrastructure only: native permission translation |
| Access keys and secret keys | AWS account and IAM user credentials | Cloud Adapter deployment-issued logical-account credentials | - | - | - |
| Policy language · authoring | IAM JSON | Supported IAM JSON translated to Cedar | - | - | - |
| Evaluation model · enforcement | Explicit deny overrides allow | Deny-wins in enforce mode | - | - | - |
| Policy consistency · freshness and revocation | AWS-managed propagation | Eventually consistent | - | - | - |
| Explicit deny wins | Yes - native | Yes - Cedar decision; enforce mode blocks | - | - | - |
| Condition keys | Yes | Partial - Time and selected DNS keys; separate trust conditions | - | - | - |
| Permissions boundaries | Yes | No - Not enforced by local Cedar | - | - | - |
| Resource-based policies | Yes | No - No general resource-policy evaluation in this IAM adapter | - | - | - |
| Cross-account role assumption | Yes | Partial - Configured local accounts and caller authorization | - | - | - |
| Organizations SCPs | Yes | No - Not enforced by this authorizer | - | - | - |
| Authorization diagnostics · denial investigation | CloudTrail and Access Analyzer | Denial and would-be-denial diagnostics | - | - | - |
| API coverage | full | high | partial | partial | partial |

## On Akamai, Azure, DigitalOcean, Google Cloud, OCI, Private Kubernetes, and Scaleway

### Cedar

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| CreatePolicy / GetPolicy / ListPolicies / DeletePolicy | Customer-managed policies | Supported | Common | Uses the deployment's customer-managed policy records; the runtime AWS-managed policy catalog is not supplied. |
| CreatePolicyVersion / GetPolicyVersion / ListPolicyVersions / SetDefaultPolicyVersion / DeletePolicyVersion | Customer-managed policies | Supported | Most usage | Maintains policy versions and the default version; up to five versions per policy. |
| TagPolicy / UntagPolicy / ListPolicyTags | Customer-managed policies | Supported | Most usage | - |
| PutRolePolicy / GetRolePolicy / ListRolePolicies / DeleteRolePolicy | Inline role policies | Supported | Common | Validates supported policy syntax; policy changes propagate eventually and may not affect authorization immediately after success. |
| AddRoleToInstanceProfile / RemoveRoleFromInstanceProfile | Instance profiles | Supported | Most usage | Maintains the association used by compute workloads to obtain role credentials. |
| CreateInstanceProfile / GetInstanceProfile / ListInstanceProfiles / ListInstanceProfilesForRole / DeleteInstanceProfile | Instance profiles | Supported | Most usage | - |
| TagInstanceProfile / UntagInstanceProfile / ListInstanceProfileTags | Instance profiles | Supported | Most usage | - |
| CreateOpenIDConnectProvider / GetOpenIDConnectProvider / ListOpenIDConnectProviders / DeleteOpenIDConnectProvider | OIDC providers | Supported | Common | Registers the providers used by web-identity federation. |
| TagOpenIDConnectProvider / UntagOpenIDConnectProvider / ListOpenIDConnectProviderTags | OIDC providers | Supported | Most usage | - |
| UpdateOpenIDConnectProviderThumbprint / AddClientIDToOpenIDConnectProvider / RemoveClientIDFromOpenIDConnectProvider | OIDC providers | Supported | Most usage | - |
| Access Analyzer / credential reports / Access Advisor | Out of scope | Out of scope | Full surface | These AWS IAM tools are not implemented by the adapter. |
| Permissions boundaries | Out of scope | Out of scope | Full surface | Role creation that attaches a boundary is rejected unless the operator acknowledges it explicitly. AWS IAM evaluates a boundary as an AND with the identity policy, and this models only the identity-policy layer, so honouring the attach silently would widen the role past what was asked for. |
| Users / groups / access-key administration / SAML federation | Out of scope | Out of scope | Full surface | These administration and federation operations are not served. |
| AttachRolePolicy / DetachRolePolicy / ListAttachedRolePolicies / ListEntitiesForPolicy | Policy attachments | Supported | Common | Attaches customer-managed policies to roles and returns their recorded relationships. |
| CreateRole / GetRole / ListRoles / DeleteRole | Roles | Supported | Common | Creates and reads role records; deletion invalidates sessions bound to that role incarnation. |
| TagRole / UntagRole / ListRoleTags | Roles | Supported | Most usage | Stores role tags; this does not enable general PrincipalTag policy conditions. |
| UpdateAssumeRolePolicy / UpdateRole / UpdateRoleDescription | Roles | Supported | Most usage | Updates role configuration. Trust is evaluated separately from Cedar identity-policy authorization. |
| AssumeRole | STS | Supported | Common | Checks role trust and issues expiring credentials. Role chaining, session policies, ExternalId and MFA inputs are unsupported. |
| AssumeRoleWithWebIdentity | STS | Supported | Common | Verifies the OIDC token and role trust before issuing a session. Issuer discovery and signing-key retrieval may need network access. |
| GetCallerIdentity | STS | Supported | Common | Returns account, ARN and user ID; an assumed-role session has an assumed-role ARN. |
| SimulateCustomPolicy | Simulation | Out of scope | Full surface | The IAM administration endpoint does not implement ad-hoc policy simulation. |
| SimulatePrincipalPolicy | Simulation | Partial | Most usage | Only the separate workload-identity endpoint supports simulation for its configured principal, with a supplied policy evaluator and concrete resources; not the IAM administration endpoint. |

#### Cloud Adapter IAM and STS

Cloud Adapter serves AWS IAM and Security Token Service (STS) requests within each Cloud Adapter deployment. The adapter supports 50 IAM administration operations across roles, customer-managed policies, instance profiles and OIDC providers, plus `GetCallerIdentity`, `AssumeRole` and `AssumeRoleWithWebIdentity`. Your applications keep their AWS SDK and CLI calls for the supported operations.

Each Cloud Adapter deployment has its own identities, policies and authorization state. Cloud Adapter deployments do not share policies or distribute policy updates to one another. Policy updates reach only the relevant replicas within the same Cloud Adapter deployment; changing permissions in one Cloud Adapter deployment does not change permissions in another.

Account IDs in adapted resource ARNs identify logical accounts within the Cloud Adapter deployment. These account records do not create cloud-provider accounts or billing relationships and do not provide AWS Organizations governance.

The adapter handles IAM administration and STS credential exchanges, and translates supported IAM policies into rules for Cedar, an open-source policy engine. When another service adapter in the Cloud Adapter deployment receives a request, Cedar evaluates those rules to allow or deny it. Role trust is checked separately, when a session is created.

Native permission translation is a different choice: it converts declared permissions into the target cloud's own grants during provisioning, and does not handle AWS IAM administration calls at run time.

This page is about the IAM in **your application's stack**. The permissions **your control plane** needs inside a customer's environment are a separate subject with its own model; see Permissions Model and Cross-Cloud IAM.

![Three separate paths in one Cloud Adapter deployment: IAM edits are validated, recorded and applied; STS checks identity and role trust before issuing temporary credentials; and each supported service call is verified and authorized against the current policies.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjcwIiB2aWV3Qm94PSIwIDAgODM2IDI3MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaHJlZSBzZXBhcmF0ZSBwYXRocyBpbiBvbmUgYXBwbGlhbmNlOiBJQU0gZWRpdHMgYXJlIHZhbGlkYXRlZCwgcmVjb3JkZWQgYW5kIGFwcGxpZWQ7IFNUUyBjaGVja3MgaWRlbnRpdHkgYW5kIHJvbGUgdHJ1c3QgYmVmb3JlIGlzc3VpbmcgdGVtcG9yYXJ5IGNyZWRlbnRpYWxzOyBhbmQgZWFjaCBzdXBwb3J0ZWQgc2VydmljZSBjYWxsIGlzIHZlcmlmaWVkIGFuZCBhdXRob3JpemVkIGFnYWluc3QgdGhlIGN1cnJlbnQgcG9saWNpZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImlhbS1wYXRoIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojOTRhM2I4Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4Ij5XSVRISU4gT05FIEFQUExJQU5DRTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMjI0IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTM2IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPklBTSBhZG1pbmlzdHJhdGlvbjwvdGV4dD4KPHRleHQgeD0iMTM2IiB5PSI4NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnJvbGVzIMK3IHBvbGljaWVzIMK3IHByb3ZpZGVyczwvdGV4dD4KPGxpbmUgeDE9IjI0OCIgeTE9IjY5IiB4Mj0iMjk4IiB5Mj0iNjkiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tcGF0aCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzMDIiIHk9IjQwIiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDE3IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPlZhbGlkYXRlIGFuZCByZWNvcmQgZWRpdHM8L3RleHQ+Cjx0ZXh0IHg9IjQxNyIgeT0iODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPnByb3RlY3RlZCBtYW5hZ2VtZW50IGFjY2VzczwvdGV4dD4KPGxpbmUgeDE9IjUzMiIgeTE9IjY5IiB4Mj0iNTgyIiB5Mj0iNjkiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tcGF0aCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI1ODYiIHk9IjQwIiB3aWR0aD0iMjI2IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjk5IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkFwcGx5IHRoZSBjaGFuZ2U8L3RleHQ+Cjx0ZXh0IHg9IjY5OSIgeT0iODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5pZGVudGl0aWVzIGFuZCBwb2xpY3kgdXBkYXRlczwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjExNiIgd2lkdGg9IjIyNCIgaGVpZ2h0PSI1OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjEzNiIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+U1RTIHJvbGUgYXNzdW1wdGlvbjwvdGV4dD4KPHRleHQgeD0iMTM2IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5jYWxsZXIgY3JlZGVudGlhbHMgb3IgT0lEQyB0b2tlbjwvdGV4dD4KPGxpbmUgeDE9IjI0OCIgeTE9IjE0NSIgeDI9IjI5OCIgeTI9IjE0NSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2lhbS1wYXRoKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjMwMiIgeT0iMTE2IiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDE3IiB5PSIxNDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5WZXJpZnkgaWRlbnRpdHkgYW5kIHJvbGUgdHJ1c3Q8L3RleHQ+Cjx0ZXh0IHg9IjQxNyIgeT0iMTYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij50cnVzdCBjb250cm9scyBzZXNzaW9uIGNyZWF0aW9uPC90ZXh0Pgo8bGluZSB4MT0iNTMyIiB5MT0iMTQ1IiB4Mj0iNTgyIiB5Mj0iMTQ1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWFtLXBhdGgpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNTg2IiB5PSIxMTYiIHdpZHRoPSIyMjYiIGhlaWdodD0iNTgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI2OTkiIHk9IjE0MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPlRlbXBvcmFyeSBjcmVkZW50aWFsczwvdGV4dD4KPHRleHQgeD0iNjk5IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5yb2xlIHNlc3Npb24gd2l0aCBhbiBleHBpcnk8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxOTIiIHdpZHRoPSIyMjQiIGhlaWdodD0iNTgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMzYiIHk9IjIxNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPlN1cHBvcnRlZCBBV1Mgc2VydmljZSBjYWxsPC90ZXh0Pgo8dGV4dCB4PSIxMzYiIHk9IjIzNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnNpZ25lZCB3aXRoIHNlc3Npb24gY3JlZGVudGlhbHM8L3RleHQ+CjxsaW5lIHgxPSIyNDgiIHkxPSIyMjEiIHgyPSIyOTgiIHkyPSIyMjEiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tcGF0aCkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzMDIiIHk9IjE5MiIgd2lkdGg9IjIzMCIgaGVpZ2h0PSI1OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjQxNyIgeT0iMjE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+VmVyaWZ5IGFuZCBhdXRob3JpemU8L3RleHQ+Cjx0ZXh0IHg9IjQxNyIgeT0iMjM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5jdXJyZW50IHBvbGljaWVzLCBpbiBDZWRhcjwvdGV4dD4KPGxpbmUgeDE9IjUzMiIgeTE9IjIyMSIgeDI9IjU4MiIgeTI9IjIyMSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2lhbS1wYXRoKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjU4NiIgeT0iMTkyIiB3aWR0aD0iMjI2IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjk5IiB5PSIyMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5SZXN1bHQgb3Igc2VydmljZSBlcnJvcjwvdGV4dD4KPHRleHQgeD0iNjk5IiB5PSIyMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5lbmZvcmNlIG1vZGUgYmxvY2tzIGRlbmlhbHM8L3RleHQ+Cjwvc3ZnPg==)

![Three separate paths in one Cloud Adapter deployment: IAM edits are validated, recorded and applied; STS checks identity and role trust before issuing temporary credentials; and each supported service call is verified and authorized against the current policies.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjcwIiB2aWV3Qm94PSIwIDAgODM2IDI3MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJUaHJlZSBzZXBhcmF0ZSBwYXRocyBpbiBvbmUgYXBwbGlhbmNlOiBJQU0gZWRpdHMgYXJlIHZhbGlkYXRlZCwgcmVjb3JkZWQgYW5kIGFwcGxpZWQ7IFNUUyBjaGVja3MgaWRlbnRpdHkgYW5kIHJvbGUgdHJ1c3QgYmVmb3JlIGlzc3VpbmcgdGVtcG9yYXJ5IGNyZWRlbnRpYWxzOyBhbmQgZWFjaCBzdXBwb3J0ZWQgc2VydmljZSBjYWxsIGlzIHZlcmlmaWVkIGFuZCBhdXRob3JpemVkIGFnYWluc3QgdGhlIGN1cnJlbnQgcG9saWNpZXMuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImlhbS1wYXRoIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0byI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNjQ3NDhiIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNCIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiIj5XSVRISU4gT05FIEFQUExJQU5DRTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQwIiB3aWR0aD0iMjI0IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTM2IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPklBTSBhZG1pbmlzdHJhdGlvbjwvdGV4dD4KPHRleHQgeD0iMTM2IiB5PSI4NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnJvbGVzIMK3IHBvbGljaWVzIMK3IHByb3ZpZGVyczwvdGV4dD4KPGxpbmUgeDE9IjI0OCIgeTE9IjY5IiB4Mj0iMjk4IiB5Mj0iNjkiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tcGF0aCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzMDIiIHk9IjQwIiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDE3IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPlZhbGlkYXRlIGFuZCByZWNvcmQgZWRpdHM8L3RleHQ+Cjx0ZXh0IHg9IjQxNyIgeT0iODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPnByb3RlY3RlZCBtYW5hZ2VtZW50IGFjY2VzczwvdGV4dD4KPGxpbmUgeDE9IjUzMiIgeTE9IjY5IiB4Mj0iNTgyIiB5Mj0iNjkiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tcGF0aCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI1ODYiIHk9IjQwIiB3aWR0aD0iMjI2IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjk5IiB5PSI2NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkFwcGx5IHRoZSBjaGFuZ2U8L3RleHQ+Cjx0ZXh0IHg9IjY5OSIgeT0iODQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5pZGVudGl0aWVzIGFuZCBwb2xpY3kgdXBkYXRlczwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjExNiIgd2lkdGg9IjIyNCIgaGVpZ2h0PSI1OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjEzNiIgeT0iMTQwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+U1RTIHJvbGUgYXNzdW1wdGlvbjwvdGV4dD4KPHRleHQgeD0iMTM2IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5jYWxsZXIgY3JlZGVudGlhbHMgb3IgT0lEQyB0b2tlbjwvdGV4dD4KPGxpbmUgeDE9IjI0OCIgeTE9IjE0NSIgeDI9IjI5OCIgeTI9IjE0NSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2lhbS1wYXRoKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjMwMiIgeT0iMTE2IiB3aWR0aD0iMjMwIiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDE3IiB5PSIxNDAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5WZXJpZnkgaWRlbnRpdHkgYW5kIHJvbGUgdHJ1c3Q8L3RleHQ+Cjx0ZXh0IHg9IjQxNyIgeT0iMTYwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij50cnVzdCBjb250cm9scyBzZXNzaW9uIGNyZWF0aW9uPC90ZXh0Pgo8bGluZSB4MT0iNTMyIiB5MT0iMTQ1IiB4Mj0iNTgyIiB5Mj0iMTQ1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWFtLXBhdGgpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNTg2IiB5PSIxMTYiIHdpZHRoPSIyMjYiIGhlaWdodD0iNTgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI2OTkiIHk9IjE0MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPlRlbXBvcmFyeSBjcmVkZW50aWFsczwvdGV4dD4KPHRleHQgeD0iNjk5IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5yb2xlIHNlc3Npb24gd2l0aCBhbiBleHBpcnk8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxOTIiIHdpZHRoPSIyMjQiIGhlaWdodD0iNTgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMzYiIHk9IjIxNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPlN1cHBvcnRlZCBBV1Mgc2VydmljZSBjYWxsPC90ZXh0Pgo8dGV4dCB4PSIxMzYiIHk9IjIzNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnNpZ25lZCB3aXRoIHNlc3Npb24gY3JlZGVudGlhbHM8L3RleHQ+CjxsaW5lIHgxPSIyNDgiIHkxPSIyMjEiIHgyPSIyOTgiIHkyPSIyMjEiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tcGF0aCkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzMDIiIHk9IjE5MiIgd2lkdGg9IjIzMCIgaGVpZ2h0PSI1OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjQxNyIgeT0iMjE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+VmVyaWZ5IGFuZCBhdXRob3JpemU8L3RleHQ+Cjx0ZXh0IHg9IjQxNyIgeT0iMjM2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5jdXJyZW50IHBvbGljaWVzLCBpbiBDZWRhcjwvdGV4dD4KPGxpbmUgeDE9IjUzMiIgeTE9IjIyMSIgeDI9IjU4MiIgeTI9IjIyMSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2lhbS1wYXRoKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjU4NiIgeT0iMTkyIiB3aWR0aD0iMjI2IiBoZWlnaHQ9IjU4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjk5IiB5PSIyMTYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5SZXN1bHQgb3Igc2VydmljZSBlcnJvcjwvdGV4dD4KPHRleHQgeD0iNjk5IiB5PSIyMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5lbmZvcmNlIG1vZGUgYmxvY2tzIGRlbmlhbHM8L3RleHQ+Cjwvc3ZnPg==)

IAM edits, STS trust checks and downstream authorization are separate steps.

#### Access keys and secret keys

Access keys and secret keys work on Google Cloud, Azure, OCI and Private Kubernetes. Use the Cloud Adapter deployment-issued pair supplied by your Cloud Adapter deployment administrator with your AWS SDK or CLI. Configure `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, the Cloud Adapter deployment endpoint and its signing region. Supported service requests use AWS Signature Version 4 (SigV4); the service adapter that receives each request verifies the signature and looks up the account the key belongs to.

This long-term pair identifies a logical account root within the Cloud Adapter deployment, not an IAM user or a cloud-provider account. Keep the secret when it is issued; it is shown once. It is not valid at AWS endpoints or in another Cloud Adapter deployment. Native permission translation does not issue this runtime credential.

A long-term pair has no session token. Temporary credentials from the supported STS operations identify a role session and also require `AWS_SESSION_TOKEN`; they expire. Credential use does not provide IAM user access-key administration: `CreateAccessKey`, `ListAccessKeys`, `UpdateAccessKey` and `DeleteAccessKey` are unsupported. The combined IAM and STS management endpoint is protected separately, as described below.

#### Authentication and management access

Temporary credentials identify a verified role session. The service adapter that receives a request verifies its signature, the session and the account before using that identity to authorize it. `GetCallerIdentity` returns the account, ARN and user ID; an assumed-role session has an assumed-role ARN, not simply its role's IAM ARN.

Protect the combined IAM and STS management endpoint with authenticated deployment access. Requests without issued session credentials use its configured bootstrap caller; this endpoint is not a general lookup of arbitrary AWS access keys. The separate public web-identity route accepts only `AssumeRoleWithWebIdentity` and verifies the token before issuing credentials.

You configure authorization enforcement on the service adapters. In enforce mode, a denied decision stops the operation and returns the receiving service's error. Report-only mode records would-be denials without blocking requests. Policy propagation does not turn report-only mode into enforcement.

#### Policy authoring and runtime changes

Keep authoring supported policies in IAM JSON. Declared stack policies and runtime IAM operations are separate ways to supply them. IAM reads return stored role, policy and relationship records, not documents reconstructed from compiled Cedar rules.

Runtime policy edits are validated before acceptance. Accepted changes update the IAM records and then propagate to the policies used for authorization, so a change can be saved before a later request sees its effect.

Creating a non-default managed-policy version does not change effective permissions. Making it the default changes the version used by attached roles. Inline policies and policy attachments also affect permissions. Role-trust changes instead govern future session creation; they are evaluated separately from Cedar identity policies.

IAM `Allow` statements translate to Cedar `permit` rules and `Deny` statements to `forbid` rules. Supported actions, resource ARNs and conditions determine their scope. A policy with a restriction that Cedar authorization cannot express is rejected; the restriction is never silently dropped. Role trust is still evaluated separately, as an IAM policy.

#### Eventual consistency for policy changes

IAM policy changes are eventually consistent, as in AWS IAM. Policy consistency is not customer-configurable. Changes take time to reach reads and authorization checks, including updates made through another replica in the same Cloud Adapter deployment.

A successful IAM response does not guarantee that subsequent reads or authorization checks already reflect the change. New grants may not be usable immediately, and revoked permissions may remain effective until the change propagates. With enforcement enabled, a request is blocked when the policies used for that check deny it; those policies can still be older than the latest accepted edit. Work already authorized can continue. Other Cloud Adapter deployments keep their own policies.

An error or timeout after commit does not imply rollback. The change may have committed even though the caller did not receive success; do not treat a failed response as proof that the old permissions remain in effect.

![Within one Cloud Adapter deployment, policy propagation may continue after a successful IAM response. Verify the dependent operation; one result does not prove every replica is up to date.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzAwIiB2aWV3Qm94PSIwIDAgODM2IDMwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJXaXRoaW4gb25lIGFwcGxpYW5jZSwgcG9saWN5IHByb3BhZ2F0aW9uIG1heSBjb250aW51ZSBhZnRlciBhIHN1Y2Nlc3NmdWwgSUFNIHJlc3BvbnNlLiBWZXJpZnkgdGhlIGRlcGVuZGVudCBvcGVyYXRpb247IG9uZSByZXN1bHQgZG9lcyBub3QgcHJvdmUgZXZlcnkgcmVwbGljYSBpcyB1cCB0byBkYXRlLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpYW0tcHJvcGFnYXRpb24iIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjgiPk9ORSBBUFBMSUFOQ0UgwrcgUE9MSUNZIENIQU5HRVMgVEFLRSBUSU1FIFRPIFBST1BBR0FURTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQ4IiB3aWR0aD0iMjE4IiBoZWlnaHQ9Ijk4IiByeD0iMTIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTMzIiB5PSI3OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPlN1Y2Nlc3NmdWwgSUFNIHJlc3BvbnNlPC90ZXh0Pgo8dGV4dCB4PSIxMzMiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPkNoYW5nZSBhY2NlcHRlZDwvdGV4dD4KPHRleHQgeD0iMTMzIiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5Ob3QgcHJvb2Ygb2YgcHJvcGFnYXRpb248L3RleHQ+CjxsaW5lIHgxPSIyNDIiIHkxPSI5NyIgeDI9IjMwMCIgeTI9Ijk3IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWFtLXByb3BhZ2F0aW9uKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjMwNCIgeT0iNDgiIHdpZHRoPSI1MDgiIGhlaWdodD0iOTgiIHJ4PSIxMiIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2Y1OWUwYiIvPgo8dGV4dCB4PSIzMjYiIHk9Ijc4IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+UHJvcGFnYXRpb24gbWF5IGNvbnRpbnVlPC90ZXh0Pgo8dGV4dCB4PSIzMjYiIHk9IjEwNCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPk5ldyBncmFudHMgbWF5IG5vdCB3b3JrIHlldDwvdGV4dD4KPHRleHQgeD0iMzI2IiB5PSIxMjYiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5SZXZva2VkIHBlcm1pc3Npb25zIG1heSBzdGlsbCBhbGxvdzwvdGV4dD4KPGxpbmUgeDE9IjU1OCIgeTE9IjE0NiIgeDI9IjU1OCIgeTI9IjE3NiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2lhbS1wcm9wYWdhdGlvbikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyNCIgeT0iMTgwIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjgyIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDE4IiB5PSIyMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5WZXJpZnkgdGhlIGRlcGVuZGVudCBvcGVyYXRpb248L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMjI3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5DaGVjayB0aGUgbmVlZGVkIHJlc3VsdCBiZWZvcmUgcmVseWluZyBvbiB0aGUgY2hhbmdlLjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIyNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPk9uZSByZXN1bHQgZG9lcyBub3QgcHJvdmUgZXZlcnkgcmVwbGljYSBpcyB1cCB0byBkYXRlLjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIyODYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5ObyBmaXhlZCBwcm9wYWdhdGlvbiBkZWFkbGluZS4gT3RoZXIgYXBwbGlhbmNlcyBrZWVwIHRoZWlyIG93biBwb2xpY2llcy48L3RleHQ+Cjwvc3ZnPg==)

![Within one Cloud Adapter deployment, policy propagation may continue after a successful IAM response. Verify the dependent operation; one result does not prove every replica is up to date.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMzAwIiB2aWV3Qm94PSIwIDAgODM2IDMwMCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJXaXRoaW4gb25lIGFwcGxpYW5jZSwgcG9saWN5IHByb3BhZ2F0aW9uIG1heSBjb250aW51ZSBhZnRlciBhIHN1Y2Nlc3NmdWwgSUFNIHJlc3BvbnNlLiBWZXJpZnkgdGhlIGRlcGVuZGVudCBvcGVyYXRpb247IG9uZSByZXN1bHQgZG9lcyBub3QgcHJvdmUgZXZlcnkgcmVwbGljYSBpcyB1cCB0byBkYXRlLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpYW0tcHJvcGFnYXRpb24iIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI0IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGIiPk9ORSBBUFBMSUFOQ0UgwrcgUE9MSUNZIENIQU5HRVMgVEFLRSBUSU1FIFRPIFBST1BBR0FURTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQ4IiB3aWR0aD0iMjE4IiBoZWlnaHQ9Ijk4IiByeD0iMTIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTMzIiB5PSI3OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPlN1Y2Nlc3NmdWwgSUFNIHJlc3BvbnNlPC90ZXh0Pgo8dGV4dCB4PSIxMzMiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPkNoYW5nZSBhY2NlcHRlZDwvdGV4dD4KPHRleHQgeD0iMTMzIiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5Ob3QgcHJvb2Ygb2YgcHJvcGFnYXRpb248L3RleHQ+CjxsaW5lIHgxPSIyNDIiIHkxPSI5NyIgeDI9IjMwMCIgeTI9Ijk3IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjaWFtLXByb3BhZ2F0aW9uKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjMwNCIgeT0iNDgiIHdpZHRoPSI1MDgiIGhlaWdodD0iOTgiIHJ4PSIxMiIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6I2ZiYmYyNCIvPgo8dGV4dCB4PSIzMjYiIHk9Ijc4IiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+UHJvcGFnYXRpb24gbWF5IGNvbnRpbnVlPC90ZXh0Pgo8dGV4dCB4PSIzMjYiIHk9IjEwNCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPk5ldyBncmFudHMgbWF5IG5vdCB3b3JrIHlldDwvdGV4dD4KPHRleHQgeD0iMzI2IiB5PSIxMjYiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5SZXZva2VkIHBlcm1pc3Npb25zIG1heSBzdGlsbCBhbGxvdzwvdGV4dD4KPGxpbmUgeDE9IjU1OCIgeTE9IjE0NiIgeDI9IjU1OCIgeTI9IjE3NiIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2lhbS1wcm9wYWdhdGlvbikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyNCIgeT0iMTgwIiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjgyIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDE4IiB5PSIyMDUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5WZXJpZnkgdGhlIGRlcGVuZGVudCBvcGVyYXRpb248L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMjI3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5DaGVjayB0aGUgbmVlZGVkIHJlc3VsdCBiZWZvcmUgcmVseWluZyBvbiB0aGUgY2hhbmdlLjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIyNDgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPk9uZSByZXN1bHQgZG9lcyBub3QgcHJvdmUgZXZlcnkgcmVwbGljYSBpcyB1cCB0byBkYXRlLjwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIyODYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5ObyBmaXhlZCBwcm9wYWdhdGlvbiBkZWFkbGluZS4gT3RoZXIgYXBwbGlhbmNlcyBrZWVwIHRoZWlyIG93biBwb2xpY2llcy48L3RleHQ+Cjwvc3ZnPg==)

Success can precede propagation. A dependent-operation check is not a freshness guarantee for every replica.

#### Propagation and dependent workflows

Verify propagation before starting a workflow that depends on the change; a fixed sleep is not proof that propagation has completed. Check the relevant IAM state and the allowed or denied result needed by that workflow. One observed result does not prove that every replica is up to date or that the next request will observe the same policy state. Avoid putting IAM changes in a critical request path that assumes immediate visibility.

There is no fixed propagation deadline. An unavailable replica or policy service can delay visibility or make requests fail. Eventual consistency does not guarantee offline availability, and there is no universal rule that permissions become denied after a fixed cache age. Test propagation, failure and recovery across the Cloud Adapter deployment's replicas with the required enforcement settings.

#### Authorization decisions

Cedar evaluates the principal, action, resource and supported request context against the selected policies. Any matching `forbid` overrides a `permit`. With no matching permit, the decision is deny. Policy order does not change that decision.

These rules describe supported identity-policy authorization. IAM management also has a privileged account-root path, and STS uses separate trust checks. They do not imply that every AWS policy layer or every receiving service is covered.

![In enforce mode, a matching deny blocks the request; otherwise a matching allow permits it, and the default is deny.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbiBlbmZvcmNlIG1vZGUsIGEgbWF0Y2hpbmcgZGVueSBibG9ja3MgdGhlIHJlcXVlc3Q7IG90aGVyd2lzZSBhIG1hdGNoaW5nIGFsbG93IHBlcm1pdHMgaXQsIGFuZCB0aGUgZGVmYXVsdCBpcyBkZW55LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpYW0tZGVueSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8iPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiOCI+RU5GT1JDRSBNT0RFIMK3IFBPTElDWSBPUkRFUiBET0VTIE5PVCBDSEFOR0UgVEhFIERFQ0lTSU9OPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNjIiIHdpZHRoPSIyMTgiIGhlaWdodD0iMTAwIiByeD0iMTIiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTMzIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPlZlcmlmaWVkIHJlcXVlc3Q8L3RleHQ+Cjx0ZXh0IHg9IjEzMyIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cHJpbmNpcGFsIMK3IGFjdGlvbiDCtyByZXNvdXJjZTwvdGV4dD4KPHRleHQgeD0iMTMzIiB5PSIxMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5zdXBwb3J0ZWQgY29uZGl0aW9uIGNvbnRleHQ8L3RleHQ+CjxsaW5lIHgxPSIyNDIiIHkxPSIxMTIiIHgyPSIzMDAiIHkyPSIxMTIiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tZGVueSkiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzMDQiIHk9IjQwIiB3aWR0aD0iNTA4IiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmZmZiZWI7c3Ryb2tlOiNmNTllMGIiLz4KPHRleHQgeD0iMzI0IiB5PSI2OSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkEgbWF0Y2hpbmcgZm9yYmlkIOKGkiBkZW55LCBldmVuIGlmIGEgcGVybWl0IGFsc28gbWF0Y2hlczwvdGV4dD4KPHJlY3QgeD0iMzA0IiB5PSI5OCIgd2lkdGg9IjUwOCIgaGVpZ2h0PSI0OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZWNmZGY1O3N0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjMyNCIgeT0iMTI3IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NyI+Tm8gZm9yYmlkLCB3aXRoIGEgbWF0Y2hpbmcgcGVybWl0IOKGkiBhbGxvdzwvdGV4dD4KPHJlY3QgeD0iMzA0IiB5PSIxNTYiIHdpZHRoPSI1MDgiIGhlaWdodD0iNDgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2Y1OWUwYiIvPgo8dGV4dCB4PSIzMjQiIHk9IjE4NSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPk5vIG1hdGNoaW5nIHBlcm1pdCDihpIgZGVueTwvdGV4dD4KPC9zdmc+)

![In enforce mode, a matching deny blocks the request; otherwise a matching allow permits it, and the default is deny.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjI2IiB2aWV3Qm94PSIwIDAgODM2IDIyNiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJJbiBlbmZvcmNlIG1vZGUsIGEgbWF0Y2hpbmcgZGVueSBibG9ja3MgdGhlIHJlcXVlc3Q7IG90aGVyd2lzZSBhIG1hdGNoaW5nIGFsbG93IHBlcm1pdHMgaXQsIGFuZCB0aGUgZGVmYXVsdCBpcyBkZW55LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJpYW0tZGVueSIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8iPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjQiIHk9IjI0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YiI+RU5GT1JDRSBNT0RFIMK3IFBPTElDWSBPUkRFUiBET0VTIE5PVCBDSEFOR0UgVEhFIERFQ0lTSU9OPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iNjIiIHdpZHRoPSIyMTgiIGhlaWdodD0iMTAwIiByeD0iMTIiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTMzIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPlZlcmlmaWVkIHJlcXVlc3Q8L3RleHQ+Cjx0ZXh0IHg9IjEzMyIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cHJpbmNpcGFsIMK3IGFjdGlvbiDCtyByZXNvdXJjZTwvdGV4dD4KPHRleHQgeD0iMTMzIiB5PSIxMzYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5zdXBwb3J0ZWQgY29uZGl0aW9uIGNvbnRleHQ8L3RleHQ+CjxsaW5lIHgxPSIyNDIiIHkxPSIxMTIiIHgyPSIzMDAiIHkyPSIxMTIiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNpYW0tZGVueSkiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzMDQiIHk9IjQwIiB3aWR0aD0iNTA4IiBoZWlnaHQ9IjQ4IiByeD0iMTAiIHN0eWxlPSJmaWxsOiM0MjIwMDY7c3Ryb2tlOiNmYmJmMjQiLz4KPHRleHQgeD0iMzI0IiB5PSI2OSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkEgbWF0Y2hpbmcgZm9yYmlkIOKGkiBkZW55LCBldmVuIGlmIGEgcGVybWl0IGFsc28gbWF0Y2hlczwvdGV4dD4KPHJlY3QgeD0iMzA0IiB5PSI5OCIgd2lkdGg9IjUwOCIgaGVpZ2h0PSI0OCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMDY0ZTNiO3N0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjMyNCIgeT0iMTI3IiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNyI+Tm8gZm9yYmlkLCB3aXRoIGEgbWF0Y2hpbmcgcGVybWl0IOKGkiBhbGxvdzwvdGV4dD4KPHJlY3QgeD0iMzA0IiB5PSIxNTYiIHdpZHRoPSI1MDgiIGhlaWdodD0iNDgiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6I2ZiYmYyNCIvPgo8dGV4dCB4PSIzMjQiIHk9IjE4NSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPk5vIG1hdGNoaW5nIHBlcm1pdCDihpIgZGVueTwvdGV4dD4KPC9zdmc+)

Explicit deny overrides allow; without a matching allow, the decision is deny.

#### Supported conditions

Identity policies support `aws:CurrentTime`, `aws:EpochTime`, and three Route 53 change keys: `route53:ChangeResourceRecordSetsNormalizedRecordNames`, `route53:ChangeResourceRecordSetsRecordTypes` and `route53:ChangeResourceRecordSetsActions`. The DNS subset includes supported set, wildcard, negation and existence tests. Accepted operators depend on the key.

`aws:SourceIp`, `aws:PrincipalTag`, `aws:SecureTransport` and MFA identity-policy keys are unsupported. A value being available in the deployment does not itself make its condition supported. Stored role tags do not imply general tag-based authorization.

Role-trust conditions are separate. OIDC trust supports issuer-qualified audience and subject comparisons using `StringEquals` and `StringLike`. Pod Identity trust supports those operators on its six verified request-tag keys. Neither capability adds general identity-policy condition coverage.

#### Role trust and temporary credentials

`AssumeRole` evaluates role trust before creating an expiring session. Conditional cross-account assumption is supported between accounts in the same Cloud Adapter deployment when caller-side authorization and target-role trust both permit it. This does not provide cross-Cloud Adapter deployment trust or policy sharing. Account-root delegation and assumption into arbitrary real AWS accounts are outside this scope.

`AssumeRoleWithWebIdentity` verifies the token signature, issuer, audience, subject and expiry against a registered OIDC provider and evaluates role trust. The dedicated Pod Identity exchange verifies the agent and pod token, selects the role from its association and issues a session with attested tags. These are real credential exchanges, not static credentials derived from a role name.

Configured replicas within one Cloud Adapter deployment can share session verification. This does not make credentials valid in another Cloud Adapter deployment. Sessions expire and are tied to the role's identity, so deleting and recreating a role with the same name does not revive its old sessions. Trust changes govern future assumptions; permission changes affect later authorization checks as they propagate. Neither effect is guaranteed to be visible immediately after a successful IAM response.

Normal `AssumeRole` does not support role chaining, session policies, arbitrary session tags, ExternalId, MFA, SourceIdentity or ProvidedContexts. The trusted Pod Identity tag path is separate. Neither session issuance nor `GetCallerIdentity` calls AWS STS, but OIDC discovery and signing-key retrieval may require access to the configured issuer.

#### Administration and simulation scope

Administration includes role updates and tags; customer-managed policy creation, versions and tags; inline role policies and attachments; instance-profile lifecycle, membership and tags; and OIDC-provider lifecycle, audiences, thumbprints and tags. Policy versioning supports up to five versions per policy. AWS-managed policy documents are not supplied by the runtime catalog; use supported customer-managed policies.

The IAM administration endpoint does not implement `SimulatePrincipalPolicy` or `SimulateCustomPolicy`. A separate workload-identity endpoint supports restricted principal simulation when configured with a policy evaluator. That simulation uses its configured workload and explicit actions and resource ARNs; it does not accept arbitrary principals or ad-hoc policy documents. A simulated deny may differ from the allowed response in report-only mode.

User, group and access-key administration, SAML federation, service-linked roles, Access Analyzer, credential reports and Access Advisor are outside the implemented API scope.

#### Diagnostics and deployment

Authorization diagnostics record denials and would-be denials, including the principal, action, resource, result, enforcement mode and readiness. They do not record every successful permit or identify the matched policy statements. Policy validation and offline evaluation help test examples; they are not an Access Analyzer equivalent.

The IAM and STS endpoints and Cedar evaluation run within each Cloud Adapter deployment. There is no shared policy distribution mechanism between Cloud Adapter deployments. Use the deployment configuration supported for that target environment; portable policy evaluation does not imply identical native identity provisioning on every cloud. AWS adapter permissions and the target cloud's native grants remain separate.

Tensor9 operates the adapter and policy propagation within each Cloud Adapter deployment. Diagnostic destinations and retention follow the Cloud Adapter deployment's logging configuration. Before cutover, test administration, denied requests, credential renewal, permission-change propagation and outages across that Cloud Adapter deployment's replicas. A healthy replica count does not prove that a particular policy change has reached every authorization check.

#### Limitations

Limitations

* **Parts of the IAM policy language are not supported.** In identity policies, `NotAction`, `NotResource` and `NotPrincipal`, policy variables, `?` wildcards and unsupported principal forms are rejected. Action wildcards are limited to `*` or `service:*`; resource patterns accept broader `*` matching.
* **Some condition keys are not supported.** `aws:SourceIp`, `aws:PrincipalTag`, `aws:SecureTransport` and MFA keys are rejected in identity policies. The supported keys are listed under Supported conditions.
* **Permissions boundaries are not enforced.** Creating a role with a boundary is rejected unless you acknowledge it. Acknowledging keeps the attribute but does not enforce it, so the role can have broader permissions than the boundary allows.
* **Resource policies behave differently: each receiving service handles them.** Translating an identity policy does not add resource-policy APIs or AWS's rules for combining resource and identity policies.
* **Organizations SCPs are not enforced by this authorizer.** Successful IAM administration or a token exchange adds no account or organization restrictions.
* **Several AssumeRole options are not supported.** Role chaining, session policies, arbitrary session tags, `ExternalId`, MFA, `SourceIdentity` and `ProvidedContexts` are not available on normal `AssumeRole`.
* **User, group and access-key administration is not supported.** `CreateAccessKey`, `ListAccessKeys`, `UpdateAccessKey` and `DeleteAccessKey`, SAML federation, service-linked roles, Access Analyzer, credential reports and Access Advisor are outside the supported API.
* **Policy simulation behaves differently.** `SimulatePrincipalPolicy` and `SimulateCustomPolicy` are not available on the IAM endpoint; a separate workload-identity endpoint offers restricted simulation for its configured workload.
* **AWS-managed policies are not supplied.** Their documents are not in the runtime catalog; write the permissions you need as customer-managed policies.
* **Permission changes behave differently: they propagate eventually.** New permissions can take time to become usable, and revoked permissions can stay effective while the change propagates. Report-only mode does not block denied requests even after the updated policy is visible.
* **Sharing policies between Cloud Adapter deployments is not supported.** Policies, policy updates and authorization state stay within one Cloud Adapter deployment. Credentials shared by its replicas work only in that Cloud Adapter deployment and grant no access at AWS.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS IAM and STS · Local authorization decisions

Feature: AWS IAM and STS.

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/c9a6e1dca45ddd17aa45281a4e910795b01085334632d043c4e78cd2acf1562b-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/f3b70dabb7aa5372ad4dae2cf21bff20e6e060df1920132beeb391930f250a28-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Local authorization decisions (operations/s) | IAM | Target scenario | Cedar | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 0 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 1 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 1 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 10 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 10 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 100 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 100 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 1,000 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 1,000 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 10,000 | 0.00 | Cedar (one copy) | 1,144.34 | 1,144.34 |
| 10,000 | 0.00 | Cedar (two copies) | 2,288.68 | 2,288.68 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cedar (one copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (one copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (one copy) | Principals and roles | 1,000 | principals |
| Cedar (one copy) | Policies per principal | 2 | policies/principal |
| Cedar (one copy) | Mean policy document size | 4,096 | bytes |
| Cedar (one copy) | Policy record expansion | 1.5 | multiplier |
| Cedar (one copy) | Management requests that mutate state | 0.1 | fraction |
| Cedar (one copy) | Target price guess · read | 0 | USD/read |
| Cedar (one copy) | Target price guess · write | 0 | USD/write |
| Cedar (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (one copy) | Target price guess · input token | 0 | USD/input token |
| Cedar (one copy) | Target price guess · output token | 0 | USD/output token |
| Cedar (one copy) | Target monthly base charge | 0 | USD/month |
| Cedar (one copy) | Approximate target service minimum | 0 | USD/month |
| Cedar (one copy) | Minimum primary CPU | 2 | vCPU |
| Cedar (one copy) | Minimum primary RAM | 8 | GiB |
| Cedar (one copy) | Minimum primary disk | 100 | GiB |
| Cedar (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cedar (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cedar (one copy) | Planning peak / mean work | 2 | multiplier |
| Cedar (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (one copy) | Planning disk utilization | 0.8 | fraction |
| Cedar (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cedar (two copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (two copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (two copies) | Principals and roles | 1,000 | principals |
| Cedar (two copies) | Policies per principal | 2 | policies/principal |
| Cedar (two copies) | Mean policy document size | 4,096 | bytes |
| Cedar (two copies) | Policy record expansion | 1.5 | multiplier |
| Cedar (two copies) | Management requests that mutate state | 0.1 | fraction |
| Cedar (two copies) | Target price guess · read | 0 | USD/read |
| Cedar (two copies) | Target price guess · write | 0 | USD/write |
| Cedar (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (two copies) | Target price guess · input token | 0 | USD/input token |
| Cedar (two copies) | Target price guess · output token | 0 | USD/output token |
| Cedar (two copies) | Target monthly base charge | 0 | USD/month |
| Cedar (two copies) | Approximate target service minimum | 0 | USD/month |
| Cedar (two copies) | Minimum primary CPU | 2 | vCPU |
| Cedar (two copies) | Minimum primary RAM | 8 | GiB |
| Cedar (two copies) | Minimum primary disk | 100 | GiB |
| Cedar (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cedar (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cedar (two copies) | Planning peak / mean work | 2 | multiplier |
| Cedar (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (two copies) | Planning disk utilization | 0.8 | fraction |
| Cedar (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Self-hosted target: Cedar (Apache-2.0, [https://github.com/cedar-policy/cedar/blob/main/LICENSE](https://github.com/cedar-policy/cedar/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-2337a2bb066032b30f6de3e2e31d3c204810929d` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

##### AWS IAM and STS · IAM / STS management requests

Feature: AWS IAM and STS.

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/9d98743b8c22f7a68918bb54d697d77f0a59b26a850c6f9f6f82ebe25816a56a-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/d267bb827b47b84d756e4c0f740a00487596beca244e2f1b0c8204cc7922c707-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| IAM / STS management requests (operations/s) | IAM | Target scenario | Cedar | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 0 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 1 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 1 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 10 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 10 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 100 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 100 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 1,000 | 0.00 | Cedar (one copy) | 80.90 | 80.90 |
| 1,000 | 0.00 | Cedar (two copies) | 161.79 | 161.79 |
| 10,000 | 0.00 | Cedar (one copy) | 1,144.34 | 1,144.34 |
| 10,000 | 0.00 | Cedar (two copies) | 2,288.68 | 2,288.68 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cedar (one copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (one copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (one copy) | Principals and roles | 1,000 | principals |
| Cedar (one copy) | Policies per principal | 2 | policies/principal |
| Cedar (one copy) | Mean policy document size | 4,096 | bytes |
| Cedar (one copy) | Policy record expansion | 1.5 | multiplier |
| Cedar (one copy) | Management requests that mutate state | 0.1 | fraction |
| Cedar (one copy) | Target price guess · read | 0 | USD/read |
| Cedar (one copy) | Target price guess · write | 0 | USD/write |
| Cedar (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (one copy) | Target price guess · input token | 0 | USD/input token |
| Cedar (one copy) | Target price guess · output token | 0 | USD/output token |
| Cedar (one copy) | Target monthly base charge | 0 | USD/month |
| Cedar (one copy) | Approximate target service minimum | 0 | USD/month |
| Cedar (one copy) | Minimum primary CPU | 2 | vCPU |
| Cedar (one copy) | Minimum primary RAM | 8 | GiB |
| Cedar (one copy) | Minimum primary disk | 100 | GiB |
| Cedar (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cedar (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cedar (one copy) | Planning peak / mean work | 2 | multiplier |
| Cedar (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (one copy) | Planning disk utilization | 0.8 | fraction |
| Cedar (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cedar (two copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| Cedar (two copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Cedar (two copies) | Principals and roles | 1,000 | principals |
| Cedar (two copies) | Policies per principal | 2 | policies/principal |
| Cedar (two copies) | Mean policy document size | 4,096 | bytes |
| Cedar (two copies) | Policy record expansion | 1.5 | multiplier |
| Cedar (two copies) | Management requests that mutate state | 0.1 | fraction |
| Cedar (two copies) | Target price guess · read | 0 | USD/read |
| Cedar (two copies) | Target price guess · write | 0 | USD/write |
| Cedar (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Cedar (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cedar (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cedar (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cedar (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cedar (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cedar (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cedar (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cedar (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cedar (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Cedar (two copies) | Target price guess · input token | 0 | USD/input token |
| Cedar (two copies) | Target price guess · output token | 0 | USD/output token |
| Cedar (two copies) | Target monthly base charge | 0 | USD/month |
| Cedar (two copies) | Approximate target service minimum | 0 | USD/month |
| Cedar (two copies) | Minimum primary CPU | 2 | vCPU |
| Cedar (two copies) | Minimum primary RAM | 8 | GiB |
| Cedar (two copies) | Minimum primary disk | 100 | GiB |
| Cedar (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cedar (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Cedar (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cedar (two copies) | Planning peak / mean work | 2 | multiplier |
| Cedar (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cedar (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cedar (two copies) | Planning disk utilization | 0.8 | fraction |
| Cedar (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Cedar (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cedar (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cedar (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cedar (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Self-hosted target: Cedar (Apache-2.0, [https://github.com/cedar-policy/cedar/blob/main/LICENSE](https://github.com/cedar-policy/cedar/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-2337a2bb066032b30f6de3e2e31d3c204810929d` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

**AWS IAM and STS → Cedar: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: IAM / STS management requests | 0.00 |
| Origin: In-process policy authorization decisions | 0.00 |
| Target: Provisioned primary CPU | 46.15 |
| Target: Provisioned primary RAM | 24.74 |
| Target: Provisioned primary disk | 10.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent provisioned resources | 0.00 |
| Target: Independent managed resources | 0.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **80.90** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · IAM / STS management requests | 0 | USD/requests |
| Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Principals and roles | 1,000 | principals |
| Policies per principal | 2 | policies/principal |
| Mean policy document size | 4,096 | bytes |
| Policy record expansion | 1.5 | multiplier |
| Management requests that mutate state | 0.1 | fraction |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| IAM / STS management requests | 1,000,000 | requests |
| In-process policy authorization decisions | 10,000,000 | decisions |

* Translated reads: 10,900,000 operations.

* Translated writes: 100,000 operations.

* Translated resident physical data: 0.0114 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.

* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.

* Self-hosted target: Cedar (Apache-2.0, [https://github.com/cedar-policy/cedar/blob/main/LICENSE](https://github.com/cedar-policy/cedar/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-2337a2bb066032b30f6de3e2e31d3c204810929d` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## On Azure

### IAM

#### Infrastructure only: native permissions

Tensor9 translates the roles, policies, and attachments declared by your stack into Azure RBAC and Entra grants during provisioning. Azure RBAC assigns built-in or custom roles over a scope hierarchy. Tensor9 maps supported actions and uses backend assignment scopes; not every AWS resource or condition restriction is preserved. The resulting grants use role-assignment granularity.

#### Permission differences

AWS policies can restrict individual resources and request conditions. This mapping does not preserve every restriction. Mappings that broaden access require explicit acceptance; incompatible restrictions stop translation. Some mappings grant fewer permissions. Review generated actions and scopes before deployment. The Cedar-based adapter separately serves supported AWS IAM calls and evaluates supported AWS identity policies.

#### Application and identity changes

This mapping provisions grants; it does not serve runtime AWS IAM calls such as `iam:CreateRole` or `iam:AttachRolePolicy`. Replace references to AWS role ARNs in trust policies, assume-role calls, and resource policies with the appropriate Azure identity. New backend grants are created during deployment; AWS policy objects are not copied.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

**Native or deployment mapping.** This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels. Cost estimates describe the selected service resources; operation coverage remains separate.

##### AWS IAM and STS · Local authorization decisions

Feature: AWS IAM and STS.

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/ecad6d6854d150d672164aeeef2bf7942c269c69bf97e83e199ae4a680d1d261-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/6e4d541a2efbe04aeb39c0b0ba20ec904b47618fa1e4e96fe66683d6e237cea6-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Local authorization decisions (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | IAM (one staging copy) | 1,635.85 | 1,635.85 |
| 10,000 | 0.00 | IAM (two staging copies) | 3,271.70 | 3,271.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1,000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4,096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1,000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4,096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* What is Azure role-based access control (Azure RBAC)?: [https://learn.microsoft.com/en-us/azure/role-based-access-control/overview](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-4aa30b86f1d9e528a7c4e3b167be549830f739b3` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [What is Azure role-based access control (Azure RBAC)?](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview).

##### AWS IAM and STS · IAM / STS management requests

Feature: AWS IAM and STS.

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/4e6028384932324ca8818000ded98d49d79f2123a88f5ec89fdad67ae0cdbee8-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/a8bef1c36bd0360b81adac4f4f2d9a21f3bfb6b1e5da447b662f21a1a4fa1484-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| IAM / STS management requests (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | IAM (one staging copy) | 1,635.85 | 1,635.85 |
| 10,000 | 0.00 | IAM (two staging copies) | 3,271.70 | 3,271.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1,000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4,096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1,000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4,096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* What is Azure role-based access control (Azure RBAC)?: [https://learn.microsoft.com/en-us/azure/role-based-access-control/overview](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-4aa30b86f1d9e528a7c4e3b167be549830f739b3` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [What is Azure role-based access control (Azure RBAC)?](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview).

**AWS IAM and STS → IAM: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: global. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: IAM / STS management requests | 0.00 |
| Origin: In-process policy authorization decisions | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **118.18** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · IAM / STS management requests | 0 | USD/requests |
| Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Principals and roles | 1,000 | principals |
| Policies per principal | 2 | policies/principal |
| Mean policy document size | 4,096 | bytes |
| Policy record expansion | 1.5 | multiplier |
| Management requests that mutate state | 0.1 | fraction |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| IAM / STS management requests | 1,000,000 | requests |
| In-process policy authorization decisions | 10,000,000 | decisions |

* Translated reads: 10,900,000 operations.

* Translated writes: 100,000 operations.

* Translated resident physical data: 0.0114 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.

* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.

* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-4aa30b86f1d9e528a7c4e3b167be549830f739b3` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [What is Azure role-based access control (Azure RBAC)?](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview).

## On Google Cloud

### IAM

#### Infrastructure only: native permissions

Tensor9 translates the roles, policies, and attachments declared by your stack into Google Cloud IAM grants during provisioning. Google Cloud IAM binds predefined or custom roles to principals. Tensor9 maps supported AWS actions to permissions; the generated scope and supported condition mapping can differ. The resulting grants use predefined or custom role permissions and resource scopes.

#### Permission differences

AWS policies can restrict individual resources and request conditions. This mapping does not preserve every restriction. Mappings that broaden access require explicit acceptance; incompatible restrictions stop translation. Some mappings grant fewer permissions. Review generated actions and scopes before deployment. The Cedar-based adapter separately serves supported AWS IAM calls and evaluates supported AWS identity policies.

#### Application and identity changes

This mapping provisions grants; it does not serve runtime AWS IAM calls such as `iam:CreateRole` or `iam:AttachRolePolicy`. Replace references to AWS role ARNs in trust policies, assume-role calls, and resource policies with the appropriate Google identity. New backend grants are created during deployment; AWS policy objects are not copied.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

**Native or deployment mapping.** This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels. Cost estimates describe the selected service resources; operation coverage remains separate.

##### AWS IAM and STS · Local authorization decisions

Feature: AWS IAM and STS.

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/41919c0624eb39db480f751ee67229e711e0e95da340fb72ee8dde1224e46d7b-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/2c1a787cf9fe1bf829feedb66545c95b4a75eda761dc8b184968c40ab7763799-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Local authorization decisions (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | IAM (one staging copy) | 1,635.85 | 1,635.85 |
| 10,000 | 0.00 | IAM (two staging copies) | 3,271.70 | 3,271.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1,000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4,096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1,000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4,096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* IAM pricing: [https://cloud.google.com/iam/pricing](https://cloud.google.com/iam/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9ae61cc2693ea509da57c8030bc42025f671c79b` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [IAM pricing](https://cloud.google.com/iam/pricing).

##### AWS IAM and STS · IAM / STS management requests

Feature: AWS IAM and STS.

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: global; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/3c34ec7b718879939a8d4c372ac534277b27f9471ab006e8e211bd687a12a9fe-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/bf3a35fd7c615c9b87b0262cb8f5781bdd117976e53ec946675aab7aef2e5dfe-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| IAM / STS management requests (operations/s) | IAM | Target scenario | IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | IAM (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | IAM (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | IAM (one staging copy) | 1,635.85 | 1,635.85 |
| 10,000 | 0.00 | IAM (two staging copies) | 3,271.70 | 3,271.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (one staging copy) | Principals and roles | 1,000 | principals |
| IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| IAM (one staging copy) | Mean policy document size | 4,096 | bytes |
| IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| IAM (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| IAM (two staging copies) | Principals and roles | 1,000 | principals |
| IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| IAM (two staging copies) | Mean policy document size | 4,096 | bytes |
| IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| IAM (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → global, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* IAM pricing: [https://cloud.google.com/iam/pricing](https://cloud.google.com/iam/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9ae61cc2693ea509da57c8030bc42025f671c79b` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [IAM pricing](https://cloud.google.com/iam/pricing).

**AWS IAM and STS → IAM: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: global. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: IAM / STS management requests | 0.00 |
| Origin: In-process policy authorization decisions | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **118.18** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · IAM / STS management requests | 0 | USD/requests |
| Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Principals and roles | 1,000 | principals |
| Policies per principal | 2 | policies/principal |
| Mean policy document size | 4,096 | bytes |
| Policy record expansion | 1.5 | multiplier |
| Management requests that mutate state | 0.1 | fraction |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| IAM / STS management requests | 1,000,000 | requests |
| In-process policy authorization decisions | 10,000,000 | decisions |

* Translated reads: 10,900,000 operations.

* Translated writes: 100,000 operations.

* Translated resident physical data: 0.0114 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.

* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.

* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-9ae61cc2693ea509da57c8030bc42025f671c79b` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [IAM pricing](https://cloud.google.com/iam/pricing).

## On OCI

### OCI IAM

#### Infrastructure only: native permissions

Tensor9 translates the roles, policies, and attachments declared by your stack into OCI IAM grants during provisioning. OCI IAM uses policy statements scoped to compartments and groups. This mapping uses OCI verbs and resource families, which can group AWS actions or resources differently. The resulting grants use group and compartment granularity.

#### Permission differences

AWS policies can restrict individual resources and request conditions. This mapping does not preserve every restriction. Mappings that broaden access require explicit acceptance; incompatible restrictions stop translation. Some mappings grant fewer permissions. Review generated actions and scopes before deployment. The Cedar-based adapter separately serves supported AWS IAM calls and evaluates supported AWS identity policies.

#### Application and identity changes

This mapping provisions grants; it does not serve runtime AWS IAM calls such as `iam:CreateRole` or `iam:AttachRolePolicy`. Replace references to AWS role ARNs in trust policies, assume-role calls, and resource policies with the appropriate OCI identity. New backend grants are created during deployment; AWS policy objects are not copied.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

**Native or deployment mapping.** This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels. Cost estimates describe the selected service resources; operation coverage remains separate.

##### AWS IAM and STS · Local authorization decisions

Feature: AWS IAM and STS.

Estimated monthly service charges by Local authorization decisions. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/6a8f79ef5f5938f0316bb47efc2beb24bb6ab348218b84b3981c1a0524b3ff74-light.svg)

![AWS IAM and STS · Local authorization decisions: monthly service charges by Local authorization decisions. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/27c7ddaca6d22838ec70155491bfadcfd8ca8796dcacf55b7f270f25ec1bf780-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Local authorization decisions (operations/s) | IAM | Target scenario | OCI IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 1 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 1 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | OCI IAM (one staging copy) | 1,635.85 | 1,635.85 |
| 10,000 | 0.00 | OCI IAM (two staging copies) | 3,271.70 | 3,271.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (one staging copy) | Principals and roles | 1,000 | principals |
| OCI IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| OCI IAM (one staging copy) | Mean policy document size | 4,096 | bytes |
| OCI IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (two staging copies) | Principals and roles | 1,000 | principals |
| OCI IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| OCI IAM (two staging copies) | Mean policy document size | 4,096 | bytes |
| OCI IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs. OCI bills only identity-domain premium or external users, SMS and tokens above 10,000 a month, none of which this family uses.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9efbb4ad5b81bf0caeda01c49cfdf2dd9b017b71` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [OCI price list](https://www.oracle.com/cloud/price-list/).

##### AWS IAM and STS · IAM / STS management requests

Feature: AWS IAM and STS.

Estimated monthly service charges by IAM / STS management requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-ashburn-1; currency: USD.

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/603e452b78c3019f39f15c2c2977e4b065d1dc962694016d566663fd78f93b86-light.svg)

![AWS IAM and STS · IAM / STS management requests: monthly service charges by IAM / STS management requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/0113aefd551bc7b0c1869f0b470a5a7417aa110636f04f179240009a075e6643-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| IAM / STS management requests (operations/s) | IAM | Target scenario | OCI IAM | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 0 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 1 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 1 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 10 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 10 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 100 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 100 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 1,000 | 0.00 | OCI IAM (one staging copy) | 118.18 | 118.18 |
| 1,000 | 0.00 | OCI IAM (two staging copies) | 236.36 | 236.36 |
| 10,000 | 0.00 | OCI IAM (one staging copy) | 1,635.85 | 1,635.85 |
| 10,000 | 0.00 | OCI IAM (two staging copies) | 3,271.70 | 3,271.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| OCI IAM (one staging copy) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (one staging copy) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (one staging copy) | Principals and roles | 1,000 | principals |
| OCI IAM (one staging copy) | Policies per principal | 2 | policies/principal |
| OCI IAM (one staging copy) | Mean policy document size | 4,096 | bytes |
| OCI IAM (one staging copy) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (one staging copy) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (one staging copy) | Target price guess · read | 0 | USD/read |
| OCI IAM (one staging copy) | Target price guess · write | 0 | USD/write |
| OCI IAM (one staging copy) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (one staging copy) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (one staging copy) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (one staging copy) | Target monthly base charge | 0 | USD/month |
| OCI IAM (one staging copy) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (one staging copy) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (one staging copy) | Minimum primary RAM | 8 | GiB |
| OCI IAM (one staging copy) | Minimum primary disk | 100 | GiB |
| OCI IAM (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| OCI IAM (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI IAM (one staging copy) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (one staging copy) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| OCI IAM (two staging copies) | Origin list price · IAM / STS management requests | 0 | USD/requests |
| OCI IAM (two staging copies) | Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| OCI IAM (two staging copies) | Principals and roles | 1,000 | principals |
| OCI IAM (two staging copies) | Policies per principal | 2 | policies/principal |
| OCI IAM (two staging copies) | Mean policy document size | 4,096 | bytes |
| OCI IAM (two staging copies) | Policy record expansion | 1.5 | multiplier |
| OCI IAM (two staging copies) | Management requests that mutate state | 0.1 | fraction |
| OCI IAM (two staging copies) | Target price guess · read | 0 | USD/read |
| OCI IAM (two staging copies) | Target price guess · write | 0 | USD/write |
| OCI IAM (two staging copies) | Target list price · provider operation | 0 | USD/provider operation |
| OCI IAM (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| OCI IAM (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| OCI IAM (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| OCI IAM (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| OCI IAM (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| OCI IAM (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| OCI IAM (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| OCI IAM (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| OCI IAM (two staging copies) | Target price guess · input token | 0 | USD/input token |
| OCI IAM (two staging copies) | Target price guess · output token | 0 | USD/output token |
| OCI IAM (two staging copies) | Target monthly base charge | 0 | USD/month |
| OCI IAM (two staging copies) | Approximate target service minimum | 0 | USD/month |
| OCI IAM (two staging copies) | Minimum primary CPU | 2 | vCPU |
| OCI IAM (two staging copies) | Minimum primary RAM | 8 | GiB |
| OCI IAM (two staging copies) | Minimum primary disk | 100 | GiB |
| OCI IAM (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| OCI IAM (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| OCI IAM (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| OCI IAM (two staging copies) | Planning peak / mean work | 2 | multiplier |
| OCI IAM (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| OCI IAM (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| OCI IAM (two staging copies) | Planning disk utilization | 0.8 | fraction |
| OCI IAM (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| OCI IAM (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| OCI IAM (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| OCI IAM (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| OCI IAM (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-ashburn-1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.
* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.
* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs. OCI bills only identity-domain premium or external users, SMS and tokens above 10,000 a month, none of which this family uses.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS IAM User Guide: What is IAM: [https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
* OCI price list: [https://www.oracle.com/cloud/price-list/](https://www.oracle.com/cloud/price-list/)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-9efbb4ad5b81bf0caeda01c49cfdf2dd9b017b71` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [OCI price list](https://www.oracle.com/cloud/price-list/).

**AWS IAM and STS → OCI IAM: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-ashburn-1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: IAM / STS management requests | 0.00 |
| Origin: In-process policy authorization decisions | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations | 0.00 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **0.00** |
| **Target service subtotal** | **118.18** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* Premium identity licenses, external federation providers, directory synchronization and all protected resource-service charges.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · IAM / STS management requests | 0 | USD/requests |
| Origin list price · In-process policy authorization decisions | 0 | USD/decisions |
| Principals and roles | 1,000 | principals |
| Policies per principal | 2 | policies/principal |
| Mean policy document size | 4,096 | bytes |
| Policy record expansion | 1.5 | multiplier |
| Management requests that mutate state | 0.1 | fraction |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| IAM / STS management requests | 1,000,000 | requests |
| In-process policy authorization decisions | 10,000,000 | decisions |

* Translated reads: 10,900,000 operations.

* Translated writes: 100,000 operations.

* Translated resident physical data: 0.0114 GiB-month.

* Native provider operations: 1,000,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Native/deployment comparison scope: This mapping provisions native target-cloud permissions. Application authorization uses the target cloud's identity system; requests do not pass through an IAM service adapter. The IAM-to-Cedar adapter has separate service levels.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* Free source IAM APIs do not imply zero adapted compute/state cost. In-process Cedar decisions are not separately billed cloud IAM decisions.

* Native policy translation does not create paid Entra seats or premium identity licenses automatically. Those licensed users require explicit separate quantities.

* Identity and access management APIs are free. Durable adapter state and hosting remain independent costs. OCI bills only identity-domain premium or external users, SMS and tokens above 10,000 a month, none of which this family uses.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-9efbb4ad5b81bf0caeda01c49cfdf2dd9b017b71` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS IAM User Guide: What is IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html), [OCI price list](https://www.oracle.com/cloud/price-list/).

## Costs

Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications.

| Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping |
| - | - | - | -: | -: | -: | - |
| Cedar | Local authorization decisions: 100 operations/s; one copy | Cited list prices, 2026-10-22 | 0.00 | 80.90 | +80.90 | Service adapter |
| IAM | Local authorization decisions: 100 operations/s; one staging copy | Cited list prices, 2026-10-22 | 0.00 | 118.18 | +118.18 | Native or deployment |
| IAM | Local authorization decisions: 100 operations/s; one staging copy | Cited list prices, 2026-10-22 | 0.00 | 118.18 | +118.18 | Native or deployment |
| OCI IAM | Local authorization decisions: 100 operations/s; one staging copy | Cited list prices, 2026-10-22 | 0.00 | 118.18 | +118.18 | Native or deployment |

Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows.
Cost curves across workload sizes, with every assumption and exclusion: [IAM costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-iam).

## Service level agreements

> [!WARNING]
>
> These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment.

Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status.

See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md).

### IAM to Cedar

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | Tests whether the covered IAM, STS and authorization services can be reached, separately from whether they handle requests correctly. |
| Time for an in-adapter permission check | 5 ms monthly p99 | Permission check inside the adapter | Request context ≤4 KiB; ≤1,000 relevant policies and ≤1,000 entities; total policy/entity data ≤1 MiB. Policy complexity must stay within the limits in your agreement. |
| Administration adapter-added latency | +20 ms monthly p99 | `aws::1.0.0::iam`: `CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`, `UpdateAssumeRolePolicy`, `UpdateRole`, `UpdateRoleDescription`, `TagRole`, `UntagRole`, `ListRoleTags`, `CreatePolicy`, `GetPolicy`, `ListPolicies`, `DeletePolicy`, `CreatePolicyVersion`, `GetPolicyVersion`, `ListPolicyVersions`, `SetDefaultPolicyVersion`, `DeletePolicyVersion`, `TagPolicy`, `UntagPolicy`, `ListPolicyTags`, `PutRolePolicy`, `GetRolePolicy`, `ListRolePolicies`, `DeleteRolePolicy`, `AttachRolePolicy`, `DetachRolePolicy`, `ListAttachedRolePolicies`, `ListEntitiesForPolicy`, `CreateInstanceProfile`, `GetInstanceProfile`, `ListInstanceProfiles`, `ListInstanceProfilesForRole`, `DeleteInstanceProfile`, `AddRoleToInstanceProfile`, `RemoveRoleFromInstanceProfile`, `TagInstanceProfile`, `UntagInstanceProfile`, `ListInstanceProfileTags`, `CreateOpenIDConnectProvider`, `GetOpenIDConnectProvider`, `ListOpenIDConnectProviders`, `DeleteOpenIDConnectProvider`, `UpdateOpenIDConnectProviderThumbprint`, `AddClientIDToOpenIDConnectProvider`, `RemoveClientIDFromOpenIDConnectProvider`, `TagOpenIDConnectProvider`, `UntagOpenIDConnectProvider`, `ListOpenIDConnectProviderTags` | Only the 50 listed IAM operations. Request ≤16 KiB; response ≤64 KiB; each list page ≤100 entries. |
| GetCallerIdentity, AssumeRole, AssumeRoleWithWebIdentity adapter-added latency | +50 ms monthly p99 | `aws::1.0.0::sts`: `GetCallerIdentity`, `AssumeRole`, `AssumeRoleWithWebIdentity` | Request/input token ≤16 KiB. Use supported request options and token formats. |
| Authorization correctness | Never grant access because a check failed or is unsupported | Permission check inside the adapter | An explicit deny overrides an allow; no matching allow means deny. Respect role/session permissions and expiry. Correct denials are successful checks; missing usable policies are failures. |
| Saving and applying policy updates | Save policies durably before confirming success | `aws::1.0.0::iam`: `CreateRole`, `DeleteRole`, `UpdateAssumeRolePolicy`, `UpdateRole`, `UpdateRoleDescription`, `TagRole`, `UntagRole`, `CreatePolicy`, `DeletePolicy`, `CreatePolicyVersion`, `SetDefaultPolicyVersion`, `DeletePolicyVersion`, `TagPolicy`, `UntagPolicy`, `PutRolePolicy`, `DeleteRolePolicy`, `AttachRolePolicy`, `DetachRolePolicy`, `CreateInstanceProfile`, `DeleteInstanceProfile`, `AddRoleToInstanceProfile`, `RemoveRoleFromInstanceProfile`, `TagInstanceProfile`, `UntagInstanceProfile`, `CreateOpenIDConnectProvider`, `DeleteOpenIDConnectProvider`, `UpdateOpenIDConnectProviderThumbprint`, `AddClientIDToOpenIDConnectProvider`, `RemoveClientIDFromOpenIDConnectProvider`, `TagOpenIDConnectProvider`, `UntagOpenIDConnectProvider` | Check a complete policy update before installing it. Each adapter must switch to the full update at once, without mixing old and new policies. |
| Distributing policy updates | Updates reach other adapters, but no fixed deadline is promised | Distributing updates to adapters using those policies | No fixed deadline for every adapter to receive a policy change or revoke access. One health check or Explain report cannot confirm that all adapters have updated. |
| Adapter autoscaling and limits | Automatic scaling within agreed traffic and deployment limits | Adapter behavior across requests | Set separate limits for completed IAM operations, STS operations and authorization checks. Include policy/entity complexity, readiness to serve requests, policy-update traffic, traffic growth and bursts, and spare capacity for failures. The standard service level promises no fixed request rate, reserved throughput or unlimited scaling. Backend capacity is separate. Adapter scaling delays still count toward the SLA while traffic stays within the agreed limits. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** Latency targets measure the time Tensor9's adapter adds to backend processing, not the application's total elapsed time. They do not replace the backend provider's SLA. Adapter time covers permission checks, deciding whether to accept a request, time waiting inside the adapter, request handling, coordination, retries, internal storage and response handling. Waiting for the backend service is excluded only when that wait is measured separately and the agreement allows the exclusion. Your agreement must name the covered deployment, operations, request limits and traffic limits. Unlisted operations are not automatically covered. Correct data and authorization behavior is required for every supported request; endpoint reachability does not excuse incorrect results.

**Scaling limits.** Tensor9 automatically adds adapter capacity within the traffic growth, burst size and infrastructure limits in your agreement. The standard service level does not promise a fixed request rate or unlimited scaling. Capacity depends on request sizes and types, how traffic is distributed across keys or message groups, backend configuration and spare capacity for failures. More adapter processes cannot speed up every shared or sequential step. You remain responsible for backend-service capacity; failures caused independently by the provider are outside this SLA.

**Read the details.** Each linked service page lists the covered operations, request limits, measurement rules, data guarantees, scaling limits and examples. This summary does not add coverage beyond those terms. Your signed agreement determines the service levels that apply to your deployment.

#### Adapter and scope

These standard terms cover supported AWS IAM administration, supported AWS STS operations, and embedded authorization using Cedar. Each is measured separately, even when the same application uses all three.

| Field | Value |
| - | - |
| Origin profile | `aws::1.0.0::iam` |
| Backend profile | `cedar::1.0.0::policy` |
| Backend display name | Cedar |

Cedar is Tensor9's authorization mechanism, not an independently operated backend service whose execution can be excluded. Policy lookup, context construction, Cedar evaluation and enforcement are adapter work.

Your signed agreement determines which components enforce permissions, the deployment requirements, and the policy complexity and traffic levels covered.

#### Latency targets

Any stricter limits of the individual APIs still apply. The table's size limits define which requests receive a latency target; they do not increase IAM's allowed request sizes. Larger supported responses have no latency target under these standard terms and must not be truncated to qualify.

Counting policies and entities does not tell you how long permission checks take. The agreed workload must also describe the complexity of conditions, policy matching, request context, and the mix of allowed and denied requests. Testing an empty policy set that always allows access does not represent that workload.

#### Covered IAM operations

The administration service level includes exactly these 50 operations. Each operation retains its own measurement even when several share a row and the administration latency budget.

| IAM group | Covered operations |
| - | - |
| Roles (10) | `CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`, `UpdateAssumeRolePolicy`, `UpdateRole`, `UpdateRoleDescription`, `TagRole`, `UntagRole`, `ListRoleTags` |
| Managed policies (12) | `CreatePolicy`, `GetPolicy`, `ListPolicies`, `DeletePolicy`, `CreatePolicyVersion`, `GetPolicyVersion`, `ListPolicyVersions`, `SetDefaultPolicyVersion`, `DeletePolicyVersion`, `TagPolicy`, `UntagPolicy`, `ListPolicyTags` |
| Inline policies (4) | `PutRolePolicy`, `GetRolePolicy`, `ListRolePolicies`, `DeleteRolePolicy` |
| Attachments (4) | `AttachRolePolicy`, `DetachRolePolicy`, `ListAttachedRolePolicies`, `ListEntitiesForPolicy` |
| Instance profiles (10) | `CreateInstanceProfile`, `GetInstanceProfile`, `ListInstanceProfiles`, `ListInstanceProfilesForRole`, `DeleteInstanceProfile`, `AddRoleToInstanceProfile`, `RemoveRoleFromInstanceProfile`, `TagInstanceProfile`, `UntagInstanceProfile`, `ListInstanceProfileTags` |
| OIDC providers (10) | `CreateOpenIDConnectProvider`, `GetOpenIDConnectProvider`, `ListOpenIDConnectProviders`, `DeleteOpenIDConnectProvider`, `UpdateOpenIDConnectProviderThumbprint`, `AddClientIDToOpenIDConnectProvider`, `RemoveClientIDFromOpenIDConnectProvider`, `TagOpenIDConnectProvider`, `UntagOpenIDConnectProvider`, `ListOpenIDConnectProviderTags` |

The list-operation limit applies to one response page, not an SDK paginator reading all pages. Supported requests outside the latency payload limits retain their documented behavior without inheriting the bounded-request latency targets.

The separate STS set contains exactly `GetCallerIdentity`, `AssumeRole` and `AssumeRoleWithWebIdentity`. Those names refer to STS operations, not additional IAM operations. Unsupported session-policy or MFA forms do not acquire a guarantee from inclusion of the operation name.

#### Embedded enforcement is not another IAM API

The permission-check latency target applies while the adapter handles a supported application request. The agreement must name the components enforcing permissions and the application operations whose permission checks are measured. This is part of request handling, not a separate API call or another name for `SimulatePrincipalPolicy`.

`SimulatePrincipalPolicy` is not covered by these standard terms. Its separately described partial support does not substitute for a real enforcement guarantee. A check that only reports a decision without enforcing it does not meet this requirement.

An S3 request can have an SLA for the object operation and another for its permission check. Time spent checking permissions can count toward both targets, but is counted only once in the request's total elapsed time.

#### Permission decisions and failures

A correct permission check can allow or deny access under the policy. Denying access when the policy requires it is the documented behavior, not a malfunction.

If the adapter cannot load usable policy data, it must refuse the request to prevent unsafe access. That is still an adapter failure. It must not be counted as a normal policy denial just because both cases refuse access.

Similarly, a successful policy update does not prove every permission-checking component has received it. Saving a policy, checking permissions, and distributing policy updates are measured separately.

#### Timing and external waits

Depending on the operation, adapter latency includes loading policies, preparing request context, checking signatures and identity claims, checking trust rules, issuing credentials, using local caches, and retrying. Accessing the adapter's policy store also counts, even when it uses a managed database.

For STS, time spent waiting for an external identity provider or retrieving external keys can be excluded only when separately measured and allowed by the agreement. Local cache work and local retry delays still count toward adapter latency. Cedar evaluation always counts toward adapter latency.

#### Security, policy durability and consistency

The adapter must:

* Allow access only when the supported IAM-to-Cedar policy rules permit it.
* Preserve explicit-deny precedence, deny access by default, and respect role and session restrictions and expiration.
* Reject unsupported restrictions rather than silently ignoring them.
* Save covered policy changes durably in the policy store before returning success.
* Install a complete, verified policy snapshot in one step, without mixing parts of old and new versions.

The adapter must never allow a request because it could not complete a permission check, even to meet a latency or endpoint-reachability target. A suspected authorization bypass requires investigation regardless of performance measurements.

##### Policy propagation is eventual

The standard terms contain **no fixed policy-propagation or global-revocation deadline**. A successful update means the policy was saved durably. It does not prove that every permission-checking component has received and applied the change.

Checking one component, reading the policy store, or obtaining an Explain report does not prove that every component has the latest policy. Work already authorized and in progress is not cancelled by a later policy update.

An older otherwise valid snapshot can explain a decision made shortly after a policy update. The adapter must still distribute updates as documented; it cannot keep using old policies indefinitely. Support checks which policy versions the components have and whether updates are reaching them.

If your application requires an immediate global revocation deadline, discuss that requirement before choosing these terms. The standard terms do not provide an immediate global revocation deadline.

#### Scaling and limits

The standard production model automatically adds adapter capacity within the agreement's workload limits. Each new permission-checking component must load usable policies before handling requests. Starting an instance does not make it ready to check permissions.

Decision cost depends on policy and entity representation, conditions, context and matching behavior. Policy distribution and shared administration state can constrain growth even when decision execution is local. A workload combining policy administration, STS, and permission checks needs its own agreed limits.

No numerical maximum decision or administration rate is assigned here. An approved limit must describe completed decisions or operations, policy complexity, memory demand, components ready to enforce permissions, update traffic, allowed traffic bursts and spare capacity for failures. Correct denies count as evaluated decisions; failures caused by unusable adapter policy data do not.

#### Worked example: authorize an object request

An application sends a supported S3 operation to an enforcing adapter with usable policy state. The authorizer constructs the principal, action, resource and context, evaluates the applicable policy, and enforces the result.

Both a correct permit and a correct deny are valid outcomes. Preparing and evaluating the decision count toward the permission-check latency target. If allowed, the request continues to the backend service. The object operation has its own timing measurements.

#### Worked example: unavailable or recently changed policy state

If a permission-checking component cannot load usable policies, refusing the request prevents unsafe access. Support still records this as an adapter failure, not an intentional policy denial.

If the problem instead follows a role-policy update, compare the saved policy update with the policy version used by the permission-checking component. If the component used an older valid policy version, investigate whether the update reached it. If it decided incorrectly under the version it used, investigate policy evaluation or enforcement. The HTTP status alone cannot tell you which happened.

#### Evidence for support

Preserve the affected application operation, permission check, or policy-administration operation, sanitized policy structure, relevant revision identifiers, result, timestamps and request identifiers. Describe policy-size or update-frequency changes that preceded the incident.

Use an Explain report to inspect the evidence it actually captured. It cannot prove decisions it did not capture or show that every component has the latest policy. `x-t9-explain: true` executes the request while recording an explanation, so do not replay policy mutations to gather evidence without considering their effects.

Never include credentials, signed tokens, session secrets or unredacted sensitive policy context in a support bundle. Tensor9 can help investigate with redacted policy structure and request identifiers; you do not need to prove whether evaluation, propagation or state availability was responsible before requesting help.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::iam
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

## Material evaluation limit

Identity administration, deny behavior, workload identity and credential lifecycle can differ by target. Validate the complete authorization path before migration.

Treat this as an evaluation warning, not a complete compatibility contract. Confirm the exact behavior for your entitled direction before migration.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.