Supported environments
API means the profile adapts origin API behavior. Infrastructure means the profile changes provisioned resources or documents a target-native alternative without promising an origin API endpoint. Check the operation and capability tables for the behavior your application depends on.
How the targets compare
Each row compares a capability of Systems Manager (SSM) with its adaptation on each target. A dash means this profile does not state the capability for that target.Cloud Adapter
On Akamai, Private Kubernetes, and Scaleway
Kubernetes Secrets
Requests and durable parameter state
With Cloud Adapter, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Kubernetes Secrets.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains the latest value and its increasing version counter. Previous values and named SSM labels are unsupported. A counter records writes; it does not make old values readable. Choose a mapping with retained history when the application needs it.Target storage and encryption
A Kubernetes Secret holds the reconciled current value in the customer cluster. The deployment’s service account accesses the backing objects. AWS reads use durable parameter records, not a Kubernetes Secret lookup for each request; the parameter counter belongs to that record. All three parameter type markers are preserved. Kubernetes Secret values are base64-encoded; base64 is not encryption. Configure Kubernetes access control and storage encryption, and protect the adapter’s durable state and backups. This storage option stays inside the customer cluster, including disconnected deployments.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.On Azure
Azure App Configuration
Requests and durable parameter state
With Cloud Adapter, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Azure App Configuration.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains numeric parameter versions; named SSM version labels are unsupported. App Configuration labels can represent retained target versions, but they are different from SSM labels. The adapter owns the AWS version counter and selection; the highest provider label does not decide a Max read.Target storage and encryption
Azure App Configuration holds the reconciled configuration value in the customer’s store, accessed with the deployment’s managed identity. Its key prefixes and label dimension organize the provider copy. GetParametersByPath queries adapter records rather than using a provider prefix query as the application read path. String and StringList are supported. SecureString is unsupported for this App Configuration mapping. Accessing Azure Key Vault directly requires application changes and is a separate option. Protect adapter state and the encrypted provider store; storage encryption alone does not add SecureString support.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.On Google Cloud
Google Parameter Manager
Requests and durable parameter state
With Cloud Adapter, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Google Parameter Manager.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains parameter history and named SSM labels. The adapter maintains retained values and label-to-version references for GetParameterHistory, LabelParameterVersion, and version-qualified reads. Parameter Manager has no native version aliases; selecting its highest native version is not the Max request path.Target storage and encryption
Google Parameter Manager holds the reconciled parameter value in the customer’s project. The deployment uses Google workload identity. Parameter resources and their native versions are the target representation; the adapter owns the AWS parameter name, current version, and read behavior. All three parameter types are supported. Parameter Manager encrypts its copy at rest. Protect durable adapter state and backups too. Parameter resources can contain sensitive values; choose access controls from their contents, not the service’s name.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.Secret Manager
Requests and durable parameter state
With Cloud Adapter, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Google Secret Manager.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains parameter history and named SSM labels. The adapter maintains the retained values and label-to-version references needed by GetParameterHistory, LabelParameterVersion, and version-qualified reads. Moving a provider alias directly does not move an SSM label.Target storage and encryption
Google Secret Manager holds the reconciled current value in the customer’s project. The deployment uses Google workload identity. Its native versions and aliases describe the provider copy; AWS reads and version selection belong to the adapter. All three parameter types are supported. Secret Manager encrypts its copy at rest. Protect the adapter’s durable parameter state and backups as well as the provider copy; storing an ordinary String as a secret does not change the sensitivity of its contents.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.On OCI
OCI Vault
Requests and durable parameter state
With Cloud Adapter, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to OCI Vault.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.