> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KMS

> KMS APIs with Cloud Adapter.

This page describes how KMS maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Azure
* Google Cloud
* OCI

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of KMS with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | KMS | Azure · Key Vault | Azure, Google Cloud, and OCI · Cloud Adapter deployment-hosted software keys | Google Cloud · Cloud KMS |
| - | - | - | - | - |
| Envelope encryption (GenerateDataKey) · a plaintext data key plus its wrapped copy | Yes - GenerateDataKey returns a plaintext data key and its wrapped copy in one call | Partial - served as RSA wrap-key: a random data key wrapped by an RSA key. The pair round-trips, but the wrapping key is RSA, not a symmetric AES key | - | Partial - synthesized: a random data key wrapped by the key's encrypt. There is no single native data-key op, but the envelope round-trips |
| Encryption context (AAD) · additional authenticated data bound into the ciphertext | Yes - an encryption-context map bound as AAD; the same map is required to decrypt | Yes - bound as AES-256-GCM additional authenticated data on the payload, so a mismatched context fails to decrypt | - | Yes - bound natively as Cloud KMS additional authenticated data |
| Symmetric AES · a symmetric encrypt/decrypt key | Yes - a symmetric AES customer master key | Partial - symmetric Encrypt and Decrypt work through an envelope: AES-256-GCM runs in the adapter and the vault's RSA-3072 key wraps each data key, so the key you see in the vault is RSA, not AES | - | Yes - a symmetric encrypt/decrypt crypto key |
| Asymmetric sign / verify · RSA / EC signing keys | Yes - asymmetric Sign / Verify with RSA or EC keys | No - asymmetric keys are not supported; Sign, Verify and GetPublicKey return UnsupportedOperationException | - | No - asymmetric keys are not supported; Sign, Verify and GetPublicKey return UnsupportedOperationException |
| HMAC (MAC sign / verify) · a keyed message authentication code | Yes - GenerateMac / VerifyMac with an HMAC key | No - HMAC keys are not supported; GenerateMac and VerifyMac return UnsupportedOperationException | - | No - HMAC keys are not supported; GenerateMac and VerifyMac return UnsupportedOperationException |
| Key rotation · automatic and on-demand rotation | Yes - automatic and on-demand key rotation | No - neither automatic nor on-demand rotation is supported on a vault key | - | Partial - automatic rotation uses the crypto key's rotation period; on-demand rotation is not supported |
| Aliases · a mutable name pointing at a key | Yes - a mutable alias pointing at a key id | Yes - the adapter maintains the alias-to-key mapping, since Key Vault has no separate alias object | - | Yes - the adapter maintains the alias-to-key mapping, since Cloud KMS has no native alias object |
| API coverage | full | partial | partial | high |

## On Azure

### Key Vault

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| CreateAlias | Aliases | Supported | Most usage | the adapter maintains the alias-to-key mapping and resolves alias references, since Key Vault addresses a key by name with no separate alias object |
| DeleteAlias | Aliases | Supported | Full surface | removes an alias from the mapping |
| ListAliases | Aliases | Supported | Most usage | lists aliases retained in adapter state |
| UpdateAlias | Aliases | Supported | Full surface | changes the key referenced by an alias in adapter state |
| DeriveSharedSecret | Asymmetric | Out of scope | Full surface | elliptic-curve shared-secret derivation has no Key Vault equivalent op and is rejected |
| GetPublicKey | Asymmetric | Out of scope | Most usage | not supported; the call returns UnsupportedOperationException |
| Sign | Asymmetric | Out of scope | Most usage | asymmetric keys are not supported; the call returns UnsupportedOperationException |
| Verify | Asymmetric | Out of scope | Most usage | not supported; the call returns UnsupportedOperationException |
| GenerateDataKey | Envelope / data keys | Partial | Common | the envelope is served as wrap-key: a fresh random data key is generated and wrapped by an RSA-3072 key (RSA-OAEP-256); the returned pair round-trips, but the wrapping key is RSA, not a symmetric AES key |
| GenerateDataKeyPair | Envelope / data keys | Out of scope | Most usage | asymmetric data-key pairs are not supported; the call returns UnsupportedOperationException |
| GenerateDataKeyPairWithoutPlaintext | Envelope / data keys | Out of scope | Full surface | not supported; the call returns UnsupportedOperationException |
| GenerateDataKeyWithoutPlaintext | Envelope / data keys | Partial | Most usage | the same wrap-key path, returning only the wrapped data key |
| CreateGrant | Grants | Out of scope | Most usage | authorization is governed by Azure role assignments rather than KMS grants, so a grant is rejected |
| ListGrants | Grants | Out of scope | Most usage | there is no grant to list; access is an Azure role assignment |
| ListRetirableGrants | Grants | Out of scope | Full surface | there is no grant to list |
| RetireGrant | Grants | Out of scope | Full surface | there is no grant to retire |
| RevokeGrant | Grants | Out of scope | Full surface | there is no grant to revoke |
| GenerateMac | HMAC | Out of scope | Most usage | HMAC keys are not supported; the call returns UnsupportedOperationException |
| VerifyMac | HMAC | Out of scope | Most usage | there is no HMAC key on a standard vault to verify against |
| DeleteImportedKeyMaterial | Imported key material | Out of scope | Full surface | there is no runtime imported-material lifecycle to drive |
| GetParametersForImport | Imported key material | Out of scope | Full surface | imported key material is loaded through Key Vault's own key-import flow at provisioning, not through the native import handshake, so the runtime import ops are rejected |
| ImportKeyMaterial | Imported key material | Out of scope | Full surface | the import handshake is not served at runtime; material is imported at provisioning |
| CancelKeyDeletion | Key management | Supported | Full surface | cancels pending deletion in adapter state; native recovery also applies if deletion in the backend has begun |
| CreateKey | Key management | Partial | Common | a symmetric AWS key is created as an RSA-3072 wrapKey/unwrapKey key in the vault; any KeySpec other than SYMMETRIC\_DEFAULT, KeyUsage other than ENCRYPT\_DECRYPT, Origin other than AWS\_KMS, MultiRegion=true or a custom key store is rejected |
| DescribeKey | Key management | Supported | Common | returns AWS key identity and lifecycle metadata: identifier, enabled state and any pending deletion |
| DisableKey | Key management | Supported | Most usage | clears the key's enabled attribute |
| EnableKey | Key management | Supported | Most usage | sets the key's enabled attribute |
| ListKeys | Key management | Supported | Common | lists the keys in the vault |
| ScheduleKeyDeletion | Key management | Partial | Most usage | records the adapter recovery window; vault retention and purge protection govern final removal from the backend |
| UpdateKeyDescription | Key management | Partial | Full surface | a Key Vault key has no description field, so the label is stored as a tag |
| GetKeyPolicy | Key policy | Out of scope | Most usage | there is no per-key policy document to read |
| ListKeyPolicies | Key policy | Out of scope | Full surface | there is no per-key policy document to list |
| PutKeyPolicy | Key policy | Out of scope | Most usage | access is governed by Azure role assignments rather than a per-key policy document, so a per-key policy is rejected |
| ReplicateKey | Multi-region | Out of scope | Full surface | a key lives in a single vault and region; cross-region key replication is rejected |
| UpdatePrimaryRegion | Multi-region | Out of scope | Full surface | there is no multi-region key set whose primary can be moved |
| GenerateRandom | Random | Out of scope | Full surface | not supported; the call returns UnsupportedOperationException |
| DisableKeyRotation | Rotation | Out of scope | Full surface | there is no rotation to disable |
| EnableKeyRotation | Rotation | Out of scope | Most usage | automatic rotation is not supported on a vault key; the request is rejected |
| GetKeyRotationStatus | Rotation | Partial | Most usage | always reports rotation off, because automatic rotation is not supported on a vault key |
| RotateKeyOnDemand | Rotation | Out of scope | Full surface | on-demand rotation is not supported; the call returns UnsupportedOperationException |
| Decrypt | Symmetric crypto | Partial | Common | the vault unwraps the data key at the exact key version that wrapped it (the version travels in the ciphertext, so a key rotation never orphans an older blob) and the payload is opened locally under the same EncryptionContext |
| Encrypt | Symmetric crypto | Partial | Common | served as an envelope: a fresh AES-256-GCM data key encrypts the payload and the vault wraps that data key with RSA-OAEP-256, so the plaintext is not bounded by the RSA modulus and the EncryptionContext binds as AES-GCM additional authenticated data; Partial rather than Supported because the key IN the vault is RSA, so a caller inspecting it there does not find the symmetric CMK AWS would show |
| ReEncrypt | Symmetric crypto | Partial | Most usage | served as a decrypt-then-encrypt across the two RSA keys under the adapter; the plaintext is never returned to the caller |
| ListResourceTags | Tags | Supported | Full surface | lists the tags on the key |
| TagResource | Tags | Supported | Full surface | attaches key/value tags to the key |
| UntagResource | Tags | Supported | Full surface | removes tags |

#### How it works

Tensor9 runs a KMS adapter in your environment and sets `AWS_ENDPOINT_URL_KMS` to its local endpoint, so your AWS SDK calls such as `Encrypt`, `Decrypt` and `GenerateDataKey` reach it unchanged. For each `Encrypt`, the adapter makes a new AES-256-GCM data key, encrypts your data locally, and has an RSA key in Key Vault wrap the data key with RSA-OAEP-256. Your plaintext size is not limited by the RSA key, and the encryption context is bound to the ciphertext as in AWS.

The private key never leaves the vault. Every `Decrypt` is a vault operation that appears in the vault's audit log, and removing the adapter's access to the key makes every existing ciphertext undecryptable. Each `Encrypt` and `Decrypt` costs one round trip to the vault.

![Your application keeps its AWS KMS SDK. On Azure it calls a Tensor9 KMS adapter, which encrypts locally and has an RSA key in Azure Key Vault wrap each data key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk0IiB2aWV3Qm94PSIwIDAgODM2IDE5NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uIGtlZXBzIGl0cyBBV1MgS01TIFNESy4gT24gQXp1cmUgaXQgY2FsbHMgYSBUZW5zb3I5IEtNUyBhZGFwdGVyLCB3aGljaCBlbmNyeXB0cyBsb2NhbGx5IGFuZCBoYXMgYW4gUlNBIGtleSBpbiBBenVyZSBLZXkgVmF1bHQgd3JhcCBlYWNoIGRhdGEga2V5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJrdjEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODIiIHdpZHRoPSIxMTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODUiIHk9IjExMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMi41cHgiPllvdXIgYXBwPC90ZXh0Pgo8dGV4dCB4PSI4NSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPkFXUyBLTVMgU0RLPC90ZXh0Pgo8bGluZSB4MT0iMTQwIiB5MT0iMTE1IiB4Mj0iMjE2IiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjE3OCIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5FbmNyeXB0PC90ZXh0Pgo8dGV4dCB4PSIxNzgiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4LjVweCI+RGVjcnlwdDwvdGV4dD4KPHJlY3QgeD0iMjIwIiB5PSI4MCIgd2lkdGg9IjE2NCIgaGVpZ2h0PSI3MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzMDIiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMi41cHgiPkFXUyBLTVM8L3RleHQ+Cjx0ZXh0IHg9IjMwMiIgeT0iMTI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPmtleSBzdGF5cyBpbiBBV1M8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0MCIgeDI9IjQxOCIgeTI9IjE2NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6I2NiZDVlMSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMwNDc4NTciPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NDgiIHk9IjgyIiB3aWR0aD0iODYiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDkxIiB5PSIxMTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+WW91ciBhcHA8L3RleHQ+Cjx0ZXh0IHg9IjQ5MSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPnNhbWUgU0RLPC90ZXh0Pgo8bGluZSB4MT0iNTM0IiB5MT0iMTE1IiB4Mj0iNTY0IiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjU2OCIgeT0iNzYiIHdpZHRoPSIxMTgiIGhlaWdodD0iODIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjI3IiB5PSIxMDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+VGVuc29yOTwvdGV4dD4KPHRleHQgeD0iNjI3IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPktNUyBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjYyNyIgeT0iMTMxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5hZGFwdGVyPC90ZXh0Pgo8bGluZSB4MT0iNjg2IiB5MT0iMTE1IiB4Mj0iNzEyIiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjcxNCIgeT0iODIiIHdpZHRoPSIxMDIiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNzY1IiB5PSIxMDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTAuNXB4Ij5BenVyZSBLZXkgVmF1bHQ8L3RleHQ+Cjx0ZXh0IHg9Ijc2NSIgeT0iMTI0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPmFuIFJTQSBrZXk8L3RleHQ+Cjwvc3ZnPg==)

![Your application keeps its AWS KMS SDK. On Azure it calls a Tensor9 KMS adapter, which encrypts locally and has an RSA key in Azure Key Vault wrap each data key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTk0IiB2aWV3Qm94PSIwIDAgODM2IDE5NCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uIGtlZXBzIGl0cyBBV1MgS01TIFNESy4gT24gQXp1cmUgaXQgY2FsbHMgYSBUZW5zb3I5IEtNUyBhZGFwdGVyLCB3aGljaCBlbmNyeXB0cyBsb2NhbGx5IGFuZCBoYXMgYW4gUlNBIGtleSBpbiBBenVyZSBLZXkgVmF1bHQgd3JhcCBlYWNoIGRhdGEga2V5LiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJrdjEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODIiIHdpZHRoPSIxMTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODUiIHk9IjExMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMi41cHgiPllvdXIgYXBwPC90ZXh0Pgo8dGV4dCB4PSI4NSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPkFXUyBLTVMgU0RLPC90ZXh0Pgo8bGluZSB4MT0iMTQwIiB5MT0iMTE1IiB4Mj0iMjE2IiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjE3OCIgeT0iMTA2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5FbmNyeXB0PC90ZXh0Pgo8dGV4dCB4PSIxNzgiIHk9IjEzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4LjVweCI+RGVjcnlwdDwvdGV4dD4KPHJlY3QgeD0iMjIwIiB5PSI4MCIgd2lkdGg9IjE2NCIgaGVpZ2h0PSI3MCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzMDIiIHk9IjEwOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMi41cHgiPkFXUyBLTVM8L3RleHQ+Cjx0ZXh0IHg9IjMwMiIgeT0iMTI2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPmtleSBzdGF5cyBpbiBBV1M8L3RleHQ+CjxsaW5lIHgxPSI0MTgiIHkxPSI0MCIgeDI9IjQxOCIgeTI9IjE2NiIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJzdHJva2U6IzQ3NTU2OSIvPgo8cmVjdCB4PSI0MzYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMiIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ1MCIgeT0iNjIiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiM2ZWU3YjciPk9OIEFaVVJFPC90ZXh0Pgo8cmVjdCB4PSI0NDgiIHk9IjgyIiB3aWR0aD0iODYiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDkxIiB5PSIxMTAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+WW91ciBhcHA8L3RleHQ+Cjx0ZXh0IHg9IjQ5MSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjAwIDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPnNhbWUgU0RLPC90ZXh0Pgo8bGluZSB4MT0iNTM0IiB5MT0iMTE1IiB4Mj0iNTY0IiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjU2OCIgeT0iNzYiIHdpZHRoPSIxMTgiIGhlaWdodD0iODIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjI3IiB5PSIxMDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+VGVuc29yOTwvdGV4dD4KPHRleHQgeD0iNjI3IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPktNUyBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjYyNyIgeT0iMTMxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5hZGFwdGVyPC90ZXh0Pgo8bGluZSB4MT0iNjg2IiB5MT0iMTE1IiB4Mj0iNzEyIiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjcxNCIgeT0iODIiIHdpZHRoPSIxMDIiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNzY1IiB5PSIxMDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTAuNXB4Ij5BenVyZSBLZXkgVmF1bHQ8L3RleHQ+Cjx0ZXh0IHg9Ijc2NSIgeT0iMTI0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPmFuIFJTQSBrZXk8L3RleHQ+Cjwvc3ZnPg==)

Your KMS calls go to a Tensor9 adapter; an RSA key in Azure Key Vault wraps each data key.

#### Key identity and lifecycle

The adapter keeps records of your AWS key IDs, aliases, tags and key state. `CreateKey` creates the matching key in the vault, and later requests resolve the AWS key ID to it. Key Vault performs the cryptographic operations and keeps the key material.

An alias is a name the adapter keeps. Updating it changes which key later alias-based requests use; it does not move key material or rewrite existing ciphertext. Back up the adapter's records, and keep the vault keys and versions needed to decrypt stored data.

`ScheduleKeyDeletion` records a waiting period of 7 to 30 days, 30 by default. Cancelling it leaves the key disabled; enable it before using it again. Final removal from the vault follows Key Vault's own retention rules, which can keep the key longer than the adapter's waiting period.

#### The key in your vault

Each KMS key is an RSA 3072 key in your vault whose permitted operations are `wrapKey` and `unwrapKey`. A standard vault holds RSA and EC keys only; it has no symmetric AES key, so the adapter does the symmetric encryption itself. `DescribeKey` reports the key's ID and state, and the adapter stores the AWS key description as a tag.

Key Vault keeps every version of a key. The version that wrapped a data key is written into the ciphertext, and `Decrypt` unwraps with that exact version, so a new key version never strands older ciphertext.

![Your application's KMS calls reach one RSA key in Key Vault that may only wrap and unwrap data keys. Key Vault keeps every version of the key. A standard vault has no symmetric AES keys.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjU2IiB2aWV3Qm94PSIwIDAgODM2IDI1NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uJ3MgS01TIGNhbGxzIHJlYWNoIG9uZSBSU0Ega2V5IGluIEtleSBWYXVsdCB0aGF0IG1heSBvbmx5IHdyYXAgYW5kIHVud3JhcCBkYXRhIGtleXMuIEtleSBWYXVsdCBrZWVwcyBldmVyeSB2ZXJzaW9uIG9mIHRoZSBrZXkuIEEgc3RhbmRhcmQgdmF1bHQgaGFzIG5vIHN5bW1ldHJpYyBBRVMga2V5cy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0ia3YyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJrdjJiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM0ZjQ2ZTUiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzMzNDE1NSI+T05FIFJTQSBLRVkgSU4gVEhFIFZBVUxUIMK3IElUIE9OTFkgV1JBUFMgQU5EIFVOV1JBUFMgREFUQSBLRVlTPC90ZXh0Pgo8cmVjdCB4PSIyNiIgeT0iMTA0IiB3aWR0aD0iMTA0IiBoZWlnaHQ9Ijg2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9Ijc4IiB5PSIxNDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+WW91ciBhcHA8L3RleHQ+Cjx0ZXh0IHg9Ijc4IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+QVdTIEtNUyBTREs8L3RleHQ+CjxsaW5lIHgxPSIxMzQiIHkxPSIxMzAiIHgyPSIyNjQiIHkyPSIxMzAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNrdjIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMTk5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij5DcmVhdGVLZXkgwrcgRW5jcnlwdCDCtyBEZWNyeXB0PC90ZXh0Pgo8bGluZSB4MT0iMjY0IiB5MT0iMTY0IiB4Mj0iMTM0IiB5Mj0iMTY0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YyKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjE5OSIgeT0iMTc4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+RGVzY3JpYmVLZXk8L3RleHQ+CjxyZWN0IHg9IjI3MiIgeT0iNDYiIHdpZHRoPSI1MzgiIGhlaWdodD0iMTk4IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNGY0NmU1Ii8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDI4OCw1NikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojNGY0NmU1Ii8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojNGY0NmU1Ii8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6I2ZmZmZmZiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojZmZmZmZmIi8+PC9nPgo8dGV4dCB4PSIzMTIiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ic3RhcnQiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweDtmaWxsOiM0ZjQ2ZTUiPkF6dXJlIEtleSBWYXVsdDwvdGV4dD4KPHRleHQgeD0iNzk0IiB5PSI3MCIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPmEga2V5IGluIHlvdXIgdmF1bHQ8L3RleHQ+CjxyZWN0IHg9IjI4OCIgeT0iODIiIHdpZHRoPSI1MDYiIGhlaWdodD0iNzIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNlZWYyZmYiLz4KPHRleHQgeD0iMzA0IiB5PSIxMDYiIHRleHQtYW5jaG9yPSJzdGFydCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTFweCI+a2V5X3R5cGU6IDx0c3BhbiBzdHlsZT0iZmlsbDojNGY0NmU1Ij5SU0E8L3RzcGFuPiAgIMK3ICAga2V5X3NpemU6IDx0c3BhbiBzdHlsZT0iZmlsbDojNGY0NmU1Ij4zMDcyPC90c3Bhbj48L3RleHQ+Cjx0ZXh0IHg9IjMwNCIgeT0iMTM0IiB0ZXh0LWFuY2hvcj0ic3RhcnQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTU7Zm9udC1zaXplOjEwcHgiPmtleV9vcHM6IFt3cmFwS2V5LCB1bndyYXBLZXldPC90ZXh0Pgo8dGV4dCB4PSIzMDQiIHk9IjE3NiIgdGV4dC1hbmNob3I9InN0YXJ0IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+aW1tdXRhYmxlIHZlcnNpb25zOyBhIG5ldyB2ZXJzaW9uIGJlY29tZXMgY3VycmVudDwvdGV4dD4KPHJlY3QgeD0iMzA0IiB5PSIxODYiIHdpZHRoPSIxMDQiIGhlaWdodD0iNDIiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIzNTYiIHk9IjIwNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzY0NzQ4YiI+djE8L3RleHQ+Cjx0ZXh0IHg9IjM1NiIgeT0iMjIxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+cmV0YWluZWQ8L3RleHQ+CjxsaW5lIHgxPSI0MTAiIHkxPSIyMDciIHgyPSI0MjYiIHkyPSIyMDciIHN0cm9rZS13aWR0aD0iMS42IiBtYXJrZXItZW5kPSJ1cmwoI2t2MikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSI0MjgiIHk9IjE4NiIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI0MiIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ4MCIgeT0iMjA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojNjQ3NDhiIj52MjwvdGV4dD4KPHRleHQgeD0iNDgwIiB5PSIyMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OXB4Ij5yZXRhaW5lZDwvdGV4dD4KPGxpbmUgeDE9IjUzNCIgeTE9IjIwNyIgeDI9IjU1MCIgeTI9IjIwNyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgja3YyYikiIHN0eWxlPSJzdHJva2U6IzRmNDZlNSIvPgo8cmVjdCB4PSI1NTIiIHk9IjE4MiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI1MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjYxMiIgeT0iMjAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzMzNDE1NTsgZmlsbDojNGY0NmU1O2ZvbnQtd2VpZ2h0OjcwMCI+djMgwrcgY3VycmVudDwvdGV4dD4KPHRleHQgeD0iNjEyIiB5PSIyMTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCA5cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM0ZjQ2ZTUiPm5ldyBvcHMgdXNlIGl0PC90ZXh0Pgo8dGV4dCB4PSI2OTAiIHk9IjIwMCIgdGV4dC1hbmNob3I9InN0YXJ0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiM2NDc0OGIiPmEgc3ltbWV0cmljIEFFUzwvdGV4dD4KPHRleHQgeD0iNjkwIiB5PSIyMTMiIHRleHQtYW5jaG9yPSJzdGFydCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojNjQ3NDhiIj5rZXkgaXMgbm90PC90ZXh0Pgo8dGV4dCB4PSI2OTAiIHk9IjIyNiIgdGV4dC1hbmNob3I9InN0YXJ0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweDtmaWxsOiNiNDUzMDkiPmF2YWlsYWJsZSBoZXJlPC90ZXh0Pgo8L3N2Zz4=)

![Your application's KMS calls reach one RSA key in Key Vault that may only wrap and unwrap data keys. Key Vault keeps every version of the key. A standard vault has no symmetric AES keys.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjU2IiB2aWV3Qm94PSIwIDAgODM2IDI1NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uJ3MgS01TIGNhbGxzIHJlYWNoIG9uZSBSU0Ega2V5IGluIEtleSBWYXVsdCB0aGF0IG1heSBvbmx5IHdyYXAgYW5kIHVud3JhcCBkYXRhIGtleXMuIEtleSBWYXVsdCBrZWVwcyBldmVyeSB2ZXJzaW9uIG9mIHRoZSBrZXkuIEEgc3RhbmRhcmQgdmF1bHQgaGFzIG5vIHN5bW1ldHJpYyBBRVMga2V5cy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0ia3YyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJrdjJiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNhNWI0ZmMiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6I2NiZDVlMSI+T05FIFJTQSBLRVkgSU4gVEhFIFZBVUxUIMK3IElUIE9OTFkgV1JBUFMgQU5EIFVOV1JBUFMgREFUQSBLRVlTPC90ZXh0Pgo8cmVjdCB4PSIyNiIgeT0iMTA0IiB3aWR0aD0iMTA0IiBoZWlnaHQ9Ijg2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9Ijc4IiB5PSIxNDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+WW91ciBhcHA8L3RleHQ+Cjx0ZXh0IHg9Ijc4IiB5PSIxNjAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+QVdTIEtNUyBTREs8L3RleHQ+CjxsaW5lIHgxPSIxMzQiIHkxPSIxMzAiIHgyPSIyNjQiIHkyPSIxMzAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNrdjIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMTk5IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij5DcmVhdGVLZXkgwrcgRW5jcnlwdCDCtyBEZWNyeXB0PC90ZXh0Pgo8bGluZSB4MT0iMjY0IiB5MT0iMTY0IiB4Mj0iMTM0IiB5Mj0iMTY0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YyKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjE5OSIgeT0iMTc4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+RGVzY3JpYmVLZXk8L3RleHQ+CjxyZWN0IHg9IjI3MiIgeT0iNDYiIHdpZHRoPSI1MzgiIGhlaWdodD0iMTk4IiByeD0iMTMiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojYTViNGZjIi8+CjxnIHRyYW5zZm9ybT0idHJhbnNsYXRlKDI4OCw1NikiPjxwYXRoIGQ9Ik00IDggVjYgYTUgNSAwIDAgMSAxMCAwIFY4IiBmaWxsPSJub25lIiBzdHJva2Utd2lkdGg9IjEuNyIgc3R5bGU9InN0cm9rZTojYTViNGZjIi8+PHJlY3QgeD0iMiIgeT0iOCIgd2lkdGg9IjE0IiBoZWlnaHQ9IjExIiByeD0iMi4yIiBzdHlsZT0iZmlsbDojYTViNGZjIi8+PGNpcmNsZSBjeD0iOSIgY3k9IjEyLjUiIHI9IjEuNyIgc3R5bGU9ImZpbGw6IzFlMjkzYiIvPjxyZWN0IHg9IjguMiIgeT0iMTMiIHdpZHRoPSIxLjYiIGhlaWdodD0iMy42IiByeD0iMC44IiBzdHlsZT0iZmlsbDojMWUyOTNiIi8+PC9nPgo8dGV4dCB4PSIzMTIiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ic3RhcnQiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweDtmaWxsOiNhNWI0ZmMiPkF6dXJlIEtleSBWYXVsdDwvdGV4dD4KPHRleHQgeD0iNzk0IiB5PSI3MCIgdGV4dC1hbmNob3I9ImVuZCIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPmEga2V5IGluIHlvdXIgdmF1bHQ8L3RleHQ+CjxyZWN0IHg9IjI4OCIgeT0iODIiIHdpZHRoPSI1MDYiIGhlaWdodD0iNzIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiMxZTFiNGIiLz4KPHRleHQgeD0iMzA0IiB5PSIxMDYiIHRleHQtYW5jaG9yPSJzdGFydCIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTFweCI+a2V5X3R5cGU6IDx0c3BhbiBzdHlsZT0iZmlsbDojYTViNGZjIj5SU0E8L3RzcGFuPiAgIMK3ICAga2V5X3NpemU6IDx0c3BhbiBzdHlsZT0iZmlsbDojYTViNGZjIj4zMDcyPC90c3Bhbj48L3RleHQ+Cjx0ZXh0IHg9IjMwNCIgeT0iMTM0IiB0ZXh0LWFuY2hvcj0ic3RhcnQiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTE7Zm9udC1zaXplOjEwcHgiPmtleV9vcHM6IFt3cmFwS2V5LCB1bndyYXBLZXldPC90ZXh0Pgo8dGV4dCB4PSIzMDQiIHk9IjE3NiIgdGV4dC1hbmNob3I9InN0YXJ0IiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+aW1tdXRhYmxlIHZlcnNpb25zOyBhIG5ldyB2ZXJzaW9uIGJlY29tZXMgY3VycmVudDwvdGV4dD4KPHJlY3QgeD0iMzA0IiB5PSIxODYiIHdpZHRoPSIxMDQiIGhlaWdodD0iNDIiIHJ4PSI5IiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIzNTYiIHk9IjIwNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6Izk0YTNiOCI+djE8L3RleHQ+Cjx0ZXh0IHg9IjM1NiIgeT0iMjIxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+cmV0YWluZWQ8L3RleHQ+CjxsaW5lIHgxPSI0MTAiIHkxPSIyMDciIHgyPSI0MjYiIHkyPSIyMDciIHN0cm9rZS13aWR0aD0iMS42IiBtYXJrZXItZW5kPSJ1cmwoI2t2MikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSI0MjgiIHk9IjE4NiIgd2lkdGg9IjEwNCIgaGVpZ2h0PSI0MiIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ4MCIgeT0iMjA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojOTRhM2I4Ij52MjwvdGV4dD4KPHRleHQgeD0iNDgwIiB5PSIyMjEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OXB4Ij5yZXRhaW5lZDwvdGV4dD4KPGxpbmUgeDE9IjUzNCIgeTE9IjIwNyIgeDI9IjU1MCIgeTI9IjIwNyIgc3Ryb2tlLXdpZHRoPSIxLjgiIG1hcmtlci1lbmQ9InVybCgja3YyYikiIHN0eWxlPSJzdHJva2U6I2E1YjRmYyIvPgo8cmVjdCB4PSI1NTIiIHk9IjE4MiIgd2lkdGg9IjEyMCIgaGVpZ2h0PSI1MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS43IiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjYxMiIgeT0iMjAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogI2NiZDVlMTsgZmlsbDojYTViNGZjO2ZvbnQtd2VpZ2h0OjcwMCI+djMgwrcgY3VycmVudDwvdGV4dD4KPHRleHQgeD0iNjEyIiB5PSIyMTkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCA5cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNhNWI0ZmMiPm5ldyBvcHMgdXNlIGl0PC90ZXh0Pgo8dGV4dCB4PSI2OTAiIHk9IjIwMCIgdGV4dC1hbmNob3I9InN0YXJ0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiM5NGEzYjgiPmEgc3ltbWV0cmljIEFFUzwvdGV4dD4KPHRleHQgeD0iNjkwIiB5PSIyMTMiIHRleHQtYW5jaG9yPSJzdGFydCIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHg7ZmlsbDojOTRhM2I4Ij5rZXkgaXMgbm90PC90ZXh0Pgo8dGV4dCB4PSI2OTAiIHk9IjIyNiIgdGV4dC1hbmNob3I9InN0YXJ0IiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweDtmaWxsOiNmYmJmMjQiPmF2YWlsYWJsZSBoZXJlPC90ZXh0Pgo8L3N2Zz4=)

Each KMS key is one RSA key in the vault that may only wrap and unwrap data keys.

#### Envelope encryption and data keys

`GenerateDataKey` returns a plaintext data key and an encrypted (wrapped) copy. Your application encrypts its data locally with the plaintext key, discards it, and stores the wrapped copy beside the encrypted data. To read the data later, it asks KMS to decrypt the wrapped key. `GenerateDataKeyWithoutPlaintext` returns only the wrapped copy.

Behind both, the adapter uses the same envelope as `Encrypt`: the vault's RSA key wraps the data key, and the encryption context is bound to the result. `ReEncrypt` decrypts and encrypts again under the destination key inside the adapter, and never returns the plaintext.

![For each call the adapter makes a random data key and encrypts your data with it. The RSA key in the vault wraps the data key, and the wrapped key is kept with the ciphertext. To read the data, the vault unwraps the data key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjg4IiB2aWV3Qm94PSIwIDAgODM2IDI4OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGb3IgZWFjaCBjYWxsIHRoZSBhZGFwdGVyIG1ha2VzIGEgcmFuZG9tIGRhdGEga2V5IGFuZCBlbmNyeXB0cyB5b3VyIGRhdGEgd2l0aCBpdC4gVGhlIFJTQSBrZXkgaW4gdGhlIHZhdWx0IHdyYXBzIHRoZSBkYXRhIGtleSwgYW5kIHRoZSB3cmFwcGVkIGtleSBpcyBrZXB0IHdpdGggdGhlIGNpcGhlcnRleHQuIFRvIHJlYWQgdGhlIGRhdGEsIHRoZSB2YXVsdCB1bndyYXBzIHRoZSBkYXRhIGtleS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0ia3YzIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJrdjNnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiMwNDc4NTciLz48L21hcmtlcj48bWFya2VyIGlkPSJrdjNiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM0ZjQ2ZTUiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzMzNDE1NSI+RU5WRUxPUEUgRU5DUllQVElPTiDCtyBUSEUgUlNBIEtFWSBJTiBUSEUgVkFVTFQgV1JBUFMgRUFDSCBEQVRBIEtFWTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQ2IiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjY0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjExMiIgeT0iNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweDtmaWxsOiM0ZjQ2ZTUiPllvdXIgUlNBIGtleTwvdGV4dD4KPHRleHQgeD0iMTEyIiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+d3JhcEtleSAvIHVud3JhcEtleSBvbmx5PC90ZXh0Pgo8bGluZSB4MT0iMjAwIiB5MT0iNzgiIHgyPSIyMzIiIHkyPSI3OCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2t2M2IpIiBzdHlsZT0ic3Ryb2tlOiM0ZjQ2ZTUiLz4KPHRleHQgeD0iMjE2IiB5PSI2OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHgiPndyYXBzPC90ZXh0Pgo8cmVjdCB4PSIyMzYiIHk9IjQ2IiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjY0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMyNCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTJweCI+UmFuZG9tIGRhdGEga2V5PC90ZXh0Pgo8dGV4dCB4PSIzMjQiIHk9Ijg4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5wbGFpbnRleHQgKyB3cmFwcGVkIGNvcHk8L3RleHQ+CjxsaW5lIHgxPSI0MTIiIHkxPSI3OCIgeDI9IjQ0NCIgeTI9Ijc4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YzZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0MjgiIHk9IjY5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjcuMnB4Ij5lbmNyeXB0czwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI0NiIgd2lkdGg9IjE2NCIgaGVpZ2h0PSI2NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MzAiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjEycHgiPllvdXIgY2lwaGVydGV4dDwvdGV4dD4KPHRleHQgeD0iNTMwIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjkuNXB4Ij5lbmNyeXB0ZWQgd2l0aCB0aGUgZGF0YSBrZXk8L3RleHQ+CjxsaW5lIHgxPSI2MTIiIHkxPSI3OCIgeDI9IjY0NCIgeTI9Ijc4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YzKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjY0OCIgeT0iNDYiIHdpZHRoPSIxNjQiIGhlaWdodD0iNjQiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI3MzAiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+S2VwdCB0b2dldGhlcjwvdGV4dD4KPHRleHQgeD0iNzMwIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+Y2lwaGVydGV4dCArIHdyYXBwZWQga2V5PC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+dGhlIHBsYWludGV4dCBkYXRhIGtleSBpcyB1c2VkIG9uY2UgYW5kIGRpc2NhcmRlZDsgeW91ciBSU0Ega2V5IG9ubHkgZXZlciB3cmFwcyB0aGUgc21hbGwgZGF0YSBrZXksIG5ldmVyIHlvdXIgYnVsayBkYXRhPC90ZXh0Pgo8bGluZSB4MT0iMjYiIHkxPSIxNTIiIHgyPSI4MTAiIHkyPSIxNTIiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0ic3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMjYiIHk9IjE3OCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+VE8gUkVBRCBJVCBCQUNLIMK3IHVud3JhcEtleSBSRUNPVkVSUyBUSEUgREFUQSBLRVk8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxOTIiIHdpZHRoPSIxODgiIGhlaWdodD0iNTIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTE4IiB5PSIyMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhOyBmb250LXNpemU6MTFweCI+V3JhcHBlZCBkYXRhIGtleTwvdGV4dD4KPHRleHQgeD0iMTE4IiB5PSIyMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPnN0b3JlZCBiZXNpZGUgdGhlIGNpcGhlcnRleHQ8L3RleHQ+CjxsaW5lIHgxPSIyMTIiIHkxPSIyMTgiIHgyPSIyNTIiIHkyPSIyMTgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNrdjNiKSIgc3R5bGU9InN0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjIzMiIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjhweCI+dW53cmFwS2V5PC90ZXh0Pgo8cmVjdCB4PSIyNTYiIHk9IjE5MiIgd2lkdGg9IjE3NiIgaGVpZ2h0PSI1MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSIzNDQiIHk9IjIxNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMXB4O2ZpbGw6IzRmNDZlNSI+UGxhaW50ZXh0IGRhdGEga2V5PC90ZXh0Pgo8dGV4dCB4PSIzNDQiIHk9IjIzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+cmVjb3ZlcmVkIGJ5IHlvdXIgUlNBIGtleTwvdGV4dD4KPGxpbmUgeDE9IjQzMiIgeTE9IjIxOCIgeDI9IjQ3MiIgeTI9IjIxOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2t2M2cpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDUyIiB5PSIyMDkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij5kZWNyeXB0czwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSIxOTIiIHdpZHRoPSIxNzYiIGhlaWdodD0iNTIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNTY0IiB5PSIyMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTFweCI+WW91ciBwbGFpbnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjU2NCIgeT0iMjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OS41cHgiPmRhdGEgcmVjb3ZlcmVkPC90ZXh0Pgo8cmVjdCB4PSI2NjgiIHk9IjE4OCIgd2lkdGg9IjE0NCIgaGVpZ2h0PSI2MCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmJlYjtzdHJva2U6I2ZkZTY4YSIvPgo8dGV4dCB4PSI3NDAiIHk9IjIxMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNiNDUzMDkiPm5vIG5hdGl2ZSBkYXRhLWtleSBvcDs8L3RleHQ+Cjx0ZXh0IHg9Ijc0MCIgeT0iMjI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2I0NTMwOSI+dGhlIHdyYXBwaW5nIGtleSBpcyBSU0EsPC90ZXh0Pgo8dGV4dCB4PSI3NDAiIHk9IjIzOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNiNDUzMDkiPm5vdCBhIHN5bW1ldHJpYyBBRVMga2V5PC90ZXh0Pgo8L3N2Zz4=)

![For each call the adapter makes a random data key and encrypts your data with it. The RSA key in the vault wraps the data key, and the wrapped key is kept with the ciphertext. To read the data, the vault unwraps the data key.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjg4IiB2aWV3Qm94PSIwIDAgODM2IDI4OCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGb3IgZWFjaCBjYWxsIHRoZSBhZGFwdGVyIG1ha2VzIGEgcmFuZG9tIGRhdGEga2V5IGFuZCBlbmNyeXB0cyB5b3VyIGRhdGEgd2l0aCBpdC4gVGhlIFJTQSBrZXkgaW4gdGhlIHZhdWx0IHdyYXBzIHRoZSBkYXRhIGtleSwgYW5kIHRoZSB3cmFwcGVkIGtleSBpcyBrZXB0IHdpdGggdGhlIGNpcGhlcnRleHQuIFRvIHJlYWQgdGhlIGRhdGEsIHRoZSB2YXVsdCB1bndyYXBzIHRoZSBkYXRhIGtleS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0ia3YzIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJrdjNnIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2ZWU3YjciLz48L21hcmtlcj48bWFya2VyIGlkPSJrdjNiIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiNhNWI0ZmMiLz48L21hcmtlcj48L2RlZnM+Cjx0ZXh0IHg9IjI2IiB5PSIyNiIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZpbGw6I2NiZDVlMSI+RU5WRUxPUEUgRU5DUllQVElPTiDCtyBUSEUgUlNBIEtFWSBJTiBUSEUgVkFVTFQgV1JBUFMgRUFDSCBEQVRBIEtFWTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjQ2IiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjY0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjExMiIgeT0iNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweDtmaWxsOiNhNWI0ZmMiPllvdXIgUlNBIGtleTwvdGV4dD4KPHRleHQgeD0iMTEyIiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+d3JhcEtleSAvIHVud3JhcEtleSBvbmx5PC90ZXh0Pgo8bGluZSB4MT0iMjAwIiB5MT0iNzgiIHgyPSIyMzIiIHkyPSI3OCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2t2M2IpIiBzdHlsZT0ic3Ryb2tlOiNhNWI0ZmMiLz4KPHRleHQgeD0iMjE2IiB5PSI2OSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHgiPndyYXBzPC90ZXh0Pgo8cmVjdCB4PSIyMzYiIHk9IjQ2IiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjY0IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMyNCIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTJweCI+UmFuZG9tIGRhdGEga2V5PC90ZXh0Pgo8dGV4dCB4PSIzMjQiIHk9Ijg4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5wbGFpbnRleHQgKyB3cmFwcGVkIGNvcHk8L3RleHQ+CjxsaW5lIHgxPSI0MTIiIHkxPSI3OCIgeDI9IjQ0NCIgeTI9Ijc4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YzZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0MjgiIHk9IjY5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjcuMnB4Ij5lbmNyeXB0czwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI0NiIgd2lkdGg9IjE2NCIgaGVpZ2h0PSI2NCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI1MzAiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjEycHgiPllvdXIgY2lwaGVydGV4dDwvdGV4dD4KPHRleHQgeD0iNTMwIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjkuNXB4Ij5lbmNyeXB0ZWQgd2l0aCB0aGUgZGF0YSBrZXk8L3RleHQ+CjxsaW5lIHgxPSI2MTIiIHkxPSI3OCIgeDI9IjY0NCIgeTI9Ijc4IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgja3YzKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjY0OCIgeT0iNDYiIHdpZHRoPSIxNjQiIGhlaWdodD0iNjQiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0cm9rZS1kYXNoYXJyYXk9IjUgNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI3MzAiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+S2VwdCB0b2dldGhlcjwvdGV4dD4KPHRleHQgeD0iNzMwIiB5PSI4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+Y2lwaGVydGV4dCArIHdyYXBwZWQga2V5PC90ZXh0Pgo8dGV4dCB4PSI0MTgiIHk9IjEzMiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+dGhlIHBsYWludGV4dCBkYXRhIGtleSBpcyB1c2VkIG9uY2UgYW5kIGRpc2NhcmRlZDsgeW91ciBSU0Ega2V5IG9ubHkgZXZlciB3cmFwcyB0aGUgc21hbGwgZGF0YSBrZXksIG5ldmVyIHlvdXIgYnVsayBkYXRhPC90ZXh0Pgo8bGluZSB4MT0iMjYiIHkxPSIxNTIiIHgyPSI4MTAiIHkyPSIxNTIiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0ic3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMjYiIHk9IjE3OCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+VE8gUkVBRCBJVCBCQUNLIMK3IHVud3JhcEtleSBSRUNPVkVSUyBUSEUgREFUQSBLRVk8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSIxOTIiIHdpZHRoPSIxODgiIGhlaWdodD0iNTIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTE4IiB5PSIyMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5OyBmb250LXNpemU6MTFweCI+V3JhcHBlZCBkYXRhIGtleTwvdGV4dD4KPHRleHQgeD0iMTE4IiB5PSIyMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPnN0b3JlZCBiZXNpZGUgdGhlIGNpcGhlcnRleHQ8L3RleHQ+CjxsaW5lIHgxPSIyMTIiIHkxPSIyMTgiIHgyPSIyNTIiIHkyPSIyMTgiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNrdjNiKSIgc3R5bGU9InN0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjIzMiIgeT0iMjA5IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjhweCI+dW53cmFwS2V5PC90ZXh0Pgo8cmVjdCB4PSIyNTYiIHk9IjE5MiIgd2lkdGg9IjE3NiIgaGVpZ2h0PSI1MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSIzNDQiIHk9IjIxNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMXB4O2ZpbGw6I2E1YjRmYyI+UGxhaW50ZXh0IGRhdGEga2V5PC90ZXh0Pgo8dGV4dCB4PSIzNDQiIHk9IjIzMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+cmVjb3ZlcmVkIGJ5IHlvdXIgUlNBIGtleTwvdGV4dD4KPGxpbmUgeDE9IjQzMiIgeTE9IjIxOCIgeDI9IjQ3MiIgeTI9IjIxOCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2t2M2cpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNDUyIiB5PSIyMDkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij5kZWNyeXB0czwvdGV4dD4KPHJlY3QgeD0iNDc2IiB5PSIxOTIiIHdpZHRoPSIxNzYiIGhlaWdodD0iNTIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNTY0IiB5PSIyMTQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTFweCI+WW91ciBwbGFpbnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjU2NCIgeT0iMjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OS41cHgiPmRhdGEgcmVjb3ZlcmVkPC90ZXh0Pgo8cmVjdCB4PSI2NjgiIHk9IjE4OCIgd2lkdGg9IjE0NCIgaGVpZ2h0PSI2MCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzQyMjAwNjtzdHJva2U6IzkyNDAwZSIvPgo8dGV4dCB4PSI3NDAiIHk9IjIxMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDEwcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNmYmJmMjQiPm5vIG5hdGl2ZSBkYXRhLWtleSBvcDs8L3RleHQ+Cjx0ZXh0IHg9Ijc0MCIgeT0iMjI1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2ZiYmYyNCI+dGhlIHdyYXBwaW5nIGtleSBpcyBSU0EsPC90ZXh0Pgo8dGV4dCB4PSI3NDAiIHk9IjIzOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweDtmaWxsOiNmYmJmMjQiPm5vdCBhIHN5bW1ldHJpYyBBRVMga2V5PC90ZXh0Pgo8L3N2Zz4=)

The adapter encrypts with a random data key; the vault's RSA key wraps and unwraps that data key.

#### Encryption context and supported operations

An encryption context is a non-secret key/value map bound to the ciphertext as additional authenticated data. `Decrypt` succeeds only with the same context, so you can tie encrypted values to a tenant or purpose. The adapter binds it inside the AES-256-GCM layer, so it works as it does in AWS.

The symmetric operations are supported: `Encrypt`, `Decrypt`, `ReEncrypt`, `GenerateDataKey` and `GenerateDataKeyWithoutPlaintext`. Asymmetric operations (`Sign`, `Verify`, `GetPublicKey`), data-key pairs and HMAC (`GenerateMac`, `VerifyMac`) return `UnsupportedOperationException`. Ciphertext made by a different Tensor9 KMS backend is rejected rather than opened with the wrong key.

#### Key versions and rotation

Automatic key rotation is not supported on Key Vault: `EnableKeyRotation` is rejected, and `RotateKeyOnDemand` returns `UnsupportedOperationException`. Because each ciphertext names the key version that wrapped its data key, a new version created in Key Vault does not break older ciphertext. Keep old versions enabled and accessible while data encrypted under them is still needed; removing access to an old version makes that data undecryptable.

#### Limitations

Where Key Vault and AWS KMS differ

* **Symmetric keys behave differently: the vault key is RSA.** The adapter encrypts with AES-256-GCM itself and the vault's RSA 3072 key wraps each data key. A caller inspecting the key in Key Vault finds an RSA key, not the symmetric key AWS would show.
* **Asymmetric keys and HMAC are not supported.** `Sign`, `Verify`, `GetPublicKey`, data-key pairs, `GenerateMac` and `VerifyMac` return `UnsupportedOperationException`. Azure Managed HSM and Key Vault Premium's preview AES/HMAC keys are separate offerings outside this mapping.
* **Key rotation is not supported.** `EnableKeyRotation` is rejected and `RotateKeyOnDemand` returns `UnsupportedOperationException`.
* **Grants and key policies are not supported.** Grant operations and `PutKeyPolicy` are rejected. Use Azure role assignments for Key Vault access.
* **Importing key material is not supported.** The AWS import handshake is not available at runtime; imported material uses Key Vault's own import procedure at provisioning.
* **Multi-Region keys are not supported.** A key lives in one vault and region; replica keys sharing material are not created.
* **Deletion behaves differently.** The adapter's 7 to 30 day waiting period and the vault's soft-delete retention are separate; vault retention and purge protection can delay final removal.

#### Other considerations

* **Key protection.** Key Vault Premium can protect RSA keys in an HSM; Managed HSM is a separate service. This mapping does not use their symmetric-key features.
* **Access.** Use the deployment's Azure identity and narrowly scoped role assignments. Keep permission to manage keys separate from permission to unwrap data keys.
* **Moving from AWS.** Key material does not move. Decrypt AWS ciphertext with the AWS key and encrypt it again under the new key before you retire AWS access. Keep old Key Vault key versions while ciphertext needs them.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS KMS · Crypto requests

Feature: AWS KMS.

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/c924d96898537012aff100e52c0a1498b6ce472a6b8213807bbc67920125a2ef-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/87252a9fecb851fcdffdf8dc3d002b667d51eb0bee1c9cb33020eed3190cc172-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Crypto requests (operations/s) | KMS Keys | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 100.00 | Key Vault (one staging copy) | 118.18 | 18.18 |
| 0 | 100.00 | Key Vault (two staging copies) | 236.36 | 136.36 |
| 1 | 107.88 | Key Vault (one staging copy) | 126.46 | 18.57 |
| 1 | 107.88 | Key Vault (two staging copies) | 244.63 | 136.75 |
| 10 | 178.84 | Key Vault (one staging copy) | 200.96 | 22.12 |
| 10 | 178.84 | Key Vault (two staging copies) | 319.14 | 140.30 |
| 100 | 888.40 | Key Vault (one staging copy) | 946.00 | 57.60 |
| 100 | 888.40 | Key Vault (two staging copies) | 1,064.18 | 175.78 |
| 1,000 | 7,984.00 | Key Vault (one staging copy) | 8,396.38 | 412.38 |
| 1,000 | 7,984.00 | Key Vault (two staging copies) | 8,514.56 | 530.56 |
| 10,000 | 78,940.00 | Key Vault (one staging copy) | 84,417.85 | 5,477.85 |
| 10,000 | 78,940.00 | Key Vault (two staging copies) | 86,053.70 | 7,113.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Key Vault (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (one staging copy) | Durable key metadata and aliases | 16,384 | bytes/key |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Key Vault (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (two staging copies) | Durable key metadata and aliases | 16,384 | bytes/key |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Key Vault crypto calls price managedOperations. Standard software-protected keys have no per-version storage meter; Premium HSM-protected keys list USD 1 per key-month and automated rotation 1 per rotation, neither selected.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-ef50affc42e0701bc747b2bf76645106c0ea8eb2` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

##### AWS KMS · Logical keys

Feature: AWS KMS.

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: eastus; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/dc0644116eb09030bcf48fc301e27aaf1704d2eb791d44fed11b40ba9e139e15-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/60195a50aece9b4f20abff50555b28853adc635a889310cc180273fcfc4a6b39-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Logical keys (keys) | KMS Keys | Target scenario | Key Vault | Difference |
| -: | -: | - | -: | -: |
| 0 | 3.00 | Key Vault (one staging copy) | 121.33 | 118.33 |
| 0 | 3.00 | Key Vault (two staging copies) | 239.51 | 236.51 |
| 10 | 13.00 | Key Vault (one staging copy) | 121.33 | 108.33 |
| 10 | 13.00 | Key Vault (two staging copies) | 239.51 | 226.51 |
| 100 | 103.00 | Key Vault (one staging copy) | 121.33 | 18.33 |
| 100 | 103.00 | Key Vault (two staging copies) | 239.51 | 136.51 |
| 1,000 | 1,003.00 | Key Vault (one staging copy) | 121.33 | -881.67 |
| 1,000 | 1,003.00 | Key Vault (two staging copies) | 239.51 | -763.49 |
| 10,000 | 10,003.00 | Key Vault (one staging copy) | 121.33 | -9,881.67 |
| 10,000 | 10,003.00 | Key Vault (two staging copies) | 239.51 | -9,763.49 |
| 100,000 | 100,003.00 | Key Vault (one staging copy) | 121.33 | -99,881.67 |
| 100,000 | 100,003.00 | Key Vault (two staging copies) | 239.51 | -99,763.49 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Key Vault (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Key Vault (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (one staging copy) | Durable key metadata and aliases | 16,384 | bytes/key |
| Key Vault (one staging copy) | Target price guess · read | 0 | USD/read |
| Key Vault (one staging copy) | Target price guess · write | 0 | USD/write |
| Key Vault (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (one staging copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Key Vault (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Key Vault (one staging copy) | Target monthly base charge | 0 | USD/month |
| Key Vault (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Key Vault (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Key Vault (one staging copy) | Minimum primary RAM | 8 | GiB |
| Key Vault (one staging copy) | Minimum primary disk | 100 | GiB |
| Key Vault (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Key Vault (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Key Vault (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Key Vault (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Key Vault (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Key Vault (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Key Vault (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Key Vault (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Key Vault (two staging copies) | Durable key metadata and aliases | 16,384 | bytes/key |
| Key Vault (two staging copies) | Target price guess · read | 0 | USD/read |
| Key Vault (two staging copies) | Target price guess · write | 0 | USD/write |
| Key Vault (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Key Vault (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Key Vault (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Key Vault (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Key Vault (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Key Vault (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Key Vault (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Key Vault (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Key Vault (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Key Vault (two staging copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Key Vault (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Key Vault (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Key Vault (two staging copies) | Target monthly base charge | 0 | USD/month |
| Key Vault (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Key Vault (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Key Vault (two staging copies) | Minimum primary RAM | 8 | GiB |
| Key Vault (two staging copies) | Minimum primary disk | 100 | GiB |
| Key Vault (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Key Vault (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Key Vault (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Key Vault (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Key Vault (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Key Vault (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Key Vault (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Key Vault (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Key Vault (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Key Vault (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Key Vault (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Key Vault (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → eastus, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Key Vault crypto calls price managedOperations. Standard software-protected keys have no per-version storage meter; Premium HSM-protected keys list USD 1 per key-month and automated rotation 1 per rotation, neither selected.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-ef50affc42e0701bc747b2bf76645106c0ea8eb2` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

**AWS KMS → Key Vault: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: eastus. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Logical managed keys | 100.00 |
| Origin: Symmetric crypto requests | 3.00 |
| Origin: ReEncrypt requests | 0.00 |
| Origin: Public-key verification requests | 0.00 |
| Target: Target native provider operations | 3.15 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **103.00** |
| **Target service subtotal** | **121.33** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Logical managed keys | 1 | USD/key-month |
| Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Target key versions per logical key | 2 | versions/key |
| Native crypto retry multiplier | 1.05 | multiplier |
| Durable key metadata and aliases | 16,384 | bytes/key |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.000003 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Logical managed keys | 100 | key-month |
| Symmetric crypto requests | 1,000,000 | requests |
| ReEncrypt requests | 0 | requests |
| Public-key verification requests | 0 | requests |

* Translated reads: 1,000,000 operations.

* Translated writes: 0 operations.

* Translated resident physical data: under 0.01 GiB-month.

* Native provider operations: 1,050,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 200 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.

* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.

* Key Vault crypto calls price managedOperations. Standard software-protected keys have no per-version storage meter; Premium HSM-protected keys list USD 1 per key-month and automated rotation 1 per rotation, neither selected.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-ef50affc42e0701bc747b2bf76645106c0ea8eb2` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## On Azure, Google Cloud, and OCI

### Cloud Adapter deployment-hosted software keys

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| CreateAlias / UpdateAlias / DeleteAlias / ListAliases | Aliases | Supported | Most usage | the alias-to-key mapping is kept on the key records and followed by DescribeKey |
| Sign / Verify / GetPublicKey / DeriveSharedSecret | Asymmetric | Out of scope | Most usage | asymmetric keys are refused with an error naming the operation |
| GenerateDataKey | Envelope / data keys | Supported | Common | fresh random bytes (AES\_128, AES\_256 or NumberOfBytes) returned alongside their wrapped copy |
| GenerateDataKeyPair / GenerateDataKeyPairWithoutPlaintext | Envelope / data keys | Out of scope | Most usage | asymmetric data-key pairs are refused; this key store holds symmetric keys only |
| GenerateDataKeyWithoutPlaintext | Envelope / data keys | Supported | Most usage | the same path, returning only the wrapped copy |
| CreateGrant / ListGrants / RetireGrant / RevokeGrant / ListRetirableGrants | Grants | Out of scope | Most usage | grants are refused; access is the caller's IAM permissions, checked on every call |
| GenerateMac / VerifyMac | HMAC | Out of scope | Most usage | not served |
| GetParametersForImport / ImportKeyMaterial / DeleteImportedKeyMaterial | Imported key material | Out of scope | Full surface | imported material is refused at CreateKey and the import handshake is not served |
| CancelKeyDeletion | Key management | Supported | Full surface | clears the pending deletion on the key's record |
| CreateKey | Key management | Partial | Common | creates a symmetric ENCRYPT\_DECRYPT key record and answers once it is ready; a KeySpec other than SYMMETRIC\_DEFAULT, a KeyUsage other than ENCRYPT\_DECRYPT, imported or custom-key-store material and a multi-region key are refused with an error naming the field |
| DescribeKey | Key management | Supported | Common | key identity, enabled state and any pending deletion from the key's record; an alias name is followed to its key |
| EnableKey / DisableKey | Key management | Partial | Most usage | recorded on the key and reported by DescribeKey; on this key store the cryptographic operations do not consult the flag, so a disabled key still encrypts and decrypts |
| ListKeys | Key management | Out of scope | Common | not served on this key store; the call is refused with an error naming it. DescribeKey reads a key by id or alias, and ListAliases lists each alias with the key it names |
| ScheduleKeyDeletion | Key management | Partial | Most usage | records a 7 to 30 day window and reports PendingDeletion; when the window ends the record is removed, and because every key wraps under the one root key that alone makes no ciphertext unrecoverable |
| UpdateKeyDescription | Key management | Out of scope | Full surface | not served |
| PutKeyPolicy / GetKeyPolicy / ListKeyPolicies | Key policy | Out of scope | Most usage | per-key policy documents are refused |
| ReplicateKey / UpdatePrimaryRegion | Multi-region | Out of scope | Full surface | a multi-region key is refused at CreateKey; there is no replica to move |
| GenerateRandom | Random | Out of scope | Full surface | not served |
| EnableKeyRotation / DisableKeyRotation / GetKeyRotationStatus / RotateKeyOnDemand | Rotation | Out of scope | Most usage | not served; there is one root key and it does not rotate |
| Decrypt | Symmetric crypto | Partial | Common | opens the ciphertext under the root key and re-checks the encryption context; a mismatch fails as InvalidCiphertext. Partial because every key wraps under the same root key, so a Decrypt does not check which key produced the ciphertext |
| Encrypt | Symmetric crypto | Supported | Common | encrypts with AES-256-GCM under the root key; the encryption context binds as authenticated data, so a matching context is required to decrypt |
| ReEncrypt | Symmetric crypto | Supported | Most usage | served as a decrypt then an encrypt inside the adapter; the plaintext is never returned to the caller |
| ListResourceTags | Tags | Out of scope | Full surface | not served on this key store; the call is refused with an error naming it, so tags set with TagResource are kept on the key's record but are not listed back |
| TagResource / UntagResource | Tags | Supported | Full surface | tags are kept on the key's record |

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS KMS · Crypto requests

Feature: AWS KMS.

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/4468a16f0d438d6bd8e331ac512a06e498a263447cea67d3bb16683e5a7e6a84-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/b067d1de59babcc3d43f61009dc86186fe73121851aa46441071df3a427b2af2-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Crypto requests (operations/s) | KMS Keys | Target scenario | Cloud Adapter deployment-hosted software keys | Difference |
| -: | -: | - | -: | -: |
| 0 | 100.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -19.10 |
| 0 | 100.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | 61.79 |
| 1 | 107.88 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -26.99 |
| 1 | 107.88 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | 53.91 |
| 10 | 178.84 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -97.94 |
| 10 | 178.84 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | -17.05 |
| 100 | 888.40 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -807.50 |
| 100 | 888.40 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | -726.61 |
| 1,000 | 7,984.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -7,903.10 |
| 1,000 | 7,984.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | -7,822.21 |
| 10,000 | 78,940.00 | Cloud Adapter deployment-hosted software keys (one copy) | 1,144.34 | -77,795.66 |
| 10,000 | 78,940.00 | Cloud Adapter deployment-hosted software keys (two copies) | 2,288.68 | -76,651.32 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (one copy) | Target key versions per logical key | 2 | versions/key |
| Cloud Adapter deployment-hosted software keys (one copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud Adapter deployment-hosted software keys (one copy) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · read | 0 | USD/read |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · write | 0 | USD/write |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · input token | 0 | USD/input token |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · output token | 0 | USD/output token |
| Cloud Adapter deployment-hosted software keys (one copy) | Target monthly base charge | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (one copy) | Approximate target service minimum | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (one copy) | Minimum primary CPU | 2 | vCPU |
| Cloud Adapter deployment-hosted software keys (one copy) | Minimum primary RAM | 8 | GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Minimum primary disk | 100 | GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cloud Adapter deployment-hosted software keys (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud Adapter deployment-hosted software keys (one copy) | Planning peak / mean work | 2 | multiplier |
| Cloud Adapter deployment-hosted software keys (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Planning disk utilization | 0.8 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (two copies) | Target key versions per logical key | 2 | versions/key |
| Cloud Adapter deployment-hosted software keys (two copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud Adapter deployment-hosted software keys (two copies) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · read | 0 | USD/read |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · write | 0 | USD/write |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · input token | 0 | USD/input token |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · output token | 0 | USD/output token |
| Cloud Adapter deployment-hosted software keys (two copies) | Target monthly base charge | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (two copies) | Approximate target service minimum | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (two copies) | Minimum primary CPU | 2 | vCPU |
| Cloud Adapter deployment-hosted software keys (two copies) | Minimum primary RAM | 8 | GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Minimum primary disk | 100 | GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cloud Adapter deployment-hosted software keys (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud Adapter deployment-hosted software keys (two copies) | Planning peak / mean work | 2 | multiplier |
| Cloud Adapter deployment-hosted software keys (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Planning disk utilization | 0.8 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Self-hosted target: Tensor9-built in-cluster KMS service; no vendor charge. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-903666407ef5896ce7f56d4a406ea675be6cb655` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

##### AWS KMS · Logical keys

Feature: AWS KMS.

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/1c68f49723fab34cc781fb2251aa69296f252fb2e938166ec4645660523f6204-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/43800865c9158451a43841a3ad32d6302ec45486120ac4ce416b0427ca82d833-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Logical keys (keys) | KMS Keys | Target scenario | Cloud Adapter deployment-hosted software keys | Difference |
| -: | -: | - | -: | -: |
| 0 | 3.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | 77.90 |
| 0 | 3.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | 158.79 |
| 10 | 13.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | 67.90 |
| 10 | 13.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | 148.79 |
| 100 | 103.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -22.10 |
| 100 | 103.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | 58.79 |
| 1,000 | 1,003.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -922.10 |
| 1,000 | 1,003.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | -841.21 |
| 10,000 | 10,003.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -9,922.10 |
| 10,000 | 10,003.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | -9,841.21 |
| 100,000 | 100,003.00 | Cloud Adapter deployment-hosted software keys (one copy) | 80.90 | -99,922.10 |
| 100,000 | 100,003.00 | Cloud Adapter deployment-hosted software keys (two copies) | 161.79 | -99,841.21 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (one copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (one copy) | Target key versions per logical key | 2 | versions/key |
| Cloud Adapter deployment-hosted software keys (one copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud Adapter deployment-hosted software keys (one copy) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · read | 0 | USD/read |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · write | 0 | USD/write |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · input token | 0 | USD/input token |
| Cloud Adapter deployment-hosted software keys (one copy) | Target price guess · output token | 0 | USD/output token |
| Cloud Adapter deployment-hosted software keys (one copy) | Target monthly base charge | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (one copy) | Approximate target service minimum | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (one copy) | Minimum primary CPU | 2 | vCPU |
| Cloud Adapter deployment-hosted software keys (one copy) | Minimum primary RAM | 8 | GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Minimum primary disk | 100 | GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cloud Adapter deployment-hosted software keys (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud Adapter deployment-hosted software keys (one copy) | Planning peak / mean work | 2 | multiplier |
| Cloud Adapter deployment-hosted software keys (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Planning disk utilization | 0.8 | fraction |
| Cloud Adapter deployment-hosted software keys (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Cloud Adapter deployment-hosted software keys (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (two copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud Adapter deployment-hosted software keys (two copies) | Target key versions per logical key | 2 | versions/key |
| Cloud Adapter deployment-hosted software keys (two copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud Adapter deployment-hosted software keys (two copies) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · read | 0 | USD/read |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · write | 0 | USD/write |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · input token | 0 | USD/input token |
| Cloud Adapter deployment-hosted software keys (two copies) | Target price guess · output token | 0 | USD/output token |
| Cloud Adapter deployment-hosted software keys (two copies) | Target monthly base charge | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (two copies) | Approximate target service minimum | 0 | USD/month |
| Cloud Adapter deployment-hosted software keys (two copies) | Minimum primary CPU | 2 | vCPU |
| Cloud Adapter deployment-hosted software keys (two copies) | Minimum primary RAM | 8 | GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Minimum primary disk | 100 | GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cloud Adapter deployment-hosted software keys (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud Adapter deployment-hosted software keys (two copies) | Planning peak / mean work | 2 | multiplier |
| Cloud Adapter deployment-hosted software keys (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Planning disk utilization | 0.8 | fraction |
| Cloud Adapter deployment-hosted software keys (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Cloud Adapter deployment-hosted software keys (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud Adapter deployment-hosted software keys (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud Adapter deployment-hosted software keys (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Self-hosted target: Tensor9-built in-cluster KMS service; no vendor charge. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-903666407ef5896ce7f56d4a406ea675be6cb655` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

**AWS KMS → Cloud Adapter deployment-hosted software keys: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Logical managed keys | 100.00 |
| Origin: Symmetric crypto requests | 3.00 |
| Origin: ReEncrypt requests | 0.00 |
| Origin: Public-key verification requests | 0.00 |
| Target: Provisioned primary CPU | 46.15 |
| Target: Provisioned primary RAM | 24.74 |
| Target: Provisioned primary disk | 10.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent provisioned resources | 0.00 |
| Target: Independent managed resources | 0.00 |
| **Origin service subtotal** | **103.00** |
| **Target service subtotal** | **80.90** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Logical managed keys | 1 | USD/key-month |
| Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Target key versions per logical key | 2 | versions/key |
| Native crypto retry multiplier | 1.05 | multiplier |
| Durable key metadata and aliases | 16,384 | bytes/key |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Logical managed keys | 100 | key-month |
| Symmetric crypto requests | 1,000,000 | requests |
| ReEncrypt requests | 0 | requests |
| Public-key verification requests | 0 | requests |

* Translated reads: 1,000,000 operations.

* Translated writes: 0 operations.

* Translated resident physical data: under 0.01 GiB-month.

* Native provider operations: 1,050,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 200 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.

* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.

* Self-hosted target: Tensor9-built in-cluster KMS service; no vendor charge. Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-903666407ef5896ce7f56d4a406ea675be6cb655` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## On Google Cloud

### Cloud KMS

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| CreateAlias | Aliases | Supported | Most usage | the adapter maintains the alias-to-key mapping and resolves alias references, since Cloud KMS has no native alias object |
| DeleteAlias | Aliases | Supported | Full surface | removes an alias from the mapping |
| ListAliases | Aliases | Supported | Most usage | lists aliases retained in adapter state |
| UpdateAlias | Aliases | Supported | Full surface | changes the key referenced by an alias in adapter state |
| DeriveSharedSecret | Asymmetric | Out of scope | Full surface | elliptic-curve shared-secret derivation has no Cloud KMS equivalent op and is rejected |
| GetPublicKey | Asymmetric | Out of scope | Most usage | not supported; the call returns UnsupportedOperationException |
| Sign | Asymmetric | Out of scope | Most usage | asymmetric keys are not supported; the call returns UnsupportedOperationException |
| Verify | Asymmetric | Out of scope | Most usage | not supported; the call returns UnsupportedOperationException |
| GenerateDataKey | Envelope / data keys | Partial | Common | Cloud KMS has no single data-key op, so the adapter synthesizes it: a fresh random data key is generated, wrapped by the key's encrypt, and returned alongside that wrapped copy |
| GenerateDataKeyPair | Envelope / data keys | Out of scope | Most usage | asymmetric data-key pairs are not supported; the call returns UnsupportedOperationException |
| GenerateDataKeyPairWithoutPlaintext | Envelope / data keys | Out of scope | Full surface | not supported; the call returns UnsupportedOperationException |
| GenerateDataKeyWithoutPlaintext | Envelope / data keys | Partial | Most usage | the same synthesized path, returning only the wrapped data key for the deferred-decrypt pattern |
| CreateGrant | Grants | Out of scope | Most usage | authorization is governed by Cloud IAM bindings on the key rather than KMS grants, so a grant is rejected |
| ListGrants | Grants | Out of scope | Most usage | there is no grant to list; access is a Cloud IAM binding |
| ListRetirableGrants | Grants | Out of scope | Full surface | there is no grant to list |
| RetireGrant | Grants | Out of scope | Full surface | there is no grant to retire |
| RevokeGrant | Grants | Out of scope | Full surface | there is no grant to revoke |
| GenerateMac | HMAC | Out of scope | Most usage | HMAC keys are not supported; the call returns UnsupportedOperationException |
| VerifyMac | HMAC | Out of scope | Most usage | not supported; the call returns UnsupportedOperationException |
| DeleteImportedKeyMaterial | Imported key material | Out of scope | Full surface | there is no runtime imported-material lifecycle to drive |
| GetParametersForImport | Imported key material | Out of scope | Full surface | imported key material is loaded through Cloud KMS's own import job at provisioning, not through the native import handshake, so the runtime import ops are rejected |
| ImportKeyMaterial | Imported key material | Out of scope | Full surface | the import handshake is not served at runtime; material is imported at provisioning |
| CancelKeyDeletion | Key management | Supported | Full surface | cancels the adapter recovery window and leaves the key disabled until EnableKey |
| CreateKey | Key management | Partial | Common | creates a symmetric encrypt/decrypt Cloud KMS key; any KeySpec other than SYMMETRIC\_DEFAULT, KeyUsage other than ENCRYPT\_DECRYPT, Origin other than AWS\_KMS, MultiRegion=true or a custom key store is rejected |
| DescribeKey | Key management | Supported | Common | returns AWS key identity and lifecycle metadata from adapter state, with the configured backend key purpose and algorithm |
| DisableKey | Key management | Supported | Most usage | moves the primary key version to disabled |
| EnableKey | Key management | Supported | Most usage | moves the primary key version to enabled |
| ListKeys | Key management | Supported | Common | lists the keys in the key ring |
| ScheduleKeyDeletion | Key management | Supported | Most usage | records a 7-30-day recovery window in adapter state; final destruction of the backend key follows Cloud KMS retention rules |
| UpdateKeyDescription | Key management | Supported | Full surface | updates the human label stored on the crypto key |
| GetKeyPolicy | Key policy | Out of scope | Most usage | there is no per-key policy document to read |
| ListKeyPolicies | Key policy | Out of scope | Full surface | there is no per-key policy document to list |
| PutKeyPolicy | Key policy | Out of scope | Most usage | access is governed by Cloud IAM rather than a per-key policy document, so a per-key policy is rejected |
| ReplicateKey | Multi-region | Out of scope | Full surface | Cloud KMS locality is the key ring's location; there is no shared-key-material multi-region replica, so a replica request is rejected |
| UpdatePrimaryRegion | Multi-region | Out of scope | Full surface | there is no multi-region key set whose primary can be moved |
| GenerateRandom | Random | Out of scope | Full surface | not supported; the call returns UnsupportedOperationException |
| DisableKeyRotation | Rotation | Supported | Full surface | clears the rotation period |
| EnableKeyRotation | Rotation | Supported | Most usage | turns on automatic rotation via the crypto key's rotation period |
| GetKeyRotationStatus | Rotation | Supported | Most usage | reports whether rotation is on and the configured period |
| RotateKeyOnDemand | Rotation | Out of scope | Full surface | on-demand rotation is not supported; the call returns UnsupportedOperationException. Automatic rotation through EnableKeyRotation works |
| Decrypt | Symmetric crypto | Supported | Common | decrypts and re-checks the encryption context; a mismatched context fails the decrypt, exactly as it does natively |
| Encrypt | Symmetric crypto | Supported | Common | encrypts under a symmetric key; the encryption context binds as Cloud KMS additional authenticated data, so a matching context is required to decrypt |
| ReEncrypt | Symmetric crypto | Partial | Most usage | there is no single re-encrypt op; the adapter serves it as a decrypt-then-encrypt across the two keys, and the plaintext is never returned to the caller |
| ListResourceTags | Tags | Supported | Full surface | lists source tags from adapter state |
| TagResource | Tags | Supported | Full surface | retains source tags in adapter state; provider labels use their own format |
| UntagResource | Tags | Supported | Full surface | removes source tags from adapter state |

#### How it works

Tensor9 runs a KMS adapter in your environment and sets `AWS_ENDPOINT_URL_KMS` to its local endpoint, so your AWS SDK calls such as `Encrypt`, `Decrypt` and `GenerateDataKey` reach it unchanged. The adapter performs each call with a Cloud KMS crypto key. Cloud KMS keeps the key material; data-key operations can return a plaintext data key for your application to use.

Each AWS key becomes one symmetric crypto key in the key ring the installation creates for this deployment. Encryption, decryption, data keys, the encryption context and automatic rotation work as in AWS. Asymmetric keys, HMAC, grants and key policies are not supported; see Limitations.

![Your application keeps its AWS KMS SDK. On Google Cloud it calls a Tensor9 KMS adapter, which uses a crypto key in a Cloud KMS key ring; the key material never leaves Cloud KMS.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTkyIiB2aWV3Qm94PSIwIDAgODM2IDE5MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uIGtlZXBzIGl0cyBBV1MgS01TIFNESy4gT24gR29vZ2xlIENsb3VkIGl0IGNhbGxzIGEgVGVuc29yOSBLTVMgYWRhcHRlciwgd2hpY2ggdXNlcyBhIGNyeXB0byBrZXkgaW4gYSBDbG91ZCBLTVMga2V5IHJpbmc7IHRoZSBrZXkgbWF0ZXJpYWwgbmV2ZXIgbGVhdmVzIENsb3VkIEtNUy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2ttczEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzY0NzQ4YiI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODIiIHdpZHRoPSIxMTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iODUiIHk9IjExMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmE7IGZvbnQtc2l6ZToxMi41cHgiPllvdXIgYXBwPC90ZXh0Pgo8dGV4dCB4PSI4NSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPkFXUyBLTVMgU0RLPC90ZXh0Pgo8bGluZSB4MT0iMTQwIiB5MT0iMTE1IiB4Mj0iMjE2IiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMTc4IiB5PSIxMDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OC41cHgiPkVuY3J5cHQ8L3RleHQ+Cjx0ZXh0IHg9IjE3OCIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjguNXB4Ij5EZWNyeXB0PC90ZXh0Pgo8cmVjdCB4PSIyMjAiIHk9IjgwIiB3aWR0aD0iMTY0IiBoZWlnaHQ9IjcwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjMwMiIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEyLjVweCI+QVdTIEtNUzwvdGV4dD4KPHRleHQgeD0iMzAyIiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+a2V5IHN0YXlzIGluIEFXUzwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjQwIiB4Mj0iNDE4IiB5Mj0iMTY0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojY2JkNWUxIi8+CjxyZWN0IHg9IjQzNiIgeT0iNDQiIHdpZHRoPSIzODQiIGhlaWdodD0iMTMwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDUwIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+T04gVEhFIFRBUkdFVCBDTE9VRDwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI4MiIgd2lkdGg9Ijg2IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQ5MSIgeT0iMTEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPllvdXIgYXBwPC90ZXh0Pgo8dGV4dCB4PSI0OTEiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5zYW1lIFNESzwvdGV4dD4KPGxpbmUgeDE9IjUzNCIgeTE9IjExNSIgeDI9IjU2NCIgeTI9IjExNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXMxKSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjU2OCIgeT0iNzYiIHdpZHRoPSIxMTgiIGhlaWdodD0iODIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjI3IiB5PSIxMDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTJweCI+VGVuc29yOTwvdGV4dD4KPHRleHQgeD0iNjI3IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTciPktNUyBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjYyNyIgeT0iMTMxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3Ij5hZGFwdGVyPC90ZXh0Pgo8bGluZSB4MT0iNjg2IiB5MT0iMTE1IiB4Mj0iNzEyIiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczEpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHJlY3QgeD0iNzE0IiB5PSI3NiIgd2lkdGg9IjEwMiIgaGVpZ2h0PSI4MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSI3NjUiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiM0ZjQ2ZTUiPkNsb3VkIEtNUzwvdGV4dD4KPHRleHQgeD0iNzY1IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+eW91ciBjcnlwdG8ga2V5PC90ZXh0Pgo8dGV4dCB4PSI3NjUiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5cHgiPmtleSByaW5nIMK3IHJlZ2lvbjwvdGV4dD4KPC9zdmc+)

![Your application keeps its AWS KMS SDK. On Google Cloud it calls a Tensor9 KMS adapter, which uses a crypto key in a Cloud KMS key ring; the key material never leaves Cloud KMS.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTkyIiB2aWV3Qm94PSIwIDAgODM2IDE5MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJZb3VyIGFwcGxpY2F0aW9uIGtlZXBzIGl0cyBBV1MgS01TIFNESy4gT24gR29vZ2xlIENsb3VkIGl0IGNhbGxzIGEgVGVuc29yOSBLTVMgYWRhcHRlciwgd2hpY2ggdXNlcyBhIGNyeXB0byBrZXkgaW4gYSBDbG91ZCBLTVMga2V5IHJpbmc7IHRoZSBrZXkgbWF0ZXJpYWwgbmV2ZXIgbGVhdmVzIENsb3VkIEtNUy4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2ttczEiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjwvZGVmcz4KPHJlY3QgeD0iMTYiIHk9IjQ0IiB3aWR0aD0iMzg0IiBoZWlnaHQ9IjEzMCIgcng9IjE0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3Ryb2tlLWRhc2hhcnJheT0iNSA1IiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6Izk0YTNiOCI+T04gQVdTIFRPREFZPC90ZXh0Pgo8cmVjdCB4PSIzMCIgeT0iODIiIHdpZHRoPSIxMTAiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iODUiIHk9IjExMCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1Zjk7IGZvbnQtc2l6ZToxMi41cHgiPllvdXIgYXBwPC90ZXh0Pgo8dGV4dCB4PSI4NSIgeT0iMTI4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPkFXUyBLTVMgU0RLPC90ZXh0Pgo8bGluZSB4MT0iMTQwIiB5MT0iMTE1IiB4Mj0iMjE2IiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMTc4IiB5PSIxMDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OC41cHgiPkVuY3J5cHQ8L3RleHQ+Cjx0ZXh0IHg9IjE3OCIgeT0iMTMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjguNXB4Ij5EZWNyeXB0PC90ZXh0Pgo8cmVjdCB4PSIyMjAiIHk9IjgwIiB3aWR0aD0iMTY0IiBoZWlnaHQ9IjcwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjMwMiIgeT0iMTA4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEyLjVweCI+QVdTIEtNUzwvdGV4dD4KPHRleHQgeD0iMzAyIiB5PSIxMjYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+a2V5IHN0YXlzIGluIEFXUzwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjQwIiB4Mj0iNDE4IiB5Mj0iMTY0IiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9InN0cm9rZTojNDc1NTY5Ii8+CjxyZWN0IHg9IjQzNiIgeT0iNDQiIHdpZHRoPSIzODQiIGhlaWdodD0iMTMwIiByeD0iMTQiIHN0cm9rZS13aWR0aD0iMS40IiBzdHJva2UtZGFzaGFycmF5PSI1IDUiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDUwIiB5PSI2MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+T04gVEhFIFRBUkdFVCBDTE9VRDwvdGV4dD4KPHJlY3QgeD0iNDQ4IiB5PSI4MiIgd2lkdGg9Ijg2IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQ5MSIgeT0iMTEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPllvdXIgYXBwPC90ZXh0Pgo8dGV4dCB4PSI0OTEiIHk9IjEyOCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDYwMCAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5zYW1lIFNESzwvdGV4dD4KPGxpbmUgeDE9IjUzNCIgeTE9IjExNSIgeDI9IjU2NCIgeTI9IjExNSIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXMxKSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjU2OCIgeT0iNzYiIHdpZHRoPSIxMTgiIGhlaWdodD0iODIiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjI3IiB5PSIxMDIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTJweCI+VGVuc29yOTwvdGV4dD4KPHRleHQgeD0iNjI3IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3YjciPktNUyBBUEk8L3RleHQ+Cjx0ZXh0IHg9IjYyNyIgeT0iMTMxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3Ij5hZGFwdGVyPC90ZXh0Pgo8bGluZSB4MT0iNjg2IiB5MT0iMTE1IiB4Mj0iNzEyIiB5Mj0iMTE1IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczEpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHJlY3QgeD0iNzE0IiB5PSI3NiIgd2lkdGg9IjEwMiIgaGVpZ2h0PSI4MiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSI3NjUiIHk9IjEwMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNhNWI0ZmMiPkNsb3VkIEtNUzwvdGV4dD4KPHRleHQgeD0iNzY1IiB5PSIxMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+eW91ciBjcnlwdG8ga2V5PC90ZXh0Pgo8dGV4dCB4PSI3NjUiIHk9IjEzMSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5cHgiPmtleSByaW5nIMK3IHJlZ2lvbjwvdGV4dD4KPC9zdmc+)

Your KMS calls go to a Tensor9 adapter, which uses a crypto key in Google Cloud KMS.

#### Key identity and lifecycle

The adapter keeps records of your AWS key IDs, aliases, tags and key state. `CreateKey` creates the matching crypto key, and later requests resolve the AWS key ID to it. Cloud KMS performs the cryptographic operations and keeps the key material.

An alias is a name the adapter keeps. Updating it changes which key later alias-based requests use; it does not move key material or rewrite existing ciphertext. Back up the adapter's records, and keep the crypto keys and versions needed to decrypt stored data.

`ScheduleKeyDeletion` records a waiting period of 7 to 30 days, 30 by default. Cancelling it leaves the key disabled; enable it before using it again. Final destruction follows Cloud KMS's own retention rules, which can keep the key material longer than the adapter's waiting period.

#### The key ring and its crypto keys

A Cloud KMS crypto key belongs to a key ring in a location. Each key has immutable versions, one of them primary. The adapter resolves an AWS key ID to its crypto key, and keeps `alias/…` mappings itself because Cloud KMS has no alias object.

The key ring's location decides where cryptographic operations run, for example `us-east1` or the `us` multi-region. Encryption uses the primary version; decryption uses the version recorded in the ciphertext.

![Each AWS key ID or alias resolves to one crypto key in a regional key ring. A crypto key has immutable versions, and new encryption uses the primary version.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjg2IiB2aWV3Qm94PSIwIDAgODM2IDI4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEFXUyBrZXkgSUQgb3IgYWxpYXMgcmVzb2x2ZXMgdG8gb25lIGNyeXB0byBrZXkgaW4gYSByZWdpb25hbCBrZXkgcmluZy4gQSBjcnlwdG8ga2V5IGhhcyBpbW11dGFibGUgdmVyc2lvbnMsIGFuZCBuZXcgZW5jcnlwdGlvbiB1c2VzIHRoZSBwcmltYXJ5IHZlcnNpb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdrbXMyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJna21zMmciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMzM0MTU1Ij5BIENSWVBUTyBLRVkgTElWRVMgSU4gQSBSRUdJT05BTCBLRVkgUklORyDCtyBJVFMgVkVSU0lPTlMgQVJFIElNTVVUQUJMRSDCtyBPTkUgSVMgUFJJTUFSWTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjUyIiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjEwNCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMTgiIHk9IjkwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEyLjVweCI+QVdTIEtNUyBrZXk8L3RleHQ+Cjx0ZXh0IHg9IjExOCIgeT0iMTEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPmtleSBpZCArIGFsaWFzL3BheW1lbnRzPC90ZXh0Pgo8dGV4dCB4PSIxMTgiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4Ij5vbmUgZmxhdCBrZXkgb2JqZWN0PC90ZXh0Pgo8bGluZSB4MT0iMjEyIiB5MT0iMTA0IiB4Mj0iMjUyIiB5Mj0iMTA0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczIpIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz4KPHRleHQgeD0iMjMyIiB5PSI5NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHgiPnJlc29sdmVzPC90ZXh0Pgo8cmVjdCB4PSIyNjIiIHk9IjQ0IiB3aWR0aD0iNTUwIiBoZWlnaHQ9IjIyNCIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzRmNDZlNSIvPgo8dGV4dCB4PSIyODAiIHk9IjY4IiBzdHlsZT0iZm9udDo3MDAgMTEuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNGY0NmU1Ij5DbG91ZCBLTVMga2V5IHJpbmc8dHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OidTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZvbnQtd2VpZ2h0OjQwMDtmb250LXNpemU6MTBweDtmaWxsOiM2NDc0OGIiPiAgwrcgIHJlZ2lvbiB1cy1lYXN0MTwvdHNwYW4+PC90ZXh0Pgo8cmVjdCB4PSIyODAiIHk9IjgwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjE3MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSI0NDUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+Y3J5cHRvIGtleSDCtyBwYXltZW50czwvdGV4dD4KPHRleHQgeD0iNDQ1IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiM2NDc0OGI7Zm9udC1zaXplOjEwcHgiPnB1cnBvc2UgRU5DUllQVF9ERUNSWVBUPC90ZXh0Pgo8cmVjdCB4PSIyOTYiIHk9IjE1MiIgd2lkdGg9Ijc4IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzM1IiB5PSIxNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPnYxPC90ZXh0Pgo8bGluZSB4MT0iMzc0IiB5MT0iMTY5IiB4Mj0iMzg2IiB5Mj0iMTY5IiBzdHJva2Utd2lkdGg9IjEuNiIgbWFya2VyLWVuZD0idXJsKCNna21zMikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIzODgiIHk9IjE1MiIgd2lkdGg9Ijc4IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNDI3IiB5PSIxNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPnYyPC90ZXh0Pgo8bGluZSB4MT0iNDY2IiB5MT0iMTY5IiB4Mj0iNDc4IiB5Mj0iMTY5IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNna21zMmcpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHJlY3QgeD0iNDgwIiB5PSIxNTAiIHdpZHRoPSIxMTIiIGhlaWdodD0iMzgiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MzYiIHk9IjE3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1Nztmb250LXdlaWdodDo3MDAiPnYzIMK3IHByaW1hcnk8L3RleHQ+Cjx0ZXh0IHg9IjQ0NSIgeT0iMjE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPktleSBtYXRlcmlhbCBpcyBpbW11dGFibGUgd2l0aGluIGEgdmVyc2lvbi48L3RleHQ+Cjx0ZXh0IHg9IjQ0NSIgeT0iMjM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPk5ldyBlbmNyeXB0aW9uIHVzZXMgdGhlIHByaW1hcnkgdmVyc2lvbi48L3RleHQ+CjxyZWN0IHg9IjYyMiIgeT0iODAiIHdpZHRoPSIxNzgiIGhlaWdodD0iMTcyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjcxMSIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTEuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij5jcnlwdG8ga2V5IMK3IG9yZGVyczwvdGV4dD4KPHRleHQgeD0iNzExIiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiM2NDc0OGI7Zm9udC1zaXplOjkuNXB4Ij5FTkNSWVBUX0RFQ1JZUFQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMSIgeT0iMTcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPml0cyBvd24gdmVyc2lvbnMsPC90ZXh0Pgo8dGV4dCB4PSI3MTEiIHk9IjE4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZToxMHB4Ij5pdHMgb3duIHByaW1hcnk8L3RleHQ+Cjwvc3ZnPg==)

![Each AWS key ID or alias resolves to one crypto key in a regional key ring. A crypto key has immutable versions, and new encryption uses the primary version.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjg2IiB2aWV3Qm94PSIwIDAgODM2IDI4NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJFYWNoIEFXUyBrZXkgSUQgb3IgYWxpYXMgcmVzb2x2ZXMgdG8gb25lIGNyeXB0byBrZXkgaW4gYSByZWdpb25hbCBrZXkgcmluZy4gQSBjcnlwdG8ga2V5IGhhcyBpbW11dGFibGUgdmVyc2lvbnMsIGFuZCBuZXcgZW5jcnlwdGlvbiB1c2VzIHRoZSBwcmltYXJ5IHZlcnNpb24uIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdrbXMyIiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJna21zMmciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjI0IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojY2JkNWUxIj5BIENSWVBUTyBLRVkgTElWRVMgSU4gQSBSRUdJT05BTCBLRVkgUklORyDCtyBJVFMgVkVSU0lPTlMgQVJFIElNTVVUQUJMRSDCtyBPTkUgSVMgUFJJTUFSWTwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjUyIiB3aWR0aD0iMTg4IiBoZWlnaHQ9IjEwNCIgcng9IjEyIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMTgiIHk9IjkwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEyLjVweCI+QVdTIEtNUyBrZXk8L3RleHQ+Cjx0ZXh0IHg9IjExOCIgeT0iMTEwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPmtleSBpZCArIGFsaWFzL3BheW1lbnRzPC90ZXh0Pgo8dGV4dCB4PSIxMTgiIHk9IjEyNiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4Ij5vbmUgZmxhdCBrZXkgb2JqZWN0PC90ZXh0Pgo8bGluZSB4MT0iMjEyIiB5MT0iMTA0IiB4Mj0iMjUyIiB5Mj0iMTA0IiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczIpIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz4KPHRleHQgeD0iMjMyIiB5PSI5NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHgiPnJlc29sdmVzPC90ZXh0Pgo8cmVjdCB4PSIyNjIiIHk9IjQ0IiB3aWR0aD0iNTUwIiBoZWlnaHQ9IjIyNCIgcng9IjEzIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6I2E1YjRmYyIvPgo8dGV4dCB4PSIyODAiIHk9IjY4IiBzdHlsZT0iZm9udDo3MDAgMTEuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYTViNGZjIj5DbG91ZCBLTVMga2V5IHJpbmc8dHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OidTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZvbnQtd2VpZ2h0OjQwMDtmb250LXNpemU6MTBweDtmaWxsOiM5NGEzYjgiPiAgwrcgIHJlZ2lvbiB1cy1lYXN0MTwvdHNwYW4+PC90ZXh0Pgo8cmVjdCB4PSIyODAiIHk9IjgwIiB3aWR0aD0iMzMwIiBoZWlnaHQ9IjE3MiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuMyIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSI0NDUiIHk9IjEwNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExLjVweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+Y3J5cHRvIGtleSDCtyBwYXltZW50czwvdGV4dD4KPHRleHQgeD0iNDQ1IiB5PSIxMjIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM5NGEzYjg7Zm9udC1zaXplOjEwcHgiPnB1cnBvc2UgRU5DUllQVF9ERUNSWVBUPC90ZXh0Pgo8cmVjdCB4PSIyOTYiIHk9IjE1MiIgd2lkdGg9Ijc4IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzM1IiB5PSIxNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPnYxPC90ZXh0Pgo8bGluZSB4MT0iMzc0IiB5MT0iMTY5IiB4Mj0iMzg2IiB5Mj0iMTY5IiBzdHJva2Utd2lkdGg9IjEuNiIgbWFya2VyLWVuZD0idXJsKCNna21zMikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIzODgiIHk9IjE1MiIgd2lkdGg9Ijc4IiBoZWlnaHQ9IjM0IiByeD0iOCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNDI3IiB5PSIxNzQiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPnYyPC90ZXh0Pgo8bGluZSB4MT0iNDY2IiB5MT0iMTY5IiB4Mj0iNDc4IiB5Mj0iMTY5IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNna21zMmcpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHJlY3QgeD0iNDgwIiB5PSIxNTAiIHdpZHRoPSIxMTIiIGhlaWdodD0iMzgiIHJ4PSI4IiBzdHJva2Utd2lkdGg9IjEuNiIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI1MzYiIHk9IjE3NCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNztmb250LXdlaWdodDo3MDAiPnYzIMK3IHByaW1hcnk8L3RleHQ+Cjx0ZXh0IHg9IjQ0NSIgeT0iMjE2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPktleSBtYXRlcmlhbCBpcyBpbW11dGFibGUgd2l0aGluIGEgdmVyc2lvbi48L3RleHQ+Cjx0ZXh0IHg9IjQ0NSIgeT0iMjM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPk5ldyBlbmNyeXB0aW9uIHVzZXMgdGhlIHByaW1hcnkgdmVyc2lvbi48L3RleHQ+CjxyZWN0IHg9IjYyMiIgeT0iODAiIHdpZHRoPSIxNzgiIGhlaWdodD0iMTcyIiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjcxMSIgeT0iMTIwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTEuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj5jcnlwdG8ga2V5IMK3IG9yZGVyczwvdGV4dD4KPHRleHQgeD0iNzExIiB5PSIxMzgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiM5NGEzYjg7Zm9udC1zaXplOjkuNXB4Ij5FTkNSWVBUX0RFQ1JZUFQ8L3RleHQ+Cjx0ZXh0IHg9IjcxMSIgeT0iMTcyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPml0cyBvd24gdmVyc2lvbnMsPC90ZXh0Pgo8dGV4dCB4PSI3MTEiIHk9IjE4OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZToxMHB4Ij5pdHMgb3duIHByaW1hcnk8L3RleHQ+Cjwvc3ZnPg==)

Each AWS key is one crypto key in a regional key ring; new encryption uses its primary version.

#### Supported keys and operations

`CreateKey` creates a symmetric Cloud KMS crypto key with purpose `ENCRYPT_DECRYPT`. A request for any other `KeySpec` or `KeyUsage` (RSA, ECC or HMAC keys), an imported-material `Origin`, or `MultiRegion` is rejected with `UnsupportedOperationException`.

`Encrypt`, `Decrypt`, `ReEncrypt`, `GenerateDataKey` and `GenerateDataKeyWithoutPlaintext` are supported. `Sign`, `Verify`, `GetPublicKey`, data-key pairs, `GenerateMac` and `VerifyMac` return `UnsupportedOperationException`.

#### How GenerateDataKey works

`GenerateDataKey` returns a plaintext data key and an encrypted (wrapped) copy. The application uses the plaintext key to encrypt its data locally, then discards that key and stores the wrapped copy beside the encrypted data. To read the data later, it asks the key service to decrypt the wrapped key.

Cloud KMS has no single data-key call, so the adapter generates a random data key of the requested size and calls `cryptoKeys.encrypt` to wrap it, returning the usual `Plaintext` and `CiphertextBlob`. `cryptoKeys.decrypt` unwraps it later. Both calls bind the encryption context. The adapter adds the key ID to the Cloud KMS ciphertext so `Decrypt` can find the key; treat the blob as opaque.

![For GenerateDataKey the adapter makes a random data key and has Cloud KMS encrypt it. Later, Cloud KMS decrypts the wrapped key so your application can read its data.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjk2IiB2aWV3Qm94PSIwIDAgODM2IDI5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGb3IgR2VuZXJhdGVEYXRhS2V5IHRoZSBhZGFwdGVyIG1ha2VzIGEgcmFuZG9tIGRhdGEga2V5IGFuZCBoYXMgQ2xvdWQgS01TIGVuY3J5cHQgaXQuIExhdGVyLCBDbG91ZCBLTVMgZGVjcnlwdHMgdGhlIHdyYXBwZWQga2V5IHNvIHlvdXIgYXBwbGljYXRpb24gY2FuIHJlYWQgaXRzIGRhdGEuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1fTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdrbXM0IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM5NGEzYjgiLz48L21hcmtlcj48bWFya2VyIGlkPSJna21zNGciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjIyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMzM0MTU1Ij5HZW5lcmF0ZURhdGFLZXk6IGdlbmVyYXRlLCB0aGVuIHdyYXA8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjIxNCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMzEiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPuKRoCByYW5kb20gZGF0YSBrZXk8L3RleHQ+Cjx0ZXh0IHg9IjEzMSIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6MTBweCI+cmVxdWVzdGVkIHNpemUsIGdlbmVyYXRlZCBsb2NhbGx5PC90ZXh0Pgo8bGluZSB4MT0iMjM4IiB5MT0iNzMiIHgyPSIyNzIiIHkyPSI3MyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM0KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+Cjx0ZXh0IHg9IjI1NSIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OHB4Ij53cmFwPC90ZXh0Pgo8cmVjdCB4PSIyNzYiIHk9IjQwIiB3aWR0aD0iMjE0IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjM4MyIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMnB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNGY0NmU1Ij7ikaEgY3J5cHRvS2V5cy5lbmNyeXB0PC90ZXh0Pgo8dGV4dCB4PSIzODMiIHk9Ijg4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjEwcHgiPnRoZSBvbmUgQ2xvdWQgS01TIGNhbGw8L3RleHQ+CjxsaW5lIHgxPSI0OTAiIHkxPSI3MyIgeDI9IjUyNCIgeTI9IjczIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczRnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+CjxyZWN0IHg9IjUyOCIgeT0iNDAiIHdpZHRoPSIyODQiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNjcwIiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMnB4Ij7ikaIgJiMxMjM7IHBsYWludGV4dCArIHdyYXBwZWQgJiMxMjU7PC90ZXh0Pgo8dGV4dCB4PSI2NzAiIHk9Ijg4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTBweCI+R2VuZXJhdGVEYXRhS2V5IHJlc3BvbnNlPC90ZXh0Pgo8dGV4dCB4PSIyNiIgeT0iMTQ2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzk0YTNiODsgZmlsbDojMDQ3ODU3Ij5MQVRFUiwgVE8gUkVBRCBUSEUgREFUQSBCQUNLPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTYwIiB3aWR0aD0iMTc4IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjExMyIgeT0iMTg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+d3JhcHBlZCBkYXRhIGtleTwvdGV4dD4KPHRleHQgeD0iMTEzIiB5PSIyMDMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPmtlcHQgYmVzaWRlIHlvdXIgY2lwaGVydGV4dDwvdGV4dD4KPGxpbmUgeDE9IjIwMiIgeTE9IjE5MCIgeDI9IjIzOCIgeTI9IjE5MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM0KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjI0MiIgeT0iMTYwIiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojZWVmMmZmO3N0cm9rZTojNGY0NmU1Ii8+Cjx0ZXh0IHg9IjMzMCIgeT0iMTg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTEuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojNGY0NmU1Ij5jcnlwdG9LZXlzLmRlY3J5cHQ8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMjAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij51bndyYXBzIHRoZSBkYXRhIGtleTwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjE5MCIgeDI9IjQ1NCIgeTI9IjE5MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM0KSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+CjxyZWN0IHg9IjQ1OCIgeT0iMTYwIiB3aWR0aD0iMTYwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjUzOCIgeT0iMTg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExLjVweCI+cGxhaW50ZXh0IGRhdGEga2V5PC90ZXh0Pgo8dGV4dCB4PSI1MzgiIHk9IjIwMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+dXNlZCBvbmNlLCBkaXNjYXJkZWQ8L3RleHQ+CjxsaW5lIHgxPSI2MTgiIHkxPSIxOTAiIHgyPSI2NTQiIHkyPSIxOTAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNna21zNGcpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHJlY3QgeD0iNjU4IiB5PSIxNjAiIHdpZHRoPSIxNTQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNzM1IiB5PSIxODYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6MTEuNXB4Ij55b3VyIGRhdGEsIHJlYWQ8L3RleHQ+Cjx0ZXh0IHg9IjczNSIgeT0iMjAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OS41cHgiPmRlY3J5cHRlZCBsb2NhbGx5PC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMjQ4IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNhN2YzZDAiLz4KPHRleHQgeD0iNDE4IiB5PSIyNjkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMC41cHgiPkNsb3VkIEtNUyBlbmNyeXB0cyBhbmQgZGVjcnlwdHMgdGhlIGdlbmVyYXRlZCBkYXRhIGtleTwvdGV4dD4KPC9zdmc+)

![For GenerateDataKey the adapter makes a random data key and has Cloud KMS encrypt it. Later, Cloud KMS decrypts the wrapped key so your application can read its data.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjk2IiB2aWV3Qm94PSIwIDAgODM2IDI5NiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJGb3IgR2VuZXJhdGVEYXRhS2V5IHRoZSBhZGFwdGVyIG1ha2VzIGEgcmFuZG9tIGRhdGEga2V5IGFuZCBoYXMgQ2xvdWQgS01TIGVuY3J5cHQgaXQuIExhdGVyLCBDbG91ZCBLTVMgZGVjcnlwdHMgdGhlIHdyYXBwZWQga2V5IHNvIHlvdXIgYXBwbGljYXRpb24gY2FuIHJlYWQgaXRzIGRhdGEuIj48c3R5bGU+dGV4dHtmb250LWZhbWlseTpJbnRlciwtYXBwbGUtc3lzdGVtLEJsaW5rTWFjU3lzdGVtRm9udCwnU2Vnb2UgVUknLFJvYm90bywnSGVsdmV0aWNhIE5ldWUnLEFyaWFsLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxfTwvc3R5bGU+CjxkZWZzPjxtYXJrZXIgaWQ9ImdrbXM0IiB2aWV3Qm94PSIwIDAgMTAgMTAiIHJlZlg9IjgiIHJlZlk9IjUiIG1hcmtlcldpZHRoPSI3IiBtYXJrZXJIZWlnaHQ9IjciIG9yaWVudD0iYXV0by1zdGFydC1yZXZlcnNlIj48cGF0aCBkPSJNMCwwIEwxMCw1IEwwLDEwIHoiIHN0eWxlPSJmaWxsOiM2NDc0OGIiLz48L21hcmtlcj48bWFya2VyIGlkPSJna21zNGciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjwvZGVmcz4KPHRleHQgeD0iMjYiIHk9IjIyIiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojY2JkNWUxIj5HZW5lcmF0ZURhdGFLZXk6IGdlbmVyYXRlLCB0aGVuIHdyYXA8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0MCIgd2lkdGg9IjIxNCIgaGVpZ2h0PSI2NiIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMzEiIHk9IjcwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPuKRoCByYW5kb20gZGF0YSBrZXk8L3RleHQ+Cjx0ZXh0IHg9IjEzMSIgeT0iODgiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6MTBweCI+cmVxdWVzdGVkIHNpemUsIGdlbmVyYXRlZCBsb2NhbGx5PC90ZXh0Pgo8bGluZSB4MT0iMjM4IiB5MT0iNzMiIHgyPSIyNzIiIHkyPSI3MyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM0KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+Cjx0ZXh0IHg9IjI1NSIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMHB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OHB4Ij53cmFwPC90ZXh0Pgo8cmVjdCB4PSIyNzYiIHk9IjQwIiB3aWR0aD0iMjE0IiBoZWlnaHQ9IjY2IiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjM4MyIgeT0iNzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMnB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYTViNGZjIj7ikaEgY3J5cHRvS2V5cy5lbmNyeXB0PC90ZXh0Pgo8dGV4dCB4PSIzODMiIHk9Ijg4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjEwcHgiPnRoZSBvbmUgQ2xvdWQgS01TIGNhbGw8L3RleHQ+CjxsaW5lIHgxPSI0OTAiIHkxPSI3MyIgeDI9IjUyNCIgeTI9IjczIiBzdHJva2Utd2lkdGg9IjIiIG1hcmtlci1lbmQ9InVybCgjZ2ttczRnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+CjxyZWN0IHg9IjUyOCIgeT0iNDAiIHdpZHRoPSIyODQiIGhlaWdodD0iNjYiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNjcwIiB5PSI3MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMnB4Ij7ikaIgJiMxMjM7IHBsYWludGV4dCArIHdyYXBwZWQgJiMxMjU7PC90ZXh0Pgo8dGV4dCB4PSI2NzAiIHk9Ijg4IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTBweCI+R2VuZXJhdGVEYXRhS2V5IHJlc3BvbnNlPC90ZXh0Pgo8dGV4dCB4PSIyNiIgeT0iMTQ2IiBzdHlsZT0iZm9udDogNzAwIDEwcHggSW50ZXIsIHNhbnMtc2VyaWY7IGxldHRlci1zcGFjaW5nOiAxLjNweDsgZmlsbDogIzY0NzQ4YjsgZmlsbDojNmVlN2I3Ij5MQVRFUiwgVE8gUkVBRCBUSEUgREFUQSBCQUNLPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMTYwIiB3aWR0aD0iMTc4IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjExMyIgeT0iMTg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+d3JhcHBlZCBkYXRhIGtleTwvdGV4dD4KPHRleHQgeD0iMTEzIiB5PSIyMDMiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPmtlcHQgYmVzaWRlIHlvdXIgY2lwaGVydGV4dDwvdGV4dD4KPGxpbmUgeDE9IjIwMiIgeTE9IjE5MCIgeDI9IjIzOCIgeTI9IjE5MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM0KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjI0MiIgeT0iMTYwIiB3aWR0aD0iMTc2IiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS42IiBzdHlsZT0iZmlsbDojMWUxYjRiO3N0cm9rZTojYTViNGZjIi8+Cjx0ZXh0IHg9IjMzMCIgeT0iMTg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTEuNXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojYTViNGZjIj5jcnlwdG9LZXlzLmRlY3J5cHQ8L3RleHQ+Cjx0ZXh0IHg9IjMzMCIgeT0iMjAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij51bndyYXBzIHRoZSBkYXRhIGtleTwvdGV4dD4KPGxpbmUgeDE9IjQxOCIgeTE9IjE5MCIgeDI9IjQ1NCIgeTI9IjE5MCIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM0KSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+CjxyZWN0IHg9IjQ1OCIgeT0iMTYwIiB3aWR0aD0iMTYwIiBoZWlnaHQ9IjYwIiByeD0iMTEiIHN0cm9rZS13aWR0aD0iMS41IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjUzOCIgeT0iMTg2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExLjVweCI+cGxhaW50ZXh0IGRhdGEga2V5PC90ZXh0Pgo8dGV4dCB4PSI1MzgiIHk9IjIwMyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+dXNlZCBvbmNlLCBkaXNjYXJkZWQ8L3RleHQ+CjxsaW5lIHgxPSI2MTgiIHkxPSIxOTAiIHgyPSI2NTQiIHkyPSIxOTAiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNna21zNGcpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHJlY3QgeD0iNjU4IiB5PSIxNjAiIHdpZHRoPSIxNTQiIGhlaWdodD0iNjAiIHJ4PSIxMSIgc3Ryb2tlLXdpZHRoPSIxLjciIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNzM1IiB5PSIxODYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA3MDAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6MTEuNXB4Ij55b3VyIGRhdGEsIHJlYWQ8L3RleHQ+Cjx0ZXh0IHg9IjczNSIgeT0iMjAzIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OS41cHgiPmRlY3J5cHRlZCBsb2NhbGx5PC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMjQ4IiB3aWR0aD0iNzg4IiBoZWlnaHQ9IjM0IiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNDE4IiB5PSIyNjkiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMC41cHgiPkNsb3VkIEtNUyBlbmNyeXB0cyBhbmQgZGVjcnlwdHMgdGhlIGdlbmVyYXRlZCBkYXRhIGtleTwvdGV4dD4KPC9zdmc+)

The adapter generates a random data key and wraps it with cryptoKeys.encrypt .

#### Encryption context and authenticated data

An encryption context is a non-secret key/value map bound to ciphertext as additional authenticated data (AAD). Decryption requires the same context. Applications can use it to bind encrypted values to a tenant or purpose.

Cloud KMS accepts up to 64 KiB of `additionalAuthenticatedData`. The adapter writes the context map in a fixed byte order, so the order of its entries does not affect decryption, and uses the same encoding for encryption and data-key wrapping. A different context makes decryption fail.

![An encryption context is bound into the ciphertext. Decrypt with the same context returns the plaintext; a different context fails. Cloud KMS binds it as additional authenticated data of up to 64 KiB.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjYyIiB2aWV3Qm94PSIwIDAgODM2IDI2MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBlbmNyeXB0aW9uIGNvbnRleHQgaXMgYm91bmQgaW50byB0aGUgY2lwaGVydGV4dC4gRGVjcnlwdCB3aXRoIHRoZSBzYW1lIGNvbnRleHQgcmV0dXJucyB0aGUgcGxhaW50ZXh0OyBhIGRpZmZlcmVudCBjb250ZXh0IGZhaWxzLiBDbG91ZCBLTVMgYmluZHMgaXQgYXMgYWRkaXRpb25hbCBhdXRoZW50aWNhdGVkIGRhdGEgb2YgdXAgdG8gNjQgS2lCLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJna21zNWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzA0Nzg1NyIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdrbXM1ciIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZGMyNjI2Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMzMzQxNTUiPkFOIEVOQ1JZUFRJT04tQ09OVEVYVCBNQVAgSVMgQk9VTkQgSU5UTyBUSEUgQ0lQSEVSVEVYVCBBUyBhZGRpdGlvbmFsQXV0aGVudGljYXRlZERhdGE8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0NCIgd2lkdGg9IjIyNCIgaGVpZ2h0PSI5OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxMzYiIHk9IjY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjEycHgiPkVuY3J5cHQgwrcgY29udGV4dCBtYXA8L3RleHQ+CjxyZWN0IHg9IjQwIiB5PSI3OCIgd2lkdGg9IjE5MiIgaGVpZ2h0PSI0OCIgcng9IjgiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMTM2IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NTtmb250LXNpemU6MTBweCI+dGVuYW50ID0gYWNtZTwvdGV4dD4KPHRleHQgeD0iMTM2IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTU7Zm9udC1zaXplOjEwcHgiPnB1cnBvc2UgPSBwYXltZW50czwvdGV4dD4KPGxpbmUgeDE9IjI0OCIgeTE9IjkzIiB4Mj0iMjg2IiB5Mj0iOTMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNna21zNWcpIiBzdHlsZT0ic3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMjY3IiB5PSI4NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHgiPmJpbmQ8L3RleHQ+CjxyZWN0IHg9IjI5MCIgeT0iNjgiIHdpZHRoPSIxNjgiIGhlaWdodD0iNTIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iMzc0IiB5PSI5MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMS41cHgiPkNpcGhlcnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjM3NCIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMDQ3ODU3OyBmb250LXNpemU6OS41cHgiPmJvdW5kIHRvIHRoYXQgY29udGV4dDwvdGV4dD4KPGxpbmUgeDE9IjQ1OCIgeTE9IjgyIiB4Mj0iNDk2IiB5Mj0iNzIiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2drbXM1ZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8bGluZSB4MT0iNDU4IiB5MT0iMTA2IiB4Mj0iNDk2IiB5Mj0iMTIwIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNna21zNXIpIiBzdHlsZT0ic3Ryb2tlOiNkYzI2MjYiLz4KPHJlY3QgeD0iNTAwIiB5PSI1MiIgd2lkdGg9IjMxMiIgaGVpZ2h0PSI0NCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI1MTgiIHk9IjcyIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzA0Nzg1NzsgZm9udC1zaXplOjExLjVweCI+RGVjcnlwdCDCtyBzYW1lIGNvbnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjUxOCIgeT0iODgiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5LjVweCI+4pyTIHJldHVybnMgdGhlIHBsYWludGV4dDwvdGV4dD4KPHJlY3QgeD0iNTAwIiB5PSIxMDQiIHdpZHRoPSIzMTIiIGhlaWdodD0iNDQiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNmZWNhY2EiLz4KPHRleHQgeD0iNTE4IiB5PSIxMjQiIHN0eWxlPSJmb250OjcwMCAxMS41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNkYzI2MjYiPkRlY3J5cHQgwrcgZGlmZmVyZW50IGNvbnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjUxOCIgeT0iMTQwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2RjMjYyNiI+4pyXIGZhaWxzOyB0aGUgd3JvbmcgY29udGV4dCBjYW5ub3QgcmVhZCBpdDwvdGV4dD4KPHRleHQgeD0iMjYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SE9XIENMT1VEIEtNUyBCSU5EUyBJVDwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE5NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI1NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6I2ZmZmZmZjtzdHJva2U6I2NiZDVlMSIvPgo8dGV4dCB4PSIxNTIiIHk9IjIxNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTUiPkJvdW5kIG5hdGl2ZWx5PC90ZXh0Pgo8dGV4dCB4PSIxNTIiIHk9IjIzNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzY0NzQ4Yjtmb250LXNpemU6OXB4Ij5hZGRpdGlvbmFsQXV0aGVudGljYXRlZERhdGE8L3RleHQ+CjxyZWN0IHg9IjI5MCIgeT0iMTk0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjU2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iMjE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+Q2Fub25pY2FsaXplZCBtYXA8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMjM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5zdGFibGUgYnl0ZSBvcmRlciwgc28gd3JhcCA9IHVud3JhcDwvdGV4dD4KPHJlY3QgeD0iNTU2IiB5PSIxOTQiIHdpZHRoPSIyNTYiIGhlaWdodD0iNTYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjg0IiB5PSIyMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij5VcCB0byA2NCBLaUI8L3RleHQ+Cjx0ZXh0IHg9IjY4NCIgeT0iMjM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5hbHNvIGJvdW5kIGludG8gdGhlIGRhdGEta2V5IHdyYXA8L3RleHQ+Cjwvc3ZnPg==)

![An encryption context is bound into the ciphertext. Decrypt with the same context returns the plaintext; a different context fails. Cloud KMS binds it as additional authenticated data of up to 64 KiB.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjYyIiB2aWV3Qm94PSIwIDAgODM2IDI2MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBlbmNyeXB0aW9uIGNvbnRleHQgaXMgYm91bmQgaW50byB0aGUgY2lwaGVydGV4dC4gRGVjcnlwdCB3aXRoIHRoZSBzYW1lIGNvbnRleHQgcmV0dXJucyB0aGUgcGxhaW50ZXh0OyBhIGRpZmZlcmVudCBjb250ZXh0IGZhaWxzLiBDbG91ZCBLTVMgYmluZHMgaXQgYXMgYWRkaXRpb25hbCBhdXRoZW50aWNhdGVkIGRhdGEgb2YgdXAgdG8gNjQgS2lCLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPgo8ZGVmcz48bWFya2VyIGlkPSJna21zNWciIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzZlZTdiNyIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdrbXM1ciIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojZjg3MTcxIi8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNjYmQ1ZTEiPkFOIEVOQ1JZUFRJT04tQ09OVEVYVCBNQVAgSVMgQk9VTkQgSU5UTyBUSEUgQ0lQSEVSVEVYVCBBUyBhZGRpdGlvbmFsQXV0aGVudGljYXRlZERhdGE8L3RleHQ+CjxyZWN0IHg9IjI0IiB5PSI0NCIgd2lkdGg9IjIyNCIgaGVpZ2h0PSI5OCIgcng9IjExIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxMzYiIHk9IjY2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjEycHgiPkVuY3J5cHQgwrcgY29udGV4dCBtYXA8L3RleHQ+CjxyZWN0IHg9IjQwIiB5PSI3OCIgd2lkdGg9IjE5MiIgaGVpZ2h0PSI0OCIgcng9IjgiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMTM2IiB5PSI5OCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMTtmb250LXNpemU6MTBweCI+dGVuYW50ID0gYWNtZTwvdGV4dD4KPHRleHQgeD0iMTM2IiB5PSIxMTUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTE7Zm9udC1zaXplOjEwcHgiPnB1cnBvc2UgPSBwYXltZW50czwvdGV4dD4KPGxpbmUgeDE9IjI0OCIgeTE9IjkzIiB4Mj0iMjg2IiB5Mj0iOTMiIHN0cm9rZS13aWR0aD0iMiIgbWFya2VyLWVuZD0idXJsKCNna21zNWcpIiBzdHlsZT0ic3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMjY3IiB5PSI4NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHgiPmJpbmQ8L3RleHQ+CjxyZWN0IHg9IjI5MCIgeT0iNjgiIHdpZHRoPSIxNjgiIGhlaWdodD0iNTIiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iMzc0IiB5PSI5MCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMS41cHgiPkNpcGhlcnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjM3NCIgeT0iMTA3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTAuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNmVlN2I3OyBmb250LXNpemU6OS41cHgiPmJvdW5kIHRvIHRoYXQgY29udGV4dDwvdGV4dD4KPGxpbmUgeDE9IjQ1OCIgeTE9IjgyIiB4Mj0iNDk2IiB5Mj0iNzIiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2drbXM1ZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8bGluZSB4MT0iNDU4IiB5MT0iMTA2IiB4Mj0iNDk2IiB5Mj0iMTIwIiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNna21zNXIpIiBzdHlsZT0ic3Ryb2tlOiNmODcxNzEiLz4KPHJlY3QgeD0iNTAwIiB5PSI1MiIgd2lkdGg9IjMxMiIgaGVpZ2h0PSI0NCIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI1MTgiIHk9IjcyIiBzdHlsZT0iZm9udDogNzAwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzZlZTdiNzsgZm9udC1zaXplOjExLjVweCI+RGVjcnlwdCDCtyBzYW1lIGNvbnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjUxOCIgeT0iODgiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5LjVweCI+4pyTIHJldHVybnMgdGhlIHBsYWludGV4dDwvdGV4dD4KPHJlY3QgeD0iNTAwIiB5PSIxMDQiIHdpZHRoPSIzMTIiIGhlaWdodD0iNDQiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM3ZjFkMWQiLz4KPHRleHQgeD0iNTE4IiB5PSIxMjQiIHN0eWxlPSJmb250OjcwMCAxMS41cHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNmODcxNzEiPkRlY3J5cHQgwrcgZGlmZmVyZW50IGNvbnRleHQ8L3RleHQ+Cjx0ZXh0IHg9IjUxOCIgeT0iMTQwIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4O2ZpbGw6I2Y4NzE3MSI+4pyXIGZhaWxzOyB0aGUgd3JvbmcgY29udGV4dCBjYW5ub3QgcmVhZCBpdDwvdGV4dD4KPHRleHQgeD0iMjYiIHk9IjE4MiIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SE9XIENMT1VEIEtNUyBCSU5EUyBJVDwvdGV4dD4KPHJlY3QgeD0iMjQiIHk9IjE5NCIgd2lkdGg9IjI1NiIgaGVpZ2h0PSI1NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNCIgc3R5bGU9ImZpbGw6IzFlMjkzYjtzdHJva2U6IzQ3NTU2OSIvPgo8dGV4dCB4PSIxNTIiIHk9IjIxNyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6NzAwIDExcHggSW50ZXIsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTEiPkJvdW5kIG5hdGl2ZWx5PC90ZXh0Pgo8dGV4dCB4PSIxNTIiIHk9IjIzNCIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6Izk0YTNiODtmb250LXNpemU6OXB4Ij5hZGRpdGlvbmFsQXV0aGVudGljYXRlZERhdGE8L3RleHQ+CjxyZWN0IHg9IjI5MCIgeT0iMTk0IiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjU2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iMjE3IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+Q2Fub25pY2FsaXplZCBtYXA8L3RleHQ+Cjx0ZXh0IHg9IjQxOCIgeT0iMjM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5zdGFibGUgYnl0ZSBvcmRlciwgc28gd3JhcCA9IHVud3JhcDwvdGV4dD4KPHJlY3QgeD0iNTU2IiB5PSIxOTQiIHdpZHRoPSIyNTYiIGhlaWdodD0iNTYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjg0IiB5PSIyMTciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj5VcCB0byA2NCBLaUI8L3RleHQ+Cjx0ZXh0IHg9IjY4NCIgeT0iMjM0IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5hbHNvIGJvdW5kIGludG8gdGhlIGRhdGEta2V5IHdyYXA8L3RleHQ+Cjwvc3ZnPg==)

The adapter encodes the encryption context as additionalAuthenticatedData . Decryption requires the same context.

#### Rotation

Rotation creates a new version for later encryption. Older versions that stay enabled still decrypt existing ciphertext.

`EnableKeyRotation` sets the crypto key's `rotation_period`, which creates new versions on schedule and makes each one primary; `GetKeyRotationStatus` reports whether rotation is on. `RotateKeyOnDemand` returns `UnsupportedOperationException`. Older enabled versions stay usable until disabled or destroyed.

![Automatic rotation adds a new primary version for new encryption. Older versions stay enabled, so ciphertext made under them still decrypts. On-demand rotation is not supported.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjYyIiB2aWV3Qm94PSIwIDAgODM2IDI2MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBdXRvbWF0aWMgcm90YXRpb24gYWRkcyBhIG5ldyBwcmltYXJ5IHZlcnNpb24gZm9yIG5ldyBlbmNyeXB0aW9uLiBPbGRlciB2ZXJzaW9ucyBzdGF5IGVuYWJsZWQsIHNvIGNpcGhlcnRleHQgbWFkZSB1bmRlciB0aGVtIHN0aWxsIGRlY3J5cHRzLiBPbi1kZW1hbmQgcm90YXRpb24gaXMgbm90IHN1cHBvcnRlZC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2ttczYiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6Izk0YTNiOCIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdrbXM2ZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojMDQ3ODU3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjOTRhM2I4OyBmaWxsOiMzMzQxNTUiPkEgTkVXIFZFUlNJT04gQkVDT01FUyBQUklNQVJZIMK3IE9MREVSIFZFUlNJT05TIFNUQVkgRU5BQkxFRCwgU08gT0xEIENJUEhFUlRFWFRTIFNUSUxMIERFQ1JZUFQ8L3RleHQ+CjxyZWN0IHg9IjYwIiB5PSI0NiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjEzNSIgeT0iNzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjMzM0MTU1OyBmaWxsOiMzMzQxNTUiPnZlcnNpb24gdjE8L3RleHQ+CjxsaW5lIHgxPSIyMTAiIHkxPSI2NiIgeDI9IjI1MiIgeTI9IjY2IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNna21zNikiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPgo8cmVjdCB4PSIyNTYiIHk9IjQ2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iMzMxIiB5PSI3MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzMzNDE1NSI+dmVyc2lvbiB2MjwvdGV4dD4KPGxpbmUgeDE9IjQwNiIgeTE9IjY2IiB4Mj0iNDQ4IiB5Mj0iNjYiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2drbXM2ZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8cmVjdCB4PSI0NTIiIHk9IjQ2IiB3aWR0aD0iMTgyIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiNlY2ZkZjU7c3Ryb2tlOiMwNDc4NTciLz4KPHRleHQgeD0iNTQzIiB5PSI3MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICMzMzQxNTU7IGZpbGw6IzA0Nzg1Nztmb250LXdlaWdodDo3MDAiPnYzIMK3IG5ldyBwcmltYXJ5PC90ZXh0Pgo8bGluZSB4MT0iNTQzIiB5MT0iODYiIHgyPSI1NDMiIHkyPSI5OCIgc3Ryb2tlLXdpZHRoPSIxLjQiIG1hcmtlci1lbmQ9InVybCgjZ2ttczZnKSIgc3R5bGU9InN0cm9rZTojMDQ3ODU3Ii8+Cjx0ZXh0IHg9IjU0MyIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjlweCI+bmV3IGVuY3J5cHRzIHVzZSB0aGUgcHJpbWFyeSB2ZXJzaW9uPC90ZXh0Pgo8cmVjdCB4PSI2MCIgeT0iMTMwIiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjE2NSIgeT0iMTUxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYTsgZm9udC1zaXplOjExcHgiPk9sZCBjaXBoZXJ0ZXh0PC90ZXh0Pgo8dGV4dCB4PSIxNjUiIHk9IjE2NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+d3JhcHBlZCB1bmRlciB2MTwvdGV4dD4KPGxpbmUgeDE9IjI3MCIgeTE9IjE1MyIgeDI9IjMzMCIgeTI9IjE1MyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM2ZykiIHN0eWxlPSJzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSIzMDIiIHk9IjE0NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo4cHgiPmRlY3J5cHQg4oaSIHYxPC90ZXh0Pgo8cmVjdCB4PSIzMzQiIHk9IjEzMCIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6I2VjZmRmNTtzdHJva2U6IzA0Nzg1NyIvPgo8dGV4dCB4PSI0ODQiIHk9IjE1MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZToxMXB4Ij5TdGlsbCByZWFkYWJsZTwvdGV4dD4KPHRleHQgeD0iNDg0IiB5PSIxNjciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwNDc4NTc7IGZvbnQtc2l6ZTo5LjVweCI+VmVyc2lvbiAxIHJlbWFpbnMgZW5hYmxlZCBmb3IgZGVjcnlwdGlvbjwvdGV4dD4KPHRleHQgeD0iMjYiIHk9IjIwMCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM5NGEzYjg7IGZpbGw6IzA0Nzg1NyI+SE9XIENMT1VEIEtNUyBST1RBVEVTPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMjEwIiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjE1MiIgeT0iMjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZpbGw6IzMzNDE1NSI+cm90YXRpb25fcGVyaW9kPC90ZXh0Pgo8dGV4dCB4PSIxNTIiIHk9IjI0NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGI7IGZvbnQtc2l6ZTo5LjVweCI+c2V0cyB0aGUgYXV0b21hdGljIGNhZGVuY2U8L3RleHQ+CjxyZWN0IHg9IjI5MCIgeT0iMjEwIiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojZmZmZmZmO3N0cm9rZTojY2JkNWUxIi8+Cjx0ZXh0IHg9IjQxOCIgeT0iMjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NSI+YSBuZXcgdmVyc2lvbiDihpIgcHJpbWFyeTwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIyNDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiOyBmb250LXNpemU6OS41cHgiPm9sZGVyIHZlcnNpb25zIHN0YXkgRU5BQkxFRDwvdGV4dD4KPHJlY3QgeD0iNTU2IiB5PSIyMTAiIHdpZHRoPSIyNTYiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiNmZmZmZmY7c3Ryb2tlOiNjYmQ1ZTEiLz4KPHRleHQgeD0iNjg0IiB5PSIyMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojMzM0MTU1Ij5vbi1kZW1hbmQgcm90YXRpb248L3RleHQ+Cjx0ZXh0IHg9IjY4NCIgeT0iMjQ2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YjsgZm9udC1zaXplOjkuNXB4Ij5ub3Qgc3VwcG9ydGVkPC90ZXh0Pgo8L3N2Zz4=)

![Automatic rotation adds a new primary version for new encryption. Older versions stay enabled, so ciphertext made under them still decrypts. On-demand rotation is not supported.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMjYyIiB2aWV3Qm94PSIwIDAgODM2IDI2MiIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBdXRvbWF0aWMgcm90YXRpb24gYWRkcyBhIG5ldyBwcmltYXJ5IHZlcnNpb24gZm9yIG5ldyBlbmNyeXB0aW9uLiBPbGRlciB2ZXJzaW9ucyBzdGF5IGVuYWJsZWQsIHNvIGNpcGhlcnRleHQgbWFkZSB1bmRlciB0aGVtIHN0aWxsIGRlY3J5cHRzLiBPbi1kZW1hbmQgcm90YXRpb24gaXMgbm90IHN1cHBvcnRlZC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT4KPGRlZnM+PG1hcmtlciBpZD0iZ2ttczYiIHZpZXdCb3g9IjAgMCAxMCAxMCIgcmVmWD0iOCIgcmVmWT0iNSIgbWFya2VyV2lkdGg9IjciIG1hcmtlckhlaWdodD0iNyIgb3JpZW50PSJhdXRvLXN0YXJ0LXJldmVyc2UiPjxwYXRoIGQ9Ik0wLDAgTDEwLDUgTDAsMTAgeiIgc3R5bGU9ImZpbGw6IzY0NzQ4YiIvPjwvbWFya2VyPjxtYXJrZXIgaWQ9ImdrbXM2ZyIgdmlld0JveD0iMCAwIDEwIDEwIiByZWZYPSI4IiByZWZZPSI1IiBtYXJrZXJXaWR0aD0iNyIgbWFya2VySGVpZ2h0PSI3IiBvcmllbnQ9ImF1dG8tc3RhcnQtcmV2ZXJzZSI+PHBhdGggZD0iTTAsMCBMMTAsNSBMMCwxMCB6IiBzdHlsZT0iZmlsbDojNmVlN2I3Ii8+PC9tYXJrZXI+PC9kZWZzPgo8dGV4dCB4PSIyNiIgeT0iMjQiIHN0eWxlPSJmb250OiA3MDAgMTBweCBJbnRlciwgc2Fucy1zZXJpZjsgbGV0dGVyLXNwYWNpbmc6IDEuM3B4OyBmaWxsOiAjNjQ3NDhiOyBmaWxsOiNjYmQ1ZTEiPkEgTkVXIFZFUlNJT04gQkVDT01FUyBQUklNQVJZIMK3IE9MREVSIFZFUlNJT05TIFNUQVkgRU5BQkxFRCwgU08gT0xEIENJUEhFUlRFWFRTIFNUSUxMIERFQ1JZUFQ8L3RleHQ+CjxyZWN0IHg9IjYwIiB5PSI0NiIgd2lkdGg9IjE1MCIgaGVpZ2h0PSI0MCIgcng9IjkiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjEzNSIgeT0iNzEiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlOyBmaWxsOiAjY2JkNWUxOyBmaWxsOiNjYmQ1ZTEiPnZlcnNpb24gdjE8L3RleHQ+CjxsaW5lIHgxPSIyMTAiIHkxPSI2NiIgeDI9IjI1MiIgeTI9IjY2IiBzdHJva2Utd2lkdGg9IjEuOCIgbWFya2VyLWVuZD0idXJsKCNna21zNikiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPgo8cmVjdCB4PSIyNTYiIHk9IjQ2IiB3aWR0aD0iMTUwIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjQiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iMzMxIiB5PSI3MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6I2NiZDVlMSI+dmVyc2lvbiB2MjwvdGV4dD4KPGxpbmUgeDE9IjQwNiIgeTE9IjY2IiB4Mj0iNDQ4IiB5Mj0iNjYiIHN0cm9rZS13aWR0aD0iMS44IiBtYXJrZXItZW5kPSJ1cmwoI2drbXM2ZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8cmVjdCB4PSI0NTIiIHk9IjQ2IiB3aWR0aD0iMTgyIiBoZWlnaHQ9IjQwIiByeD0iOSIgc3Ryb2tlLXdpZHRoPSIxLjYiIHN0eWxlPSJmaWxsOiMwNjRlM2I7c3Ryb2tlOiM2ZWU3YjciLz4KPHRleHQgeD0iNTQzIiB5PSI3MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICNjYmQ1ZTE7IGZpbGw6IzZlZTdiNztmb250LXdlaWdodDo3MDAiPnYzIMK3IG5ldyBwcmltYXJ5PC90ZXh0Pgo8bGluZSB4MT0iNTQzIiB5MT0iODYiIHgyPSI1NDMiIHkyPSI5OCIgc3Ryb2tlLXdpZHRoPSIxLjQiIG1hcmtlci1lbmQ9InVybCgjZ2ttczZnKSIgc3R5bGU9InN0cm9rZTojNmVlN2I3Ii8+Cjx0ZXh0IHg9IjU0MyIgeT0iMTEyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTBweCAnU0YgTW9ubycsIHVpLW1vbm9zcGFjZSwgJ0pldEJyYWlucyBNb25vJywgTWVubG8sIG1vbm9zcGFjZTsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjlweCI+bmV3IGVuY3J5cHRzIHVzZSB0aGUgcHJpbWFyeSB2ZXJzaW9uPC90ZXh0Pgo8cmVjdCB4PSI2MCIgeT0iMTMwIiB3aWR0aD0iMjEwIiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS40IiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjE2NSIgeT0iMTUxIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOTsgZm9udC1zaXplOjExcHgiPk9sZCBjaXBoZXJ0ZXh0PC90ZXh0Pgo8dGV4dCB4PSIxNjUiIHk9IjE2NyIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+d3JhcHBlZCB1bmRlciB2MTwvdGV4dD4KPGxpbmUgeDE9IjI3MCIgeTE9IjE1MyIgeDI9IjMzMCIgeTI9IjE1MyIgc3Ryb2tlLXdpZHRoPSIyIiBtYXJrZXItZW5kPSJ1cmwoI2drbXM2ZykiIHN0eWxlPSJzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSIzMDIiIHk9IjE0NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDEwcHggJ1NGIE1vbm8nLCB1aS1tb25vc3BhY2UsICdKZXRCcmFpbnMgTW9ubycsIE1lbmxvLCBtb25vc3BhY2U7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo4cHgiPmRlY3J5cHQg4oaSIHYxPC90ZXh0Pgo8cmVjdCB4PSIzMzQiIHk9IjEzMCIgd2lkdGg9IjMwMCIgaGVpZ2h0PSI0NiIgcng9IjEwIiBzdHJva2Utd2lkdGg9IjEuNSIgc3R5bGU9ImZpbGw6IzA2NGUzYjtzdHJva2U6IzZlZTdiNyIvPgo8dGV4dCB4PSI0ODQiIHk9IjE1MSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDcwMCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZToxMXB4Ij5TdGlsbCByZWFkYWJsZTwvdGV4dD4KPHRleHQgeD0iNDg0IiB5PSIxNjciIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMC41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2ZWU3Yjc7IGZvbnQtc2l6ZTo5LjVweCI+VmVyc2lvbiAxIHJlbWFpbnMgZW5hYmxlZCBmb3IgZGVjcnlwdGlvbjwvdGV4dD4KPHRleHQgeD0iMjYiIHk9IjIwMCIgc3R5bGU9ImZvbnQ6IDcwMCAxMHB4IEludGVyLCBzYW5zLXNlcmlmOyBsZXR0ZXItc3BhY2luZzogMS4zcHg7IGZpbGw6ICM2NDc0OGI7IGZpbGw6IzZlZTdiNyI+SE9XIENMT1VEIEtNUyBST1RBVEVTPC90ZXh0Pgo8cmVjdCB4PSIyNCIgeT0iMjEwIiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjE1MiIgeT0iMjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTAuNXB4ICdTRiBNb25vJywgdWktbW9ub3NwYWNlLCAnSmV0QnJhaW5zIE1vbm8nLCBNZW5sbywgbW9ub3NwYWNlO2ZpbGw6I2NiZDVlMSI+cm90YXRpb25fcGVyaW9kPC90ZXh0Pgo8dGV4dCB4PSIxNTIiIHk9IjI0NiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjg7IGZvbnQtc2l6ZTo5LjVweCI+c2V0cyB0aGUgYXV0b21hdGljIGNhZGVuY2U8L3RleHQ+CjxyZWN0IHg9IjI5MCIgeT0iMjEwIiB3aWR0aD0iMjU2IiBoZWlnaHQ9IjQ2IiByeD0iMTAiIHN0cm9rZS13aWR0aD0iMS4zIiBzdHlsZT0iZmlsbDojMWUyOTNiO3N0cm9rZTojNDc1NTY5Ii8+Cjx0ZXh0IHg9IjQxOCIgeT0iMjMwIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDo3MDAgMTFweCBJbnRlcixzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMSI+YSBuZXcgdmVyc2lvbiDihpIgcHJpbWFyeTwvdGV4dD4KPHRleHQgeD0iNDE4IiB5PSIyNDYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4OyBmb250LXNpemU6OS41cHgiPm9sZGVyIHZlcnNpb25zIHN0YXkgRU5BQkxFRDwvdGV4dD4KPHJlY3QgeD0iNTU2IiB5PSIyMTAiIHdpZHRoPSIyNTYiIGhlaWdodD0iNDYiIHJ4PSIxMCIgc3Ryb2tlLXdpZHRoPSIxLjMiIHN0eWxlPSJmaWxsOiMxZTI5M2I7c3Ryb2tlOiM0NzU1NjkiLz4KPHRleHQgeD0iNjg0IiB5PSIyMzAiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OjcwMCAxMXB4IEludGVyLHNhbnMtc2VyaWY7ZmlsbDojY2JkNWUxIj5vbi1kZW1hbmQgcm90YXRpb248L3RleHQ+Cjx0ZXh0IHg9IjY4NCIgeT0iMjQ2IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiODsgZm9udC1zaXplOjkuNXB4Ij5ub3Qgc3VwcG9ydGVkPC90ZXh0Pgo8L3N2Zz4=)

Rotation creates a primary version for new encryption. Earlier enabled versions can still decrypt existing data.

#### Limitations

Where Cloud KMS and AWS KMS differ

* **Asymmetric keys and HMAC are not supported.** `CreateKey` accepts only symmetric `ENCRYPT_DECRYPT` keys. `Sign`, `Verify`, `GetPublicKey`, data-key pairs, `GenerateMac` and `VerifyMac` return `UnsupportedOperationException`, and `DeriveSharedSecret` is not available.
* **On-demand rotation is not supported.** `RotateKeyOnDemand` returns `UnsupportedOperationException`. Automatic rotation works.
* **Key policies and grants are not supported.** Access to the crypto keys uses Google IAM. Grant operations and custom key policies are rejected; an encryption context does not replace a grant that limited callers or contexts.
* **The ciphertext format behaves differently.** The adapter wraps Cloud KMS ciphertext with the key ID that `Decrypt` needs. Treat `CiphertextBlob` as opaque. Existing AWS ciphertext cannot be decrypted with a new Google key.
* **Imported key material and Multi-Region keys are not supported.** A `CreateKey` with an imported-material origin or `MultiRegion` is rejected; import material through a Cloud KMS import job instead. A key ring's location does not give separately addressable replica keys.
* **`ReEncrypt` behaves differently.** It decrypts and encrypts again under the destination key. The plaintext exists briefly inside the adapter but is never returned to the caller.

#### Other considerations

* **Access and protection.** Give the deployment identity the Cloud KMS permissions it needs at the key or key-ring scope; workload identity supplies its credentials. Google operates the key service; choose software or HSM protection for your keys.
* **Keep data recoverable.** Keep old key versions while ciphertext needs them, and back up the adapter's key and alias records with your key inventory. Test disabling, cancelling deletion, rotation and recovery before you change production keys.
* **Moving from AWS.** Decrypt AWS ciphertext or unwrap data keys with the AWS key, then encrypt or wrap them under the new key. Keep AWS available until that is done and verified; creating a key does not convert stored ciphertext.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### AWS KMS · Crypto requests

Feature: AWS KMS.

Estimated monthly service charges by Crypto requests. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/5b4a2aec690c48be4ad0decb2ea7ce2b852f38f02affde50600d48774ddc2344-light.svg)

![AWS KMS · Crypto requests: monthly service charges by Crypto requests. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/7a9b308c94a33f4e4d63b87e4f8bdd026434742769e8019cb349eda1bf8faa6f-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Crypto requests (operations/s) | KMS Keys | Target scenario | Cloud KMS | Difference |
| -: | -: | - | -: | -: |
| 0 | 100.00 | Cloud KMS (one staging copy) | 130.18 | 30.18 |
| 0 | 100.00 | Cloud KMS (two staging copies) | 248.36 | 148.36 |
| 1 | 107.88 | Cloud KMS (one staging copy) | 138.46 | 30.57 |
| 1 | 107.88 | Cloud KMS (two staging copies) | 256.63 | 148.75 |
| 10 | 178.84 | Cloud KMS (one staging copy) | 212.96 | 34.12 |
| 10 | 178.84 | Cloud KMS (two staging copies) | 331.14 | 152.30 |
| 100 | 888.40 | Cloud KMS (one staging copy) | 958.00 | 69.60 |
| 100 | 888.40 | Cloud KMS (two staging copies) | 1,076.18 | 187.78 |
| 1,000 | 7,984.00 | Cloud KMS (one staging copy) | 8,408.38 | 424.38 |
| 1,000 | 7,984.00 | Cloud KMS (two staging copies) | 8,526.56 | 542.56 |
| 10,000 | 78,940.00 | Cloud KMS (one staging copy) | 84,429.85 | 5,489.85 |
| 10,000 | 78,940.00 | Cloud KMS (two staging copies) | 86,065.70 | 7,125.70 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 operations/s to 32 vCPU, 128 GiB memory and 100 GiB SSD at 10,000 operations/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cloud KMS (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (one staging copy) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud KMS (one staging copy) | Target price guess · read | 0 | USD/read |
| Cloud KMS (one staging copy) | Target price guess · write | 0 | USD/write |
| Cloud KMS (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (one staging copy) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (one staging copy) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (one staging copy) | Minimum primary disk | 100 | GiB |
| Cloud KMS (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cloud KMS (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud KMS (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cloud KMS (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (two staging copies) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud KMS (two staging copies) | Target price guess · read | 0 | USD/read |
| Cloud KMS (two staging copies) | Target price guess · write | 0 | USD/write |
| Cloud KMS (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (two staging copies) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (two staging copies) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (two staging copies) | Minimum primary disk | 100 | GiB |
| Cloud KMS (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cloud KMS (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud KMS (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Monthly operation quantity varies with this steady average rate; stored inventory and other meters retain their defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Resource inventory is retained SOFTWARE key versions; symmetric crypto work prices managedOperations and admin operations are free. HSM versions list USD 1/month and EXTERNAL 3/month.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Cloud KMS pricing: [https://cloud.google.com/kms/pricing](https://cloud.google.com/kms/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-41eda65ede57a26b9cc517002df79c1d2a25e63d` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Cloud KMS pricing](https://cloud.google.com/kms/pricing).

##### AWS KMS · Logical keys

Feature: AWS KMS.

Estimated monthly service charges by Logical keys. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/50e896537a025aee6ade15e50cc184c91e042cacc5c00011c17fe02c9b1cac7d-light.svg)

![AWS KMS · Logical keys: monthly service charges by Logical keys. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/5ed8c7b2bc8a0883ff962876273b75c6a7e388aa0a8446950f2e2b4e19b76d1e-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| Logical keys (keys) | KMS Keys | Target scenario | Cloud KMS | Difference |
| -: | -: | - | -: | -: |
| 0 | 3.00 | Cloud KMS (one staging copy) | 121.33 | 118.33 |
| 0 | 3.00 | Cloud KMS (two staging copies) | 239.51 | 236.51 |
| 10 | 13.00 | Cloud KMS (one staging copy) | 122.53 | 109.53 |
| 10 | 13.00 | Cloud KMS (two staging copies) | 240.71 | 227.71 |
| 100 | 103.00 | Cloud KMS (one staging copy) | 133.33 | 30.33 |
| 100 | 103.00 | Cloud KMS (two staging copies) | 251.51 | 148.51 |
| 1,000 | 1,003.00 | Cloud KMS (one staging copy) | 241.33 | -761.67 |
| 1,000 | 1,003.00 | Cloud KMS (two staging copies) | 359.51 | -643.49 |
| 10,000 | 10,003.00 | Cloud KMS (one staging copy) | 1,321.33 | -8,681.67 |
| 10,000 | 10,003.00 | Cloud KMS (two staging copies) | 1,439.51 | -8,563.49 |
| 100,000 | 100,003.00 | Cloud KMS (one staging copy) | 12,121.33 | -87,881.67 |
| 100,000 | 100,003.00 | Cloud KMS (two staging copies) | 12,239.51 | -87,763.49 |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD at every sample.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Cloud KMS (one staging copy) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (one staging copy) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (one staging copy) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (one staging copy) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (one staging copy) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud KMS (one staging copy) | Target price guess · read | 0 | USD/read |
| Cloud KMS (one staging copy) | Target price guess · write | 0 | USD/write |
| Cloud KMS (one staging copy) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (one staging copy) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (one staging copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (one staging copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (one staging copy) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (one staging copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (one staging copy) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (one staging copy) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (one staging copy) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (one staging copy) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (one staging copy) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (one staging copy) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (one staging copy) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (one staging copy) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (one staging copy) | Minimum primary disk | 100 | GiB |
| Cloud KMS (one staging copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Cloud KMS (one staging copy) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (one staging copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud KMS (one staging copy) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (one staging copy) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (one staging copy) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (one staging copy) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (one staging copy) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (one staging copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (one staging copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (one staging copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (one staging copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Cloud KMS (two staging copies) | Origin list price · Logical managed keys | 1 | USD/key-month |
| Cloud KMS (two staging copies) | Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Cloud KMS (two staging copies) | Target key versions per logical key | 2 | versions/key |
| Cloud KMS (two staging copies) | Native crypto retry multiplier | 1.05 | multiplier |
| Cloud KMS (two staging copies) | Durable key metadata and aliases | 16,384 | bytes/key |
| Cloud KMS (two staging copies) | Target price guess · read | 0 | USD/read |
| Cloud KMS (two staging copies) | Target price guess · write | 0 | USD/write |
| Cloud KMS (two staging copies) | Target list price · provider operation | 0.000003 | USD/provider operation |
| Cloud KMS (two staging copies) | Target price guess · GiB-month | 0 | USD/GiB-month |
| Cloud KMS (two staging copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Cloud KMS (two staging copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Cloud KMS (two staging copies) | Target price guess · network GiB | 0 | USD/network GiB |
| Cloud KMS (two staging copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Cloud KMS (two staging copies) | Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Cloud KMS (two staging copies) | Target list price · resource-month | 0.06 | USD/resource-month |
| Cloud KMS (two staging copies) | Target price guess · input token | 0 | USD/input token |
| Cloud KMS (two staging copies) | Target price guess · output token | 0 | USD/output token |
| Cloud KMS (two staging copies) | Target monthly base charge | 0 | USD/month |
| Cloud KMS (two staging copies) | Approximate target service minimum | 0 | USD/month |
| Cloud KMS (two staging copies) | Minimum primary CPU | 2 | vCPU |
| Cloud KMS (two staging copies) | Minimum primary RAM | 8 | GiB |
| Cloud KMS (two staging copies) | Minimum primary disk | 100 | GiB |
| Cloud KMS (two staging copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Cloud KMS (two staging copies) | Allocated share of provisioned cost | 1 | fraction |
| Cloud KMS (two staging copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Cloud KMS (two staging copies) | Planning peak / mean work | 2 | multiplier |
| Cloud KMS (two staging copies) | Planning primary CPU utilization | 0.7 | fraction |
| Cloud KMS (two staging copies) | Resident state reserved in RAM | 0.1 | fraction |
| Cloud KMS (two staging copies) | Planning disk utilization | 0.8 | fraction |
| Cloud KMS (two staging copies) | Maintenance and log disk reserve | 20 | GiB |
| Cloud KMS (two staging copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Cloud KMS (two staging copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Cloud KMS (two staging copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Cloud KMS (two staging copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Inventory varies independently of monthly reads and mutations. Retention remains an explicit planning assumption. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.
* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.
* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.
* Resource inventory is retained SOFTWARE key versions; symmetric crypto work prices managedOperations and admin operations are free. HSM versions list USD 1/month and EXTERNAL 3/month.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, awskms offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json)
* Cloud KMS pricing: [https://cloud.google.com/kms/pricing](https://cloud.google.com/kms/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-41eda65ede57a26b9cc517002df79c1d2a25e63d` / `2026-10-22.planning.2`. Curve: `workload-2`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Cloud KMS pricing](https://cloud.google.com/kms/pricing).

**AWS KMS → Cloud KMS: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: Logical managed keys | 100.00 |
| Origin: Symmetric crypto requests | 3.00 |
| Origin: ReEncrypt requests | 0.00 |
| Origin: Public-key verification requests | 0.00 |
| Target: Target native provider operations | 3.15 |
| Target: Execution or worker CPU | 0.00 |
| Target: Execution or worker RAM | 0.00 |
| Target: Selected billable network | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 12.00 |
| Target: Durable staging CPU | 60.30 |
| Target: Durable staging RAM | 40.88 |
| Target: Durable staging disk | 17.00 |
| **Origin service subtotal** | **103.00** |
| **Target service subtotal** | **133.33** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Free allowances, committed discounts, credits, taxes and negotiated rates.
* Commercial Tensor9 fees and operations labor unless entered separately.
* HSM/private vault allocations, asymmetric algorithm pricing, external key managers, imported-key handling and geographic replication.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · Logical managed keys | 1 | USD/key-month |
| Origin list price · Symmetric crypto requests | 0.000003 | USD/requests |
| Origin list price · ReEncrypt requests | 0.000003 | USD/requests |
| Origin list price · Public-key verification requests | 0.000003 | USD/requests |
| Target key versions per logical key | 2 | versions/key |
| Native crypto retry multiplier | 1.05 | multiplier |
| Durable key metadata and aliases | 16,384 | bytes/key |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.000003 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target price guess · network GiB | 0 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target list price · resource-month | 0.06 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| Logical managed keys | 100 | key-month |
| Symmetric crypto requests | 1,000,000 | requests |
| ReEncrypt requests | 0 | requests |
| Public-key verification requests | 0 | requests |

* Translated reads: 1,000,000 operations.

* Translated writes: 0 operations.

* Translated resident physical data: under 0.01 GiB-month.

* Native provider operations: 1,050,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 0 vCPU-hour.

* Allocated execution RAM: 0 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 200 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 0 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices. Retention, amplification, and capacity coefficients are authored planning guesses; they are editable, not measured capacity.

* ReEncrypt performs one decrypt and one encrypt. GenerateDataKey wraps a locally generated data key once. Public-key verification is local in this planning mix.

* Cloud-managed key versions and AWS logical key inventory use different billing units. Software-key custody and managed HSM custody are not equivalent.

* Resource inventory is retained SOFTWARE key versions; symmetric crypto work prices managedOperations and admin operations are free. HSM versions list USD 1/month and EXTERNAL 3/month.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The operations/vCPU coefficient supplies the compute requirement alongside explicit resource-hour minima.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-41eda65ede57a26b9cc517002df79c1d2a25e63d` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, awskms offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/awskms/current/us-east-1/index.json), [Cloud KMS pricing](https://cloud.google.com/kms/pricing).

## Costs

Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications.

| Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping |
| - | - | - | -: | -: | -: | - |
| Cloud KMS | Crypto requests: 100 operations/s; one staging copy | Cited list prices, 2026-10-22 | 888.40 | 958.00 | +69.60 | Service adapter |
| Key Vault | Crypto requests: 100 operations/s; one staging copy | Cited list prices, 2026-10-22 | 888.40 | 946.00 | +57.60 | Service adapter |

Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows.
Cost curves across workload sizes, with every assumption and exclusion: [KMS Keys costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-kms).

## Service level agreements

> [!WARNING]
>
> These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment.

Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status.

See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md).

### KMS Keys to Key Vault

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| Cryptographic operations adapter-added latency | +5 ms monthly p99 | `aws::1.0.0::kms`: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncrypt` | Input at most 64 KiB, at most 20 encryption-context entries, one key; provider crypto time separately spanned. |
| Key metadata and bounded lists adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::kms`: `DescribeKey`, `GetKeyRotationStatus`, `ListAliases`, `ListKeys`, `ListResourceTags` | at most 100 returned entries; policy at most 32 KiB. |
| Key, alias, policy and grant mutation adapter-added latency | +15 ms monthly p99 | `aws::1.0.0::kms`: `CancelKeyDeletion`, `CreateAlias`, `CreateKey`, `DeleteAlias`, `DisableKey`, `EnableKey`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`, `UpdateAlias`, `UpdateKeyDescription` | One key/alias/grant; at most 50 tags and grants; policy at most 32 KiB. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::kms`: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncrypt`, `DescribeKey`, `GetKeyRotationStatus`, `ListAliases`, `ListKeys`, `ListResourceTags`, `CancelKeyDeletion`, `CreateAlias`, `CreateKey`, `DeleteAlias`, `DisableKey`, `EnableKey`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`, `UpdateAlias`, `UpdateKeyDescription` | The adapter never substitutes a key, drops encryption context, returns plaintext to an unauthorized principal or acknowledges key-policy state before it is durable. Disabled and pending-deletion keys fail closed. Unsupported asymmetric, HMAC, import or multi-region shapes fail explicitly on profiles that do not cover them. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Cryptographic calls include adapter authorization, request decoding, key/version lookup, policy enforcement and response encoding. Native HSM or provider cryptographic execution is separately spanned for azure::1.0.0::keyvault; local envelope handling, grant evaluation, encryption-context checks and retry policy remain covered adapter work.

#### How the latency targets were chosen

**Cryptographic operations: +5 ms monthly p99 (adapter-added).** `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncrypt`. Authorization, key resolution and bounded envelope conversion.

**Key metadata and bounded lists: +8 ms monthly p99 (adapter-added).** `DescribeKey`, `GetKeyRotationStatus`, `ListAliases`, `ListKeys`, `ListResourceTags`. Local metadata lookup and bounded page encoding.

**Key, alias, policy and grant mutation: +15 ms monthly p99 (adapter-added).** `CancelKeyDeletion`, `CreateAlias`, `CreateKey`, `DeleteAlias`, `DisableKey`, `EnableKey`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`, `UpdateAlias`, `UpdateKeyDescription`. Serialized durable metadata transition per key or alias.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Encrypt/decrypt and data-key calls scale across keys and adapter replicas. Mutations serialize per key or alias, and list operations use bounded pages. Qualification fixes plaintext/ciphertext size, encryption-context entries, grant count, key type and concurrency, and reserves capacity for authorization and audit work.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

The adapter never substitutes a key, drops encryption context, returns plaintext to an unauthorized principal or acknowledges key-policy state before it is durable. Disabled and pending-deletion keys fail closed. Unsupported asymmetric, HMAC, import or multi-region shapes fail explicitly on profiles that do not cover them.

#### Example and diagnosis

GenerateDataKey authorizes the caller and returns plaintext plus ciphertext bound to the selected key and context. Decrypt with a changed context must fail. Alias updates use the metadata-write group and become visible atomically; they do not silently retarget an in-flight cryptographic request.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

### KMS Keys to Cloud KMS

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| Cryptographic operations adapter-added latency | +5 ms monthly p99 | `aws::1.0.0::kms`: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncrypt` | Input at most 64 KiB, at most 20 encryption-context entries, one key; provider crypto time separately spanned. |
| Key metadata and bounded lists adapter-added latency | +8 ms monthly p99 | `aws::1.0.0::kms`: `DescribeKey`, `GetKeyRotationStatus`, `ListAliases`, `ListKeys`, `ListResourceTags` | at most 100 returned entries; policy at most 32 KiB. |
| Key, alias, policy and grant mutation adapter-added latency | +15 ms monthly p99 | `aws::1.0.0::kms`: `CancelKeyDeletion`, `CreateAlias`, `CreateKey`, `DeleteAlias`, `DisableKey`, `DisableKeyRotation`, `EnableKey`, `EnableKeyRotation`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`, `UpdateAlias`, `UpdateKeyDescription` | One key/alias/grant; at most 50 tags and grants; policy at most 32 KiB. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::kms`: `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncrypt`, `DescribeKey`, `GetKeyRotationStatus`, `ListAliases`, `ListKeys`, `ListResourceTags`, `CancelKeyDeletion`, `CreateAlias`, `CreateKey`, `DeleteAlias`, `DisableKey`, `DisableKeyRotation`, `EnableKey`, `EnableKeyRotation`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`, `UpdateAlias`, `UpdateKeyDescription` | The adapter never substitutes a key, drops encryption context, returns plaintext to an unauthorized principal or acknowledges key-policy state before it is durable. Disabled and pending-deletion keys fail closed. Unsupported asymmetric, HMAC, import or multi-region shapes fail explicitly on profiles that do not cover them. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Cryptographic calls include adapter authorization, request decoding, key/version lookup, policy enforcement and response encoding. Native HSM or provider cryptographic execution is separately spanned for google::1.0.0::kms; local envelope handling, grant evaluation, encryption-context checks and retry policy remain covered adapter work.

#### How the latency targets were chosen

**Cryptographic operations: +5 ms monthly p99 (adapter-added).** `Decrypt`, `Encrypt`, `GenerateDataKey`, `GenerateDataKeyWithoutPlaintext`, `ReEncrypt`. Authorization, key resolution and bounded envelope conversion.

**Key metadata and bounded lists: +8 ms monthly p99 (adapter-added).** `DescribeKey`, `GetKeyRotationStatus`, `ListAliases`, `ListKeys`, `ListResourceTags`. Local metadata lookup and bounded page encoding.

**Key, alias, policy and grant mutation: +15 ms monthly p99 (adapter-added).** `CancelKeyDeletion`, `CreateAlias`, `CreateKey`, `DeleteAlias`, `DisableKey`, `DisableKeyRotation`, `EnableKey`, `EnableKeyRotation`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`, `UpdateAlias`, `UpdateKeyDescription`. Serialized durable metadata transition per key or alias.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Encrypt/decrypt and data-key calls scale across keys and adapter replicas. Mutations serialize per key or alias, and list operations use bounded pages. Qualification fixes plaintext/ciphertext size, encryption-context entries, grant count, key type and concurrency, and reserves capacity for authorization and audit work.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

The adapter never substitutes a key, drops encryption context, returns plaintext to an unauthorized principal or acknowledges key-policy state before it is durable. Disabled and pending-deletion keys fail closed. Unsupported asymmetric, HMAC, import or multi-region shapes fail explicitly on profiles that do not cover them.

#### Example and diagnosis

GenerateDataKey authorizes the caller and returns plaintext plus ciphertext bound to the selected key and context. Decrypt with a changed context must fail. Alias updates use the metadata-write group and become visible atomically; they do not silently retarget an in-flight cryptographic request.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::kms
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

An existing AWS KMS ciphertext or wrapped data key is not decryptable with a newly created Cloud KMS key. Selecting Cloud KMS does not transfer AWS key material. Plan key and encrypted-data migration before cutover; keep the existing decryption path until it is no longer needed.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.