- Coverage by target cloud
- How the targets compare
- On Google Cloud
- On Azure
- On OCI
- On Private Kubernetes
Coverage by target cloud
How the targets compare
Each row compares a capability of Secrets Manager with its adaptation on each target. A dash means this row is not stated for that target.Max adaptation
On Google Cloud
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Google Secret Manager stores the current value under the deployment’s Google identity. Its numbered versions are target revisions, not the source of AWS stage selection. Google replication and encryption settings govern that provider copy. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Google Secret Manager. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Google’s native replication policy is chosen when its secret is created. AWS stage moves and delayed deletion are handled in the adapter’s record, so they do not require corresponding Google aliases or a native secret recovery window.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Azure
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
Azure Key Vault stores the current value under the deployment’s Azure identity. A version tag tracks the adapter revision because Key Vault’s native version IDs are opaque. The adapter retains AWS version history and stage labels independently. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to Azure Key Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Key Vault limits a stored value to 25 KiB; encoded binary content must fit that limit. This target’s deletion and name-reuse workflow requires purge permission. A purge-protected vault can block final removal or reuse of a deleted name. AWS scheduled deletion is handled by the adapter before this target cleanup begins.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On OCI
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
OCI Vault is the target store for the current secret value in this mapping. OCI requires an encryption key for the vault secret and provides its own version stages and replication settings. The adapter owns AWS history and stage selection, independently of those native features. The adapter’s durable record retains all versions and labels. Reconciliation writes the current value and its revision to OCI Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Configure the OCI key and any geographic replication for the provider copy. OCI’s native scheduled-deletion rules can delay physical removal after the AWS API has withdrawn a secret. These target rules do not replace the adapter’s deletion window or create an independent AWS regional replica.
Cutover and ongoing operation
Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter’s record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring.On Private Kubernetes
Requests, versions, and deletion
Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret’s values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store.PutSecretValue creates an immutable version. AWSCURRENT, AWSPENDING, AWSPREVIOUS, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected.
Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. RestoreSecret cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
The adapter stores values and version history in its durable state.
Rotation and access policies
The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment’s cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal’s permissions.Target storage, encryption, and replication
The customer deployment stores the secret entirely in the adapter’s durable state. This configuration creates no additional Kubernetes Secret. Version history and reads use the same secret record as cloud-backed deployments. All versions and labels remain in the adapter’s durable state. Protect that state store and its backups; no separate cloud secret copy is configured. Encryption follows the deployment’s storage and key configuration. The adapter retainsKmsKeyId as metadata. Protect the durable state and configure any target copy to meet the workload’s encryption-key requirements.
Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; StopReplicationToReplica does not promote an independent regional replica.
Storage durability, encryption, backups, and recovery depend on the appliance’s state store. A Kubernetes namespace or an external synchronization controller does not provide that history.