AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
#### Batch reads, paths, and metadata GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter's metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping. #### Versions and labels This mapping retains parameter history and named SSM labels. The adapter maintains retained values and label-to-version references for GetParameterHistory, LabelParameterVersion, and version-qualified reads. Parameter Manager has no native version aliases; selecting its highest native version is not the Max request path. #### Target storage and encryption Google Parameter Manager holds the reconciled parameter value in the customer's project. The deployment uses Google workload identity. Parameter resources and their native versions are the target representation; the adapter owns the AWS parameter name, current version, and read behavior. All three parameter types are supported. Parameter Manager encrypts its copy at rest. Protect durable adapter state and backups too. Parameter resources can contain sensitive values; choose access controls from their contents, not the service's name. #### Limits and deployment Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges. ### Via Secret Manager | Operation | Area | Support | Depth | Notes | | ----------------------------------------------------------- | -------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Consumed parameters (read-only references) | Build & deploy | Supported | Common | a parameter the stack reads but does not own is supplied by the customer during installation; that supply path is distinct from runtime parameter management | | Filters & discovery (DescribeParameters / ParameterFilters) | Discovery | Partial | Full surface | DescribeParameters serves paginated metadata without values; complete ParameterFilters behavior is outside the documented contract | | Change notifications | Events | Out of scope | Full surface | parameter-change events are outside this mapping | | Batch reads (GetParameters) | Parameters | Supported | Common | reads caller-scoped parameter records and partitions found and missing names | | Hierarchies & by-path reads (GetParametersByPath) | Parameters | Supported | Common | queries live adapter records by path, applies recursion rules, and returns paginated results; no provider value fetch per returned parameter | | Parameter reads (GetParameter) | Parameters | Supported | Common | reads the current value, type, and AWS version from the caller-scoped durable parameter record; the target copy is reconciled separately | | Parameter writes & deletes | Parameters | Supported | Common | PutParameter creates or updates durable parameter state and reconciles the target; DeleteParameter withdraws reads while target cleanup proceeds separately | | Parameter policies & Advanced tier | Policies | Out of scope | Most usage | parameter policies and the Advanced tier are outside the documented contract | | Public & shared parameters | Scope | Out of scope | Full surface | AWS-published public parameters and cross-account shared parameters are outside this mapping | | The wider Systems Manager suite | Scope | Out of scope | Full surface | Parameter Store only: remote commands, sessions, patching, state management, and documents remain out of scope | | Custom encryption keys (KeyId) | Types | Out of scope | Most usage | custom per-parameter AWS KMS keys are unsupported; protect durable adapter state and configure the target copy independently | | Parameter types (String / StringList / SecureString) | Types | Supported | Common | all three type markers are retained in durable state; Secret Manager encrypts its provider copy at rest | | Reading ciphertext (WithDecryption=false) | Types | Out of scope | Most usage | SecureString reads require WithDecryption=true; the adapter does not return AWS KMS ciphertext | | Versions & labels | Versions | Supported | Most usage | retained values and adapter-owned label references provide parameter history and named labels; native aliases do not decide AWS reads | #### Requests and durable parameter state With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Google Secret Manager. `PutParameter` creates a parameter or updates it when `Overwrite=true`. An existing name with `Overwrite=false` returns `ParameterAlreadyExists`. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. `DeleteParameter` removes the parameter from reads while target cleanup proceeds separately. Protect and back up the adapter's state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
#### Batch reads, paths, and metadata GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter's metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping. #### Versions and labels This mapping retains parameter history and named SSM labels. The adapter maintains the retained values and label-to-version references needed by GetParameterHistory, LabelParameterVersion, and version-qualified reads. Moving a provider alias directly does not move an SSM label. #### Target storage and encryption Google Secret Manager holds the reconciled current value in the customer's project. The deployment uses Google workload identity. Its native versions and aliases describe the provider copy; AWS reads and version selection belong to the adapter. All three parameter types are supported. Secret Manager encrypts its copy at rest. Protect the adapter's durable parameter state and backups as well as the provider copy; storing an ordinary String as a secret does not change the sensitivity of its contents. #### Limits and deployment Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges. ## On Azure | Operation | Area | Support | Depth | Notes | | ----------------------------------------------------------- | -------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Consumed parameters (read-only references) | Build & deploy | Supported | Common | a parameter the stack reads but does not own is supplied by the customer during installation; that supply path is distinct from runtime parameter management | | Filters & discovery (DescribeParameters / ParameterFilters) | Discovery | Partial | Full surface | DescribeParameters serves paginated metadata without values; complete ParameterFilters behavior is outside the documented contract | | Change notifications | Events | Out of scope | Full surface | parameter-change events are outside this mapping | | Batch reads (GetParameters) | Parameters | Supported | Common | reads caller-scoped parameter records and partitions found and missing names | | Hierarchies & by-path reads (GetParametersByPath) | Parameters | Supported | Common | queries live adapter records by path, applies recursion rules, and returns paginated results; no provider value fetch per returned parameter | | Parameter reads (GetParameter) | Parameters | Supported | Common | reads the current value, type, and AWS version from the caller-scoped durable parameter record; the target copy is reconciled separately | | Parameter writes & deletes | Parameters | Supported | Common | PutParameter creates or updates durable parameter state and reconciles the target; DeleteParameter withdraws reads while target cleanup proceeds separately | | Parameter policies & Advanced tier | Policies | Out of scope | Most usage | parameter policies and the Advanced tier are outside the documented contract | | Public & shared parameters | Scope | Out of scope | Full surface | AWS-published public parameters and cross-account shared parameters are outside this mapping | | The wider Systems Manager suite | Scope | Out of scope | Full surface | Parameter Store only: remote commands, sessions, patching, state management, and documents remain out of scope | | Custom encryption keys (KeyId) | Types | Out of scope | Most usage | custom per-parameter AWS KMS keys are unsupported; protect durable adapter state and configure the target copy independently | | Parameter types (String / StringList / SecureString) | Types | Partial | Common | String and StringList are supported; SecureString remains outside the App Configuration mapping. Direct Key Vault access is a separate application path | | Reading ciphertext (WithDecryption=false) | Types | Out of scope | Most usage | SecureString reads require WithDecryption=true; the adapter does not return AWS KMS ciphertext | | Versions & labels | Versions | Partial | Most usage | numeric history is retained; the adapter owns AWS version selection. Named SSM labels remain outside this mapping | #### Requests and durable parameter state With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Azure App Configuration. `PutParameter` creates a parameter or updates it when `Overwrite=true`. An existing name with `Overwrite=false` returns `ParameterAlreadyExists`. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. `DeleteParameter` removes the parameter from reads while target cleanup proceeds separately. Protect and back up the adapter's state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
#### Batch reads, paths, and metadata GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter's metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping. #### Versions and labels This mapping retains numeric parameter versions; named SSM version labels are unsupported. App Configuration labels can represent retained target versions, but they are different from SSM labels. The adapter owns the AWS version counter and selection; the highest provider label does not decide a Max read. #### Target storage and encryption Azure App Configuration holds the reconciled configuration value in the customer's store, accessed with the deployment's managed identity. Its key prefixes and label dimension organize the provider copy. GetParametersByPath queries adapter records rather than using a provider prefix query as the application read path. String and StringList are supported. SecureString is unsupported for this App Configuration mapping. Accessing Azure Key Vault directly requires application changes and is a separate option. Protect adapter state and the encrypted provider store; storage encryption alone does not add SecureString support. #### Limits and deployment Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges. ## On OCI | Operation | Area | Support | Depth | Notes | | ----------------------------------------------------------- | -------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Consumed parameters (read-only references) | Build & deploy | Supported | Common | a parameter the stack reads but does not own is supplied by the customer during installation; that supply path is distinct from runtime parameter management | | Filters & discovery (DescribeParameters / ParameterFilters) | Discovery | Partial | Full surface | DescribeParameters serves paginated metadata without values; complete ParameterFilters behavior is outside the documented contract | | Change notifications | Events | Out of scope | Full surface | parameter-change events are outside this mapping | | Batch reads (GetParameters) | Parameters | Supported | Common | reads caller-scoped parameter records and partitions found and missing names | | Hierarchies & by-path reads (GetParametersByPath) | Parameters | Supported | Common | queries live adapter records by path, applies recursion rules, and returns paginated results; no provider value fetch per returned parameter | | Parameter reads (GetParameter) | Parameters | Supported | Common | reads the current value, type, and AWS version from the caller-scoped durable parameter record; the target copy is reconciled separately | | Parameter writes & deletes | Parameters | Supported | Common | PutParameter creates or updates durable parameter state and reconciles the target; DeleteParameter withdraws reads while target cleanup proceeds separately | | Parameter policies & Advanced tier | Policies | Out of scope | Most usage | parameter policies and the Advanced tier are outside the documented contract | | Public & shared parameters | Scope | Out of scope | Full surface | AWS-published public parameters and cross-account shared parameters are outside this mapping | | The wider Systems Manager suite | Scope | Out of scope | Full surface | Parameter Store only: remote commands, sessions, patching, state management, and documents remain out of scope | | Custom encryption keys (KeyId) | Types | Out of scope | Most usage | custom per-parameter AWS KMS keys are unsupported; protect durable adapter state and configure the target copy independently | | Parameter types (String / StringList / SecureString) | Types | Supported | Common | all three type markers are retained in durable state; the configured OCI vault key encrypts the provider copy | | Reading ciphertext (WithDecryption=false) | Types | Out of scope | Most usage | SecureString reads require WithDecryption=true; the adapter does not return AWS KMS ciphertext | | Move-only version labels | Versions | Out of scope | Most usage | named SSM labels are outside this mapping; native OCI stages do not define the AWS contract | | Versions | Versions | Supported | Most usage | numeric history is retained; the adapter owns AWS version identity and selection independently of native OCI versionNumber values | #### Requests and durable parameter state With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to OCI Vault. `PutParameter` creates a parameter or updates it when `Overwrite=true`. An existing name with `Overwrite=false` returns `ParameterAlreadyExists`. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. `DeleteParameter` removes the parameter from reads while target cleanup proceeds separately. Protect and back up the adapter's state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
#### Batch reads, paths, and metadata GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter's metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping. #### Versions and labels This mapping retains numeric parameter versions; named SSM labels are unsupported. OCI supplies versioned target storage, while the adapter maintains AWS version identity and selection. A native versionNumber is not an instruction to read around the parameter record. #### Target storage and encryption OCI Vault holds the reconciled value as a secret, including ordinary String configuration. Configure the vault, compartment, encryption key, and resource-principal access for secret management and retrieval. Native secret versions describe the provider copy; the adapter owns the AWS parameter record and read path. All three parameter types use the configured vault key for the provider copy. OCI schedules physical secret deletion; that cleanup can finish after the parameter leaves the AWS-readable set. Reusing a name must be reconciled with any retained native secret, without confusing its version sequence with the new AWS parameter identity. Protect durable adapter state and backups as well as the vault. #### Limits and deployment Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges. ## On Private Kubernetes | Operation | Area | Support | Depth | Notes | | ----------------------------------------------------------- | -------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Consumed parameters (read-only references) | Build & deploy | Supported | Common | a parameter the stack reads but does not own is supplied by the customer during installation; that supply path is distinct from runtime parameter management | | Filters & discovery (DescribeParameters / ParameterFilters) | Discovery | Partial | Full surface | DescribeParameters serves paginated metadata without values; complete ParameterFilters behavior is outside the documented contract | | Change notifications | Events | Out of scope | Full surface | parameter-change events are outside this mapping | | Batch reads (GetParameters) | Parameters | Supported | Common | reads caller-scoped parameter records and partitions found and missing names | | Hierarchies & by-path reads (GetParametersByPath) | Parameters | Supported | Common | queries live adapter records by path, applies recursion rules, and returns paginated results; no provider value fetch per returned parameter | | Parameter reads (GetParameter) | Parameters | Supported | Common | reads the current value, type, and AWS version from the caller-scoped durable parameter record; the target copy is reconciled separately | | Parameter writes & deletes | Parameters | Supported | Common | PutParameter creates or updates durable parameter state and reconciles the target; DeleteParameter withdraws reads while target cleanup proceeds separately | | Parameter policies & Advanced tier | Policies | Out of scope | Most usage | parameter policies and the Advanced tier are outside the documented contract | | Public & shared parameters | Scope | Out of scope | Full surface | AWS-published public parameters and cross-account shared parameters are outside this mapping | | The wider Systems Manager suite | Scope | Out of scope | Full surface | Parameter Store only: remote commands, sessions, patching, state management, and documents remain out of scope | | Custom encryption keys (KeyId) | Types | Out of scope | Most usage | custom per-parameter AWS KMS keys are unsupported; protect durable adapter state and configure the target copy independently | | Parameter types (String / StringList / SecureString) | Types | Supported | Common | all three type markers are retained; protect durable state and configure Kubernetes storage encryption. Base64 encoding does not encrypt the target copy | | Reading ciphertext (WithDecryption=false) | Types | Out of scope | Most usage | SecureString reads require WithDecryption=true; the adapter does not return AWS KMS ciphertext | | Versions & labels | Versions | Out of scope | Most usage | only the latest value and increasing AWS version counter are retained; previous values and named labels are unsupported | #### Requests and durable parameter state With Max adaptation, your application sends Parameter Store requests in its AWS SDK to the Tensor9 adapter. The adapter keeps a durable parameter record containing the name, type, current value, version counter, description, and tags. Reads use that record. A background worker reconciles its current value to Kubernetes Secrets. `PutParameter` creates a parameter or updates it when `Overwrite=true`. An existing name with `Overwrite=false` returns `ParameterAlreadyExists`. Writes advance the AWS version counter and wait for target reconciliation within a bounded interval; a terminal target rejection is reported. `DeleteParameter` removes the parameter from reads while target cleanup proceeds separately. Protect and back up the adapter's state as well as the target store. Direct provider edits do not update the AWS parameter record and can be overwritten during reconciliation. Existing AWS values and provider history are not automatically imported.
AWS parameter reads use durable adapter state. Target reconciliation and cleanup run separately.
#### Batch reads, paths, and metadata GetParameter and GetParameters read caller-scoped parameter records. Batch reads partition found and missing names. GetParametersByPath selects live records by path, applies recursion rules, and returns paginated results in name order. It does not fetch every matching value from the provider store, so the earlier direct-proxy per-parameter access cost is not the Max read path. DescribeParameters returns paginated metadata, including names, types, versions, and descriptions, without parameter values. Complete ParameterFilters behavior is outside the documented contract. Tag operations update the parameter's metadata. These operations cover Parameter Store; Run Command, Session Manager, patching, state management, and documents remain outside the mapping. #### Versions and labels This mapping retains the latest value and its increasing version counter. Previous values and named SSM labels are unsupported. A counter records writes; it does not make old values readable. Choose a mapping with retained history when the application needs it. #### Target storage and encryption A Kubernetes Secret holds the reconciled current value in the customer cluster. The deployment's service account accesses the backing objects. AWS reads use durable parameter records, not a Kubernetes Secret lookup for each request; the parameter counter belongs to that record. All three parameter type markers are preserved. Kubernetes Secret values are base64-encoded; base64 is not encryption. Configure Kubernetes access control and storage encryption, and protect the adapter's durable state and backups. This storage option stays inside the customer cluster, including disconnected deployments. #### Limits and deployment Custom per-parameter KMS keys, AWS ciphertext reads with WithDecryption=false, parameter policies, and the Advanced tier are unsupported. SecureString reads on a supporting mapping require WithDecryption=true. AWS-published public parameters, cross-account shared parameters, and parameter-change events are outside this mapping. Load values through the Parameter Store API and verify reads, overwrite behavior, and deletion before switching the application. Deployment can also initialize stack-owned literal values from the release. The customer supplies parameters the stack only reads during installation; that secret-supply path is distinct from runtime parameter management. Provider storage, access permissions, reconciliation, and durable-state availability affect operation. Historical direct-proxy measurements describe their recorded request path; they do not establish Max latency, throughput, or per-read provider charges. [Service Catalog](/service-adapters/catalog).