Supported environments
- Akamai
- Azure
- Google Cloud
- OCI
- Private Kubernetes
- Scaleway
How the targets compare
Each row compares a capability of Secrets Manager with its adaptation on each target. A dash means this profile does not state the capability for that target.Cloud Adapter
On Akamai, Private Kubernetes, and Scaleway
Kubernetes Secret
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
The adapter stores values and version history in its durable state.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
The customer deployment stores the secret entirely in the adapter’s durable state. This configuration creates no additional Kubernetes Secret. Version history and reads use the same secret record as cloud-backed deployments. All versions and labels remain in the adapter’s durable state. Protect that state store and its backups; no separate cloud secret copy is configured. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Storage durability, encryption, backups, and recovery depend on the Cloud Adapter deployment’s state store. A Kubernetes namespace or an external synchronization controller does not provide that history.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Azure
Key Vault
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Azure Key Vault stores the current value under the deployment’s Azure identity. A version tag tracks the adapter revision because Key Vault’s native version IDs are opaque. The adapter retains AWS version history and stage labels independently. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Azure Key Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Key Vault limits a stored value to 25 KiB; encoded binary content must fit that limit. This target’s deletion and name-reuse workflow requires purge permission. A purge-protected vault can block final removal or reuse of a deleted name. AWS scheduled deletion is handled by the adapter before this target cleanup begins.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Google Cloud
Secret Manager
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Google Secret Manager stores the current value under the deployment’s Google identity. Its numbered versions are target revisions, not the source of AWS stage selection. Google replication and encryption settings govern that provider copy. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Google Secret Manager. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Google’s native replication policy is chosen when its secret is created. AWS stage moves and delayed deletion are handled in the adapter’s record, so they do not require corresponding Google aliases or a native secret recovery window.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On OCI
OCI Vault
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
OCI Vault is the target store for the current secret value in this mapping. OCI requires an encryption key for the vault secret and provides its own version stages and replication settings. The adapter owns AWS history and stage selection, independently of those native features. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to OCI Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Configure the OCI key and any geographic replication for the provider copy. OCI’s native scheduled-deletion rules can delay physical removal after the AWS API has withdrawn a secret. These target rules do not replace the adapter’s deletion window or create an independent AWS regional replica.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Scaleway
Scaleway Secret Manager
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Scaleway Secret Manager is the target store for the current secret value in this mapping: one Scaleway secret per logical secret, and the adapter’s declared version is carried as that secret’s REVISION. A read resolves the newest ENABLED revision; a write appends one enabled revision when the target is behind. The adapter owns AWS history and stage selection independently of Scaleway’s own revision numbering, and never reads a stored payload back out of Scaleway — values are served from the adapter’s own record. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Scaleway Secret Manager. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
YOUR SECRET NAMES ARE TRANSFORMED, and this is the one thing to know before you go looking in the Scaleway console. Scaleway’s name grammar admits only letters, digits, dot, dash and underscore, so the commonest AWS shape — prod/db/password — is rejected outright at create. The adapter therefore encodes each name: lower-case letters and digits are kept and every other byte becomes _ plus two hex digits, so a/b and a_b stay distinct, and an encoding over 255 characters folds to a 200-character prefix plus a short hash. The secret you named prod/db/password exists, holds the right value, and is listed under its encoded name. Two smaller differences: Scaleway tags are a flat list of strings rather than key/value pairs, so AWS tag pairs are encoded into that shape; and a secret whose every revision is disabled resolves to nothing, which the adapter reads as absent and repairs by appending a fresh enabled revision rather than by reusing a disabled one.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.Service level agreements
Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider’s own SLA. Each origin-to-target pair has its own terms or an explicit pending status. See the SLA tables, measurement rules, and scaling conditions.Secrets Manager to Key Vault
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
The adapter authenticates and authorizes the request, reads or mutates versioned secret state, and translates the result to the Secrets Manager API. Calls that coordinate rotation, replication or a target secret store have a distinct budget; external Lambda and provider execution are excluded only at explicit measurement spans.How the latency targets were chosen
Secret point reads: 4 ms monthly p99.DescribeSecret, GetRandomPassword, GetResourcePolicy, GetSecretValue, ValidateResourcePolicy. Authorization, version lookup and bounded response conversion.
Bounded secret lists: 12 ms monthly p99. BatchGetSecretValue, ListSecretVersionIds, ListSecrets. Bounded lookup fan-out and page assembly.
Secret and policy mutation: 12 ms monthly p99. CreateSecret, DeleteResourcePolicy, DeleteSecret, PutResourcePolicy, PutSecretValue, RestoreSecret, TagResource, UntagResource, UpdateSecret, UpdateSecretVersionStage. Validation plus one serialized durable secret-state commit.
Rotation and replication coordination: 25 ms monthly p99. CancelRotateSecret, RemoveRegionsFromReplication, ReplicateSecretToRegions, RotateSecret. Durable workflow transition and bounded reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Reads shard by secret identity and version. Mutations on one secret serialize to protect staging-label and deletion invariants, while unrelated secrets remain parallel. List and batch qualification fixes page size, secret count, payload bytes and concurrency; rotation trials include bounded callback and retry accounting without treating callback time as local compute. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
A returned success means secret material and version metadata are durable. AWSCURRENT/AWSPREVIOUS transitions remain atomic, recovery windows are honored, resource policies never widen on translation, and replica or rotation failures cannot expose an uncommitted version.Example and diagnosis
PutSecretValue creates a new version and moves AWSCURRENT in one logical mutation. A simultaneous GetSecretValue either sees the old complete version or the new complete version. RotateSecret uses the coordination group and reports callback/provider time separately from adapter admission, state transitions and response work. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Secrets Manager to Kubernetes Secrets
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
The adapter authenticates and authorizes the request, reads or mutates versioned secret state, and translates the result to the Secrets Manager API. Calls that coordinate rotation, replication or a target secret store have a distinct budget; external Lambda and provider execution are excluded only at explicit measurement spans.How the latency targets were chosen
Secret point reads: 4 ms monthly p99.DescribeSecret, GetRandomPassword, GetSecretValue. Authorization, version lookup and bounded response conversion.
Bounded secret lists: 12 ms monthly p99. BatchGetSecretValue, ListSecretVersionIds, ListSecrets. Bounded lookup fan-out and page assembly.
Secret and policy mutation: 12 ms monthly p99. CreateSecret, DeleteSecret, PutSecretValue, TagResource, UntagResource, UpdateSecret. Validation plus one serialized durable secret-state commit.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Reads shard by secret identity and version. Mutations on one secret serialize to protect staging-label and deletion invariants, while unrelated secrets remain parallel. List and batch qualification fixes page size, secret count, payload bytes and concurrency; rotation trials include bounded callback and retry accounting without treating callback time as local compute. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
A returned success means secret material and version metadata are durable. AWSCURRENT/AWSPREVIOUS transitions remain atomic, recovery windows are honored, resource policies never widen on translation, and replica or rotation failures cannot expose an uncommitted version.Example and diagnosis
PutSecretValue creates a new version and moves AWSCURRENT in one logical mutation. A simultaneous GetSecretValue either sees the old complete version or the new complete version. RotateSecret uses the coordination group and reports callback/provider time separately from adapter admission, state transitions and response work. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Secrets Manager to Secret Manager
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
The adapter authenticates and authorizes the request, reads or mutates versioned secret state, and translates the result to the Secrets Manager API. Calls that coordinate rotation, replication or a target secret store have a distinct budget; external Lambda and provider execution are excluded only at explicit measurement spans.How the latency targets were chosen
Secret point reads: 4 ms monthly p99.DescribeSecret, GetRandomPassword, GetResourcePolicy, GetSecretValue, ValidateResourcePolicy. Authorization, version lookup and bounded response conversion.
Bounded secret lists: 12 ms monthly p99. BatchGetSecretValue, ListSecretVersionIds, ListSecrets. Bounded lookup fan-out and page assembly.
Secret and policy mutation: 12 ms monthly p99. CreateSecret, DeleteResourcePolicy, DeleteSecret, PutResourcePolicy, PutSecretValue, RestoreSecret, TagResource, UntagResource, UpdateSecret, UpdateSecretVersionStage. Validation plus one serialized durable secret-state commit.
Rotation and replication coordination: 25 ms monthly p99. CancelRotateSecret, RemoveRegionsFromReplication, ReplicateSecretToRegions, RotateSecret. Durable workflow transition and bounded reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Reads shard by secret identity and version. Mutations on one secret serialize to protect staging-label and deletion invariants, while unrelated secrets remain parallel. List and batch qualification fixes page size, secret count, payload bytes and concurrency; rotation trials include bounded callback and retry accounting without treating callback time as local compute. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
A returned success means secret material and version metadata are durable. AWSCURRENT/AWSPREVIOUS transitions remain atomic, recovery windows are honored, resource policies never widen on translation, and replica or rotation failures cannot expose an uncommitted version.Example and diagnosis
PutSecretValue creates a new version and moves AWSCURRENT in one logical mutation. A simultaneous GetSecretValue either sees the old complete version or the new complete version. RotateSecret uses the coordination group and reports callback/provider time separately from adapter admission, state transitions and response work. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Secrets Manager to OCI Vault
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
The adapter authenticates and authorizes the request, reads or mutates versioned secret state, and translates the result to the Secrets Manager API. Calls that coordinate rotation, replication or a target secret store have a distinct budget; external Lambda and provider execution are excluded only at explicit measurement spans.How the latency targets were chosen
Secret point reads: 4 ms monthly p99.DescribeSecret, GetRandomPassword, GetResourcePolicy, GetSecretValue, ValidateResourcePolicy. Authorization, version lookup and bounded response conversion.
Bounded secret lists: 12 ms monthly p99. BatchGetSecretValue, ListSecretVersionIds, ListSecrets. Bounded lookup fan-out and page assembly.
Secret and policy mutation: 12 ms monthly p99. CreateSecret, DeleteResourcePolicy, DeleteSecret, PutResourcePolicy, PutSecretValue, RestoreSecret, TagResource, UntagResource, UpdateSecret, UpdateSecretVersionStage. Validation plus one serialized durable secret-state commit.
Rotation and replication coordination: 25 ms monthly p99. CancelRotateSecret, RemoveRegionsFromReplication, ReplicateSecretToRegions, RotateSecret. Durable workflow transition and bounded reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Reads shard by secret identity and version. Mutations on one secret serialize to protect staging-label and deletion invariants, while unrelated secrets remain parallel. List and batch qualification fixes page size, secret count, payload bytes and concurrency; rotation trials include bounded callback and retry accounting without treating callback time as local compute. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
A returned success means secret material and version metadata are durable. AWSCURRENT/AWSPREVIOUS transitions remain atomic, recovery windows are honored, resource policies never widen on translation, and replica or rotation failures cannot expose an uncommitted version.Example and diagnosis
PutSecretValue creates a new version and moves AWSCURRENT in one logical mutation. A simultaneous GetSecretValue either sees the old complete version or the new complete version. RotateSecret uses the coordination group and reports callback/provider time separately from adapter admission, state transitions and response work. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Secrets Manager to Scaleway Secret Manager
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
The adapter authenticates and authorizes the request, reads or mutates versioned secret state, and translates the result to the Secrets Manager API. Calls that coordinate rotation, replication or a target secret store have a distinct budget; external Lambda and provider execution are excluded only at explicit measurement spans.How the latency targets were chosen
Secret point reads: 4 ms monthly p99.DescribeSecret, GetRandomPassword, GetResourcePolicy, GetSecretValue, ValidateResourcePolicy. Authorization, version lookup and bounded response conversion.
Bounded secret lists: 12 ms monthly p99. BatchGetSecretValue, ListSecretVersionIds, ListSecrets. Bounded lookup fan-out and page assembly.
Secret and policy mutation: 12 ms monthly p99. CreateSecret, DeleteResourcePolicy, DeleteSecret, PutResourcePolicy, PutSecretValue, RestoreSecret, TagResource, UntagResource, UpdateSecret, UpdateSecretVersionStage. Validation plus one serialized durable secret-state commit.
Rotation and replication coordination: 25 ms monthly p99. CancelRotateSecret, RemoveRegionsFromReplication, ReplicateSecretToRegions, RotateSecret. Durable workflow transition and bounded reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Reads shard by secret identity and version. Mutations on one secret serialize to protect staging-label and deletion invariants, while unrelated secrets remain parallel. List and batch qualification fixes page size, secret count, payload bytes and concurrency; rotation trials include bounded callback and retry accounting without treating callback time as local compute. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
A returned success means secret material and version metadata are durable. AWSCURRENT/AWSPREVIOUS transitions remain atomic, recovery windows are honored, resource policies never widen on translation, and replica or rotation failures cannot expose an uncommitted version.Example and diagnosis
PutSecretValue creates a new version and moves AWSCURRENT in one logical mutation. A simultaneous GetSecretValue either sees the old complete version or the new complete version. RotateSecret uses the coordination group and reports callback/provider time separately from adapter admission, state transitions and response work. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Secrets Manager to Kubernetes Secret
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
The adapter authenticates and authorizes the request, reads or mutates versioned secret state, and translates the result to the Secrets Manager API. Calls that coordinate rotation, replication or a target secret store have a distinct budget; external Lambda and provider execution are excluded only at explicit measurement spans.How the latency targets were chosen
Secret point reads: 4 ms monthly p99.DescribeSecret, GetRandomPassword, GetResourcePolicy, GetSecretValue, ValidateResourcePolicy. Authorization, version lookup and bounded response conversion.
Bounded secret lists: 12 ms monthly p99. BatchGetSecretValue, ListSecretVersionIds, ListSecrets. Bounded lookup fan-out and page assembly.
Secret and policy mutation: 12 ms monthly p99. CreateSecret, DeleteResourcePolicy, DeleteSecret, PutResourcePolicy, PutSecretValue, RestoreSecret, TagResource, UntagResource, UpdateSecret, UpdateSecretVersionStage. Validation plus one serialized durable secret-state commit.
Rotation and replication coordination: 25 ms monthly p99. CancelRotateSecret, RemoveRegionsFromReplication, ReplicateSecretToRegions, RotateSecret. Durable workflow transition and bounded reconciliation scheduling.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Reads shard by secret identity and version. Mutations on one secret serialize to protect staging-label and deletion invariants, while unrelated secrets remain parallel. List and batch qualification fixes page size, secret count, payload bytes and concurrency; rotation trials include bounded callback and retry accounting without treating callback time as local compute. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
A returned success means secret material and version metadata are durable. AWSCURRENT/AWSPREVIOUS transitions remain atomic, recovery windows are honored, resource policies never widen on translation, and replica or rotation failures cannot expose an uncommitted version.Example and diagnosis
PutSecretValue creates a new version and moves AWSCURRENT in one logical mutation. A simultaneous GetSecretValue either sees the old complete version or the new complete version. RotateSecret uses the coordination group and reports callback/provider time separately from adapter admission, state transitions and response work. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Install and run
The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. SetT9_API_KEY as described in Install and Authenticate, then list the adapters your account may use with this origin: