Supported environments
- Azure
- Google Cloud
- OCI
- Private Kubernetes
- Scaleway
How the targets compare
Each row compares a capability of VPC with its adaptation on each target. A dash means this profile does not state the capability for that target.Cloud Adapter
On Azure
Virtual Network
How it works
Your application can keep using the AWS EC2 APIs to create networks, subnets, security groups, and other supported VPC resources in the customer’s environment. The Tensor9 service adapter accepts those requests and manages the corresponding Azure resources. Terraform’s AWS provider uses the same API path. The adapter checks the request and permissions, assigns an AWS-format resource ID, and saves the requested configuration. A background worker applies that configuration to the target cloud and tracks the result. For example,CreateVpc records the VPC together with its default security group, main route table, and default network ACL. DescribeVpcs reports pending until the cloud configuration has been applied, then available. Creating an API record does not mean the network is ready.
The customer’s cloud carries application traffic. The adapter handles network-management API calls; it does not forward the application’s packets.
Network layout
The VPC becomes an Azure Virtual Network (VNet), with subnets using the requested IPv4 ranges. The adapter keeps AWS subnet IDs so applications can use them in later requests. Azure VNet address spaces hold the network’s CIDR ranges; subnet ranges must fit within them. Azure subnets are regional. Choose availability zones on the workloads that need them rather than relying on an AWS subnet’s zone. Subnetcount and for_each declarations keep their instance keys and address expressions. Review the resulting VNet and workload placement together.
Security groups and subnet filters
Azure network security groups (NSGs) enforce the translated allow and deny rules. Rules preserve protocols, ports, direction, and address ranges while using Azure’s ordered priorities. Same-VPC references to another security group use Application Security Groups, which select the member interfaces. The adapter updates that membership when an instance’s security groups change. Review rules that combine group identity with subnet network ACLs (ordered, stateless traffic filters). Azure limits which selectors one rule can combine. AKS-managed node interfaces also cannot join Application Security Groups: where a subnet mixes managed nodes with other interfaces, a subnet-wide approximation requires explicit acknowledgement because it changes which traffic the rule selects. For network ACLs, the adapter composes ordered subnet filters with the security-group rules. Azure NSGs are stateful, so the translation cannot promise AWS’s stateless return-traffic behavior. Configurations whose rule ordering or selectors cannot be represented are rejected. A reduced stateful mapping requires explicit acknowledgement.Routes and connectivity
Supported route-table operations configure Azure routes and subnet associations. Internet access needs an explicit outbound method or an appropriate public frontend; do not rely on default outbound connectivity. Private-subnet egress uses an Azure NAT Gateway with a public IP, attached to the subnets that need it. Private NAT gateways and multiple-address NAT requests are outside this mapping. Same-account, same-region VPC peering becomes two directional VNet peerings. The AWS API retains the peering lifecycle and route references, while Azure installs routes to the peered address spaces. Cross-account or cross-region requests are outside the adapter’s binding, even though Azure has broader peering capabilities. AWS peering DNS options require a separate private-DNS design. Transit-gateway, instance, interface, and other unsupported route next hops are rejected. Azure Private Endpoint, Private Link, VPN, and custom DNS services require their own configuration; a VPC endpoint declaration does not create them automatically.Addresses and interfaces
The adapter keeps AWS-format VPC, subnet, security-group, and address identifiers for API callers and tracks the corresponding cloud resources separately. An AWS ID is not a native cloud resource name.AllocateAddress obtains a target-cloud public IP and waits for that allocation before returning the address. It does not preserve an existing AWS Elastic IP. A standalone CreateNetworkInterface records the subnet, private address, and security groups; the VM launch that names that interface creates the attached target interface. Standalone attach/detach operations and launches with multiple interfaces are outside this mapping.
Other compatibility differences
Use explicit IPv4 subnet ranges. AWS IPAM allocation, Amazon-provided IPv6 address blocks, and custom DHCP option sets are outside this mapping. Azure’s support for multiple VNet address ranges does not reproduce AWS address-allocation behavior. A VPC-wide encryption requirement must be expressed through supported target controls. Flow telemetry uses Azure’s logging facilities, with Azure fields and destinations. Update collectors and queries that expect AWS flow-log records or an AWS destination. Check log coverage for the subnets and interfaces the application depends on.Deployment and ongoing changes
The application signs its EC2 requests with credentials accepted by the Cloud Adapter deployment’s IAM/STS service. The adapter checks the requested action and resource before changing anything. Target-cloud credentials stay with the adapter; the application does not need a second set of cloud API calls. Keep using the normal status checks after a create or update. The adapter keeps requested configuration and observed cloud state separately, retries changes that can be retried, and reports errors when a requested setting cannot be applied. ADescribe response uses the saved AWS identity and configuration, with current cloud-assigned values where needed. Deletion checks dependencies: for example, a subnet remains in use while its NAT gateway is still being removed.
Before moving traffic, check subnet ranges and placement, test allowed and denied connections, and confirm that private-subnet egress uses the intended NAT gateway. Review peering, private service access, DNS, and log destinations separately. Public IP addresses change, so update DNS records and external allowlists. Existing connections do not survive the move to the new network.
On Google Cloud
Virtual Private Cloud (VPC)
How it works
Your application can keep using the AWS EC2 APIs to create networks, subnets, security groups, and other supported VPC resources in the customer’s environment. The Tensor9 service adapter accepts those requests and manages the corresponding Google Cloud resources. Terraform’s AWS provider uses the same API path. The adapter checks the request and permissions, assigns an AWS-format resource ID, and saves the requested configuration. A background worker applies that configuration to the target cloud and tracks the result. For example,CreateVpc records the VPC together with its default security group, main route table, and default network ACL. DescribeVpcs reports pending until the cloud configuration has been applied, then available. Creating an API record does not mean the network is ready.
The customer’s cloud carries application traffic. The adapter handles network-management API calls; it does not forward the application’s packets.
Network layout
The VPC becomes a custom-mode Google Cloud network. Google places address ranges on subnetworks, so the AWS VPC’s overall CIDR remains part of the API model while each subnet’s IPv4 range becomes a native subnetwork range. Subnet references continue to identify the corresponding target subnet. A Google subnetwork is regional. An AWS subnet’s Availability Zone does not fix the target instance’s zone; review instance placement when the application depends on zone separation. Terraform subnet declarations usingcount or for_each retain their instance keys and address expressions.
Security groups and subnet filters
Security-group rules become Google Cloud firewall rules with the requested direction, protocol, ports, and address ranges. Group membership uses network tags: a same-VPC rule that names another group selects instances with that group’s tag. Membership changes must therefore update the native instance tags as well as the AWS-facing group record. Google source tags match within their own network and against primary internal addresses. A reference to a group in a peered VPC cannot be represented by the same tag rule and is rejected during application of the configuration. Secondary and alias IP behavior needs separate review. Network access control list (ACL) operations maintain ordered subnet rules, but Google’s firewall tracks connections and cannot preserve AWS’s stateless filtering exactly. Applying that reduced behavior requires an explicit acknowledgement; an accepted ACL API request alone does not establish equivalent packet filtering. Prefix-list security rules are omitted with a recorded limitation, leaving less traffic permitted.Routes and connectivity
Route-table APIs retain subnet associations and supported next hops. Internet-gateway routing uses Google’s internet gateway; private-subnet egress uses a Cloud Router and Cloud NAT for the selected subnetworks. A default internet route alone does not make an instance publicly reachable: addresses and firewall rules also matter. Private NAT gateways and multiple-address NAT requests are outside this mapping. Same-account, same-region VPC peering creates both directions of Google VPC Network Peering after acceptance. Routes naming that peering remain visible through the AWS API, while Google installs the peered subnet routes. If the peering is deleted, the AWS route can remain as a blackhole. Cross-account or cross-region peering and AWS peering DNS options are outside the adapter’s current binding. Transit-gateway, instance, interface, and other unsupported route next hops are rejected. Private Google Access provides access to Google APIs from eligible private workloads. Customer-published private services need a separate Private Service Connect configuration; an AWS PrivateLink endpoint is not created by this VPC mapping.Addresses and interfaces
The adapter keeps AWS-format VPC, subnet, security-group, and address identifiers for API callers and tracks the corresponding cloud resources separately. An AWS ID is not a native cloud resource name.AllocateAddress obtains a target-cloud public IP and waits for that allocation before returning the address. It does not preserve an existing AWS Elastic IP. A standalone CreateNetworkInterface records the subnet, private address, and security groups; the VM launch that names that interface creates the attached target interface. Standalone attach/detach operations and launches with multiple interfaces are outside this mapping.
Other compatibility differences
Use explicit IPv4 subnet ranges. AWS IPAM allocation, Amazon-provided IPv6 address blocks, custom DHCP option sets, and VPC-wide encryption enforcement are not reproduced. The public IPv6 aggregate AWS assigns to a VPC is different from Google’s independently allocated public subnet ranges. Flow-log requests enable native subnet logging in Google Cloud. Records use Google’s schema and logging destination; the 60-second and 600-second aggregation windows are preserved. An S3 or CloudWatch destination requires acknowledgement that it will not receive those records. Single-interface capture, AWS log-filter expressions, and ACCEPT-only or REJECT-only capture are not represented.Deployment and ongoing changes
The application signs its EC2 requests with credentials accepted by the Cloud Adapter deployment’s IAM/STS service. The adapter checks the requested action and resource before changing anything. Target-cloud credentials stay with the adapter; the application does not need a second set of cloud API calls. Keep using the normal status checks after a create or update. The adapter keeps requested configuration and observed cloud state separately, retries changes that can be retried, and reports errors when a requested setting cannot be applied. ADescribe response uses the saved AWS identity and configuration, with current cloud-assigned values where needed. Deletion checks dependencies: for example, a subnet remains in use while its NAT gateway is still being removed.
Before moving traffic, check subnet ranges and placement, test allowed and denied connections, and confirm that private-subnet egress uses the intended NAT gateway. Review peering, private service access, DNS, and log destinations separately. Public IP addresses change, so update DNS records and external allowlists. Existing connections do not survive the move to the new network.
On OCI
Virtual Cloud Network
How it works
Your application can keep using the AWS EC2 APIs to create networks, subnets, security groups, and other supported VPC resources in the customer’s environment. The Tensor9 service adapter accepts those requests and manages the corresponding OCI resources. Terraform’s AWS provider uses the same API path. The adapter checks the request and permissions, assigns an AWS-format resource ID, and saves the requested configuration. A background worker applies that configuration to the target cloud and tracks the result. For example,CreateVpc records the VPC together with its default security group, main route table, and default network ACL. DescribeVpcs reports pending until the cloud configuration has been applied, then available. Creating an API record does not mean the network is ready.
The customer’s cloud carries application traffic. The adapter handles network-management API calls; it does not forward the application’s packets.
Network layout
The VPC maps to an OCI Virtual Cloud Network (VCN), with the VPC’s IPv4 range in the VCN and each subnet range in an OCI subnet. AWS-facing identifiers remain available to later API requests; the adapter tracks the corresponding OCI identities separately. The mapped OCI subnets are regional. Availability-domain and fault-domain placement belongs to the workloads using those subnets, so review it when the application relies on AWS Availability Zone separation. Subnetcount and for_each declarations keep their keys and address expressions.
Security groups and subnet filters
Security groups map to OCI network security groups (NSGs) attached to the relevant virtual network interfaces. Rules specify direction, protocol, ports, and CIDR selectors. A rule naming a peer group uses OCI’s native NSG reference; a reference to a group outside the mapped environment needs separate configuration. OCI combines permissions from subnet security lists and interface NSGs. The adapter must account for both when applying the requested ingress policy. Adding a restrictive NSG does not cancel an existing security-list allow rule; review rules already present in the customer’s VCN as well as the groups the application creates. Internet reachability also requires the relevant route, gateway, and public address. AWS subnet network ACLs are outside this mapping. Do not treat stateful NSG rules as equivalent stateless filters. Check both permitted and denied connections after deploying the VCN.Routes and connectivity
The VCN uses OCI route tables and an internet gateway for public routing. Subnets that require outbound-only access use an OCI NAT Gateway and a private route table whose default route points to it. A custom next hop requires an appropriate OCI route; the AWS route-table declaration does not cover every OCI routing option. Private service access and connections to other VCNs need OCI-specific configuration. Service Gateway, Private Endpoint, Local Peering, and Remote Peering have different attachment and routing rules from AWS PrivateLink and VPC peering. They are outside this profile’s claimed automatic mapping.Addresses and interfaces
The adapter keeps AWS-format VPC, subnet, security-group, and address identifiers for API callers and tracks the corresponding cloud resources separately. An AWS ID is not a native cloud resource name.AllocateAddress obtains a target-cloud public IP and waits for that allocation before returning the address. It does not preserve an existing AWS Elastic IP. A standalone CreateNetworkInterface records the subnet, private address, and security groups; the VM launch that names that interface creates the attached target interface. Standalone attach/detach operations and launches with multiple interfaces are outside this mapping.
Other compatibility differences
The primary IPv4 VCN and subnet ranges are preserved. AWS IPAM allocation, IPv6 associations, secondary CIDR blocks, custom DHCP option sets, and subnet network ACLs are outside this profile. OCI offers related native features, but their presence alone does not preserve the AWS configuration. Flow telemetry uses OCI Logging and OCI’s record format. Update destinations and queries that depend on AWS flow logs. Public addresses are new OCI reserved addresses, so plan DNS and allowlist changes.Deployment and ongoing changes
The application signs its EC2 requests with credentials accepted by the Cloud Adapter deployment’s IAM/STS service. The adapter checks the requested action and resource before changing anything. Target-cloud credentials stay with the adapter; the application does not need a second set of cloud API calls. Keep using the normal status checks after a create or update. The adapter keeps requested configuration and observed cloud state separately, retries changes that can be retried, and reports errors when a requested setting cannot be applied. ADescribe response uses the saved AWS identity and configuration, with current cloud-assigned values where needed. Deletion checks dependencies: for example, a subnet remains in use while its NAT gateway is still being removed.
Before moving traffic, check subnet ranges and placement, test allowed and denied connections, and confirm that private-subnet egress uses the intended NAT gateway. Review peering, private service access, DNS, and log destinations separately. Public IP addresses change, so update DNS records and external allowlists. Existing connections do not survive the move to the new network.
On Private Kubernetes
Existing Kubernetes network
How it works
The customer’s Kubernetes cluster already supplies the network used by the application. Tensor9 translates the workload resources to use that cluster. It keeps the source VPC-family references needed by the generated infrastructure, but creates no separate VPC, subnet, NAT gateway, or AWS security-group boundary through this target.What source network outputs mean
A source network identifier can feed another resource or module output even though the target cluster has no corresponding AWS network object. Compilation preserves a resolvable value for that reference and records which source resource it came from. The value is not a routable address or proof that a new network was provisioned. Use the deployed workload and Service endpoints to determine actual connectivity.Traffic policy and external access
The customer platform team must configure the cluster’s network plugin, network policies, ingress or load balancer integration, DNS, and outbound routes. This VPC target does not convert source security groups or stateless subnet ACLs into enforced Kubernetes rules. Verify both allowed and denied connections, including traffic between application components and other workloads sharing the cluster.Runtime API and cutover
Applications that create or change AWS VPC resources at runtime cannot use this existing-network target for those operations. The AWS-compatible VPC management described for Google Cloud, Azure, and OCI is a different mapping. Before cutover, prepare cluster connectivity, deploy the translated workloads, and update DNS and external allowlists for their target endpoints.On Scaleway
Scaleway VPC
Service level agreements
Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider’s own SLA. Each origin-to-target pair has its own terms or an explicit pending status. See the SLA tables, measurement rules, and scaling conditions.VPC to Virtual Network
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on azure::1.0.0::vnet. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered.How the latency targets were chosen
Bounded VPC management reads: 10 ms monthly p99.DescribeAvailabilityZones, DescribeFlowLogs, DescribeInternetGateways, DescribeNatGateways, DescribeNetworkAcls, DescribeRouteTables, DescribeSecurityGroupRules, DescribeSecurityGroups, DescribeSubnets, DescribeVpcAttribute, DescribeVpcPeeringConnections, DescribeVpcs, GetFlowLogsIntegrationTemplate, GetSecurityGroupsForVpc, GetVpcResourcesBlockingEncryptionEnforcement. Bounded adapter state lookup and AWS response mapping; packet forwarding is excluded.
VPC topology and policy mutation: 25 ms monthly p99. AcceptVpcPeeringConnection, AssociateRouteTable, AssociateSecurityGroupVpc, AssociateSubnetCidrBlock, AssociateVpcCidrBlock, AttachInternetGateway, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateDefaultSubnet, CreateDefaultVpc, CreateFlowLogs, CreateInternetGateway, CreateNatGateway, CreateNetworkAcl, CreateNetworkAclEntry, CreateRoute, CreateRouteTable, CreateSecurityGroup, CreateSubnet, CreateVpc, CreateVpcPeeringConnection, DeleteFlowLogs, DeleteInternetGateway, DeleteNatGateway, DeleteNetworkAcl, DeleteNetworkAclEntry, DeleteRoute, DeleteRouteTable, DeleteSecurityGroup, DeleteSubnet, DeleteVpc, DeleteVpcPeeringConnection, DetachInternetGateway, DisableVgwRoutePropagation, DisassociateRouteTable, DisassociateSecurityGroupVpc, DisassociateSubnetCidrBlock, DisassociateVpcCidrBlock, EnableVgwRoutePropagation, ModifyAvailabilityZoneGroup, ModifySecurityGroupRules, ModifySubnetAttribute, ModifyVpcAttribute, ModifyVpcPeeringConnectionOptions, ModifyVpcTenancy, RejectVpcPeeringConnection, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry, ReplaceRoute, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress. Whole-request validation, durable desired-state admission and reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state.Example and diagnosis
Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
VPC to Virtual Private Cloud (VPC)
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on google::1.0.0::compute::network. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered.How the latency targets were chosen
Bounded VPC management reads: 10 ms monthly p99.DescribeAddresses, DescribeAddressesAttribute, DescribeAvailabilityZones, DescribeFlowLogs, DescribeInternetGateways, DescribeMovingAddresses, DescribeNatGateways, DescribeNetworkAcls, DescribeNetworkInterfaceAttribute, DescribeNetworkInterfaces, DescribeRouteTables, DescribeSecurityGroupRules, DescribeSecurityGroups, DescribeSubnets, DescribeTags, DescribeVpcAttribute, DescribeVpcPeeringConnections, DescribeVpcs, GetFlowLogsIntegrationTemplate, GetIpamAddressHistory, GetSecurityGroupsForVpc, GetVpcResourcesBlockingEncryptionEnforcement. Bounded adapter state lookup and AWS response mapping; packet forwarding is excluded.
VPC topology and policy mutation: 25 ms monthly p99. AcceptVpcPeeringConnection, AllocateAddress, ApplySecurityGroupsToClientVpnTargetNetwork, AssignIpv6Addresses, AssignPrivateIpAddresses, AssociateAddress, AssociateRouteTable, AssociateSecurityGroupVpc, AssociateSubnetCidrBlock, AssociateVpcCidrBlock, AttachClassicLinkVpc, AttachInternetGateway, AttachNetworkInterface, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateDefaultSubnet, CreateDefaultVpc, CreateFlowLogs, CreateInternetGateway, CreateNatGateway, CreateNetworkAcl, CreateNetworkAclEntry, CreateNetworkInterface, CreateRoute, CreateRouteTable, CreateSecurityGroup, CreateSubnet, CreateTags, CreateVpc, CreateVpcPeeringConnection, CreateVpnConnectionRoute, DeleteFlowLogs, DeleteInternetGateway, DeleteNatGateway, DeleteNetworkAcl, DeleteNetworkAclEntry, DeleteNetworkInterface, DeleteRoute, DeleteRouteTable, DeleteSecurityGroup, DeleteSubnet, DeleteTags, DeleteVpc, DeleteVpcPeeringConnection, DeleteVpnConnectionRoute, DetachClassicLinkVpc, DetachInternetGateway, DetachNetworkInterface, DisableVgwRoutePropagation, DisassociateAddress, DisassociateRouteTable, DisassociateSecurityGroupVpc, DisassociateSubnetCidrBlock, DisassociateVpcCidrBlock, EnableVgwRoutePropagation, ModifyAvailabilityZoneGroup, ModifyNetworkInterfaceAttribute, ModifySecurityGroupRules, ModifySubnetAttribute, ModifyVpcAttribute, ModifyVpcPeeringConnectionOptions, ModifyVpcTenancy, MoveAddressToVpc, RejectVpcPeeringConnection, ReleaseAddress, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry, ReplaceRoute, ResetNetworkInterfaceAttribute, RestoreAddressToClassic, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress, UnassignIpv6Addresses, UnassignPrivateIpAddresses. Whole-request validation, durable desired-state admission and reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state.Example and diagnosis
Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
VPC to Virtual Cloud Network
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
Network control calls validate AWS-shaped topology, record desired state and reconcile native networking on oci::1.0.0::vcn. Application packets, load-balancer forwarding and health-probe network time are not adapter request latency. Local graph validation, rule translation, admission, status lookup and response encoding remain covered.How the latency targets were chosen
Bounded VPC management reads: 10 ms monthly p99.DescribeAvailabilityZones, DescribeFlowLogs, DescribeInternetGateways, DescribeNatGateways, DescribeNetworkAcls, DescribeRouteTables, DescribeSecurityGroupRules, DescribeSecurityGroups, DescribeSubnets, DescribeVpcAttribute, DescribeVpcPeeringConnections, DescribeVpcs, GetFlowLogsIntegrationTemplate, GetSecurityGroupsForVpc. Bounded adapter state lookup and AWS response mapping; packet forwarding is excluded.
VPC topology and policy mutation: 25 ms monthly p99. AcceptVpcPeeringConnection, AssociateRouteTable, AssociateSecurityGroupVpc, AssociateSubnetCidrBlock, AssociateVpcCidrBlock, AttachInternetGateway, AuthorizeSecurityGroupEgress, AuthorizeSecurityGroupIngress, CreateDefaultSubnet, CreateDefaultVpc, CreateFlowLogs, CreateInternetGateway, CreateNatGateway, CreateNetworkAcl, CreateNetworkAclEntry, CreateRoute, CreateRouteTable, CreateSecurityGroup, CreateSubnet, CreateVpc, CreateVpcPeeringConnection, DeleteFlowLogs, DeleteInternetGateway, DeleteNatGateway, DeleteNetworkAcl, DeleteNetworkAclEntry, DeleteRoute, DeleteRouteTable, DeleteSecurityGroup, DeleteSubnet, DeleteVpc, DeleteVpcPeeringConnection, DetachInternetGateway, DisableVgwRoutePropagation, DisassociateRouteTable, DisassociateSecurityGroupVpc, DisassociateSubnetCidrBlock, DisassociateVpcCidrBlock, EnableVgwRoutePropagation, ModifyAvailabilityZoneGroup, ModifySecurityGroupRules, ModifySubnetAttribute, ModifyVpcAttribute, ModifyVpcPeeringConnectionOptions, ModifyVpcTenancy, RejectVpcPeeringConnection, ReplaceNetworkAclAssociation, ReplaceNetworkAclEntry, ReplaceRoute, RevokeSecurityGroupEgress, RevokeSecurityGroupIngress. Whole-request validation, durable desired-state admission and reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Independent load balancers, networks and flow-log records reconcile concurrently; changes to one object serialize by generation. Qualification fixes listeners, rules, target groups, routes, security rules, tags and returned page size. Large rule trees receive their own bounded group rather than inheriting a point-write estimate. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
The adapter preserves exposure, protocol, address family, listener/rule priority, target membership and fail-closed security intent. A successful change is durable before acknowledgement, stale generations cannot re-open removed access, and readiness reflects observed native state.Example and diagnosis
Adding one HTTPS listener with ten routing rules is a bounded policy mutation. The adapter target covers validation, durable recording and native-plan construction; provider provisioning and certificate readiness are separate. The response cannot claim ACTIVE until the native listener is observed. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
VPC to Scaleway VPC
SLA status: Not applicable This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider’s networking terms apply.VPC to Tensor9 Trivial
SLA status: Not applicable This mapping configures native networking. Application packets pass through the target network or load balancer, not the adapter fabric, and this directed mapping does not expose an origin-cloud network-management endpoint. The target provider’s networking terms apply.Install and run
The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. SetT9_API_KEY as described in Install and Authenticate, then list the adapters your account may use with this origin: