Supported environments
API means the profile adapts origin API behavior. Infrastructure means the profile changes provisioned resources or documents a target-native alternative without promising an origin API endpoint. Check the operation and capability tables for the behavior your application depends on.
How the targets compare
Each row compares a capability of Secrets Manager with its adaptation on each target. A dash means this profile does not state the capability for that target.Cloud Adapter
On Akamai, Private Kubernetes, and Scaleway
Kubernetes Secret
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
The adapter stores values and version history in its durable state.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
The customer deployment stores the secret entirely in the adapter’s durable state. This configuration creates no additional Kubernetes Secret. Version history and reads use the same secret record as cloud-backed deployments. All versions and labels remain in the adapter’s durable state. Protect that state store and its backups; no separate cloud secret copy is configured. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Storage durability, encryption, backups, and recovery depend on the Cloud Adapter deployment’s state store. A Kubernetes namespace or an external synchronization controller does not provide that history.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Azure
Key Vault
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Azure Key Vault stores the current value under the deployment’s Azure identity. A version tag tracks the adapter revision because Key Vault’s native version IDs are opaque. The adapter retains AWS version history and stage labels independently. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Azure Key Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Key Vault limits a stored value to 25 KiB; encoded binary content must fit that limit. This target’s deletion and name-reuse workflow requires purge permission. A purge-protected vault can block final removal or reuse of a deleted name. AWS scheduled deletion is handled by the adapter before this target cleanup begins.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Google Cloud
Google Secret Manager
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Google Secret Manager stores the current value under the deployment’s Google identity. Its numbered versions are target revisions, not the source of AWS stage selection. Google replication and encryption settings govern that provider copy. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Google Secret Manager. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Google’s native replication policy is chosen when its secret is created. AWS stage moves and delayed deletion are handled in the adapter’s record, so they do not require corresponding Google aliases or a native secret recovery window.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On OCI
OCI Vault
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
OCI Vault is the target store for the current secret value in this mapping. OCI requires an encryption key for the vault secret and provides its own version stages and replication settings. The adapter owns AWS history and stage selection, independently of those native features. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to OCI Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Configure the OCI key and any geographic replication for the provider copy. OCI’s native scheduled-deletion rules can delay physical removal after the AWS API has withdrawn a secret. These target rules do not replace the adapter’s deletion window or create an independent AWS regional replica.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Scaleway
Scaleway Secret Manager
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the target environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Scaleway Secret Manager is the target store for the current secret value in this mapping: one Scaleway secret per logical secret, and the adapter’s declared version is carried as that secret’s REVISION. A read resolves the newest ENABLED revision; a write appends one enabled revision when the target is behind. The adapter owns AWS history and stage selection independently of Scaleway’s own revision numbering, and never reads a stored payload back out of Scaleway — values are served from the adapter’s own record. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Scaleway Secret Manager. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
YOUR SECRET NAMES ARE TRANSFORMED, and this is the one thing to know before you go looking in the Scaleway console. Scaleway’s name grammar admits only letters, digits, dot, dash and underscore, so the commonest AWS shape — prod/db/password — is rejected outright at create. The adapter therefore encodes each name: lower-case letters and digits are kept and every other byte becomes _ plus two hex digits, so a/b and a_b stay distinct, and an encoding over 255 characters folds to a 200-character prefix plus a short hash. The secret you named prod/db/password exists, holds the right value, and is listed under its encoded name. Two smaller differences: Scaleway tags are a flat list of strings rather than key/value pairs, so AWS tag pairs are encoded into that shape; and a secret whose every revision is disabled resolves to nothing, which the adapter reads as absent and repairs by appending a fresh enabled revision rather than by reusing a disabled one.