- Coverage by target cloud
- How the targets compare
- On Google Cloud
- On Azure
- On OCI
- On Private Kubernetes
Coverage by target cloud
How the targets compare
Each row compares a capability of Systems Manager (SSM) with its adaptation on each target. A dash means this row is not stated for that target.Max adaptation
On Google Cloud
Via Google Parameter Manager
Requests and durable parameter state
With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Google Parameter Manager.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains parameter history and named SSM labels. The adapter maintains retained values and label-to-version references for GetParameterHistory, LabelParameterVersion, and version-qualified reads. Parameter Manager has no native version aliases; selecting its highest native version is not the Max request path.Target storage and encryption
Google Parameter Manager holds the reconciled parameter value in the customer’s project. The deployment uses Google workload identity. Parameter resources and their native versions are the target representation; the adapter owns the AWS parameter name, current version, and read behavior. All three parameter types are supported. Parameter Manager encrypts its copy at rest. Protect durable adapter state and backups too. Parameter resources can contain sensitive values; choose access controls from their contents, not the service’s name.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.Via Secret Manager
Requests and durable parameter state
With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Google Secret Manager.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains parameter history and named SSM labels. The adapter maintains the retained values and label-to-version references needed by GetParameterHistory, LabelParameterVersion, and version-qualified reads. Moving a provider alias directly does not move an SSM label.Target storage and encryption
Google Secret Manager holds the reconciled current value in the customer’s project. The deployment uses Google workload identity. Its native versions and aliases describe the provider copy; AWS reads and version selection belong to the adapter. All three parameter types are supported. Secret Manager encrypts its copy at rest. Protect the adapter’s durable parameter state and backups as well as the provider copy; storing an ordinary String as a secret does not change the sensitivity of its contents.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.On Azure
Requests and durable parameter state
With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Azure App Configuration.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains numeric parameter versions; named SSM version labels are unsupported. App Configuration labels can represent retained target versions, but they are different from SSM labels. The adapter owns the AWS version counter and selection; the highest provider label does not decide a Max read.Target storage and encryption
Azure App Configuration holds the reconciled configuration value in the customer’s store, accessed with the deployment’s managed identity. Its key prefixes and label dimension organize the provider copy. GetParametersByPath queries adapter records rather than using a provider prefix query as the application read path. String and StringList are supported. SecureString is unsupported for this App Configuration mapping. Accessing Azure Key Vault directly requires application changes and is a separate option. Protect adapter state and the encrypted provider store; storage encryption alone does not add SecureString support.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.On OCI
Requests and durable parameter state
With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to OCI Vault.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
Batch reads, paths, and metadata
GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter’s metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping.Versions and labels
This mapping retains numeric parameter versions; named SSM labels are unsupported. OCI supplies versioned target storage, while the adapter maintains AWS version identity and selection. A native versionNumber is not an instruction to read around the parameter record.Target storage and encryption
OCI Vault holds the reconciled value as a secret, including ordinary String configuration. Configure the vault, compartment, encryption key, and resource-principal access for secret management and retrieval. Native secret versions describe the provider copy; the adapter owns the AWS parameter record and read path. All three parameter types use the configured vault key for the provider copy. OCI schedules physical secret deletion; that cleanup can finish after the parameter leaves the AWS-readable set. Reusing a name must be reconciled with any retained native secret, without confusing its version sequence with the new AWS parameter identity. Protect durable adapter state and backups as well as the vault.Limits and deployment
Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges.On Private Kubernetes
Requests and durable parameter state
With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Kubernetes Secrets.PutParameter creates a parameter or updates it when Overwrite=true. An existing name with Overwrite=false returns ParameterAlreadyExists. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. DeleteParameter removes the parameter from reads while target cleanup proceeds separately.
Protect and back up the adapter’s state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.