AWS version history stays in the record; the target copy follows its current value.
#### Rotation and access policies The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment's cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal's permissions. #### Target storage, encryption, and replication Google Secret Manager stores the current value under the deployment's Google identity. Its numbered versions are target revisions, not the source of AWS stage selection. Google replication and encryption settings govern that provider copy. The adapter's durable record retains all versions and labels. Reconciliation writes the current value and its revision to Google Secret Manager. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment's storage and key configuration. The adapter retains `KmsKeyId` as metadata. Protect the durable state and configure any target copy to meet the workload's encryption-key requirements. Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; `StopReplicationToReplica` does not promote an independent regional replica. Google's native replication policy is chosen when its secret is created. AWS stage moves and delayed deletion are handled in the adapter's record, so they do not require corresponding Google aliases or a native secret recovery window. #### Cutover and ongoing operation Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter's record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring. ## On Azure | Operation | Area | Support | Depth | Notes | | ---------------------------- | --------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------ | | BatchGetSecretValue | Bulk & generate | Supported | Most usage | reads requested secrets from their records with list/filter selection | | GetRandomPassword | Bulk & generate | Supported | Most usage | generates a password using the operating system's secure random source and requested character rules | | ListSecrets | Listing & tags | Supported | Common | lists and filters caller-scoped records, excluding deleted secrets | | TagResource | Listing & tags | Supported | Full surface | retains source tags verbatim; deployment directive tags cannot be mutated | | UntagResource | Listing & tags | Supported | Full surface | removes source tags; deployment directive tags are protected | | RemoveRegionsFromReplication | Replication | Partial | Full surface | removes region entries from the secret record; physical target replicas are managed separately | | ReplicateSecretToRegions | Replication | Partial | Most usage | retains requested region configuration; physical copies require separately configured target replication | | StopReplicationToReplica | Replication | Out of scope | Full surface | this adapter serves primary records and does not promote an independent regional replica | | DeleteResourcePolicy | Resource policy | Supported | Full surface | removes the policy document from the secret record | | GetResourcePolicy | Resource policy | Supported | Full surface | returns the stored source policy document | | PutResourcePolicy | Resource policy | Partial | Full surface | stores and validates the policy; full resource-policy enforcement is separate from policy management | | ValidateResourcePolicy | Resource policy | Partial | Full surface | checks syntax, public access, and administrative lockout; does not promise AWS's complete policy analysis | | CancelRotateSecret | Rotation | Supported | Full surface | disables rotation and withdraws its run; pending labels remain for the caller to resolve | | RotateSecret | Rotation | Supported | Most usage | runs the four-step protocol; the connected Lambda adapter must be able to invoke the supplied function | | CreateSecret | Secret CRUD | Supported | Common | creates durable secret state and the initial version; target-specific value and key constraints still apply | | DeleteSecret | Secret CRUD | Supported | Common | records a 7-30 day recovery window, default 30; force deletion withdraws the record while target cleanup follows | | DescribeSecret | Secret CRUD | Supported | Common | reports the secret record, including version stages, deletion, rotation, and replica configuration | | GetSecretValue | Secret CRUD | Supported | Common | reads the requested version or stage from durable state; scheduled deletion blocks reads | | PutSecretValue | Secret CRUD | Supported | Common | adds an immutable version with idempotency-token checks and updates stages | | RestoreSecret | Secret CRUD | Supported | Most usage | cancels scheduled deletion before the recovery window expires | | UpdateSecret | Secret CRUD | Supported | Most usage | updates metadata or adds a value version; an encryption-key ID must be distinguished from target key configuration | | ListSecretVersionIds | Versioning | Supported | Most usage | lists immutable versions and their stage labels from the record | | UpdateSecretVersionStage | Versioning | Supported | Most usage | moves source stage labels independently of provider-native aliases | #### Requests, versions, and deletion Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret's values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store. `PutSecretValue` creates an immutable version. `AWSCURRENT`, `AWSPENDING`, `AWSPREVIOUS`, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected. Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. `RestoreSecret` cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
#### Rotation and access policies The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment's cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal's permissions. #### Target storage, encryption, and replication Azure Key Vault stores the current value under the deployment's Azure identity. A version tag tracks the adapter revision because Key Vault's native version IDs are opaque. The adapter retains AWS version history and stage labels independently. The adapter's durable record retains all versions and labels. Reconciliation writes the current value and its revision to Azure Key Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment's storage and key configuration. The adapter retains `KmsKeyId` as metadata. Protect the durable state and configure any target copy to meet the workload's encryption-key requirements. Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; `StopReplicationToReplica` does not promote an independent regional replica. Key Vault limits a stored value to 25 KiB; encoded binary content must fit that limit. This target's deletion and name-reuse workflow requires purge permission. A purge-protected vault can block final removal or reuse of a deleted name. AWS scheduled deletion is handled by the adapter before this target cleanup begins. #### Cutover and ongoing operation Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter's record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring. ## On OCI | Operation | Area | Support | Depth | Notes | | ---------------------------- | --------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------ | | BatchGetSecretValue | Bulk & generate | Supported | Most usage | reads requested secrets from their records with list/filter selection | | GetRandomPassword | Bulk & generate | Supported | Most usage | generates a password using the operating system's secure random source and requested character rules | | ListSecrets | Listing & tags | Supported | Common | lists and filters caller-scoped records, excluding deleted secrets | | TagResource | Listing & tags | Supported | Full surface | retains source tags verbatim; deployment directive tags cannot be mutated | | UntagResource | Listing & tags | Supported | Full surface | removes source tags; deployment directive tags are protected | | RemoveRegionsFromReplication | Replication | Partial | Full surface | removes region entries from the secret record; physical target replicas are managed separately | | ReplicateSecretToRegions | Replication | Partial | Most usage | retains requested region configuration; physical copies require separately configured target replication | | StopReplicationToReplica | Replication | Out of scope | Full surface | this adapter serves primary records and does not promote an independent regional replica | | DeleteResourcePolicy | Resource policy | Supported | Full surface | removes the policy document from the secret record | | GetResourcePolicy | Resource policy | Supported | Full surface | returns the stored source policy document | | PutResourcePolicy | Resource policy | Partial | Full surface | stores and validates the policy; full resource-policy enforcement is separate from policy management | | ValidateResourcePolicy | Resource policy | Partial | Full surface | checks syntax, public access, and administrative lockout; does not promise AWS's complete policy analysis | | CancelRotateSecret | Rotation | Supported | Full surface | disables rotation and withdraws its run; pending labels remain for the caller to resolve | | RotateSecret | Rotation | Supported | Most usage | runs the four-step protocol; the connected Lambda adapter must be able to invoke the supplied function | | CreateSecret | Secret CRUD | Supported | Common | creates durable secret state and the initial version; target-specific value and key constraints still apply | | DeleteSecret | Secret CRUD | Supported | Common | records a 7-30 day recovery window, default 30; force deletion withdraws the record while target cleanup follows | | DescribeSecret | Secret CRUD | Supported | Common | reports the secret record, including version stages, deletion, rotation, and replica configuration | | GetSecretValue | Secret CRUD | Supported | Common | reads the requested version or stage from durable state; scheduled deletion blocks reads | | PutSecretValue | Secret CRUD | Supported | Common | adds an immutable version with idempotency-token checks and updates stages | | RestoreSecret | Secret CRUD | Supported | Most usage | cancels scheduled deletion before the recovery window expires | | UpdateSecret | Secret CRUD | Supported | Most usage | updates metadata or adds a value version; an encryption-key ID must be distinguished from target key configuration | | ListSecretVersionIds | Versioning | Supported | Most usage | lists immutable versions and their stage labels from the record | | UpdateSecretVersionStage | Versioning | Supported | Most usage | moves source stage labels independently of provider-native aliases | #### Requests, versions, and deletion Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret's values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store. `PutSecretValue` creates an immutable version. `AWSCURRENT`, `AWSPENDING`, `AWSPREVIOUS`, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected. Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. `RestoreSecret` cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
AWS version history stays in the record; the target copy follows its current value.
#### Rotation and access policies The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment's cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal's permissions. #### Target storage, encryption, and replication OCI Vault is the target store for the current secret value in this mapping. OCI requires an encryption key for the vault secret and provides its own version stages and replication settings. The adapter owns AWS history and stage selection, independently of those native features. The adapter's durable record retains all versions and labels. Reconciliation writes the current value and its revision to OCI Vault. Direct edits to that copy do not update AWS version history and can be overwritten. Protect and back up adapter state as well as the target store. Encryption follows the deployment's storage and key configuration. The adapter retains `KmsKeyId` as metadata. Protect the durable state and configure any target copy to meet the workload's encryption-key requirements. Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; `StopReplicationToReplica` does not promote an independent regional replica. Configure the OCI key and any geographic replication for the provider copy. OCI's native scheduled-deletion rules can delay physical removal after the AWS API has withdrawn a secret. These target rules do not replace the adapter's deletion window or create an independent AWS regional replica. #### Cutover and ongoing operation Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter's record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring. ## On Private Kubernetes | Operation | Area | Support | Depth | Notes | | ---------------------------- | --------------- | ------------ | ------------ | ------------------------------------------------------------------------------------------------------------------ | | BatchGetSecretValue | Bulk & generate | Supported | Most usage | reads requested secrets from their records with list/filter selection | | GetRandomPassword | Bulk & generate | Supported | Most usage | generates a password using the operating system's secure random source and requested character rules | | ListSecrets | Listing & tags | Supported | Common | lists and filters caller-scoped records, excluding deleted secrets | | TagResource | Listing & tags | Supported | Full surface | retains source tags verbatim; deployment directive tags cannot be mutated | | UntagResource | Listing & tags | Supported | Full surface | removes source tags; deployment directive tags are protected | | RemoveRegionsFromReplication | Replication | Partial | Full surface | removes region entries from the secret record; physical target replicas are managed separately | | ReplicateSecretToRegions | Replication | Partial | Most usage | retains requested region configuration; physical copies require separately configured target replication | | StopReplicationToReplica | Replication | Out of scope | Full surface | this adapter serves primary records and does not promote an independent regional replica | | DeleteResourcePolicy | Resource policy | Supported | Full surface | removes the policy document from the secret record | | GetResourcePolicy | Resource policy | Supported | Full surface | returns the stored source policy document | | PutResourcePolicy | Resource policy | Partial | Full surface | stores and validates the policy; full resource-policy enforcement is separate from policy management | | ValidateResourcePolicy | Resource policy | Partial | Full surface | checks syntax, public access, and administrative lockout; does not promise AWS's complete policy analysis | | CancelRotateSecret | Rotation | Supported | Full surface | disables rotation and withdraws its run; pending labels remain for the caller to resolve | | RotateSecret | Rotation | Supported | Most usage | runs the four-step protocol; the connected Lambda adapter must be able to invoke the supplied function | | CreateSecret | Secret CRUD | Supported | Common | creates durable secret state and the initial version; target-specific value and key constraints still apply | | DeleteSecret | Secret CRUD | Supported | Common | records a 7-30 day recovery window, default 30; force deletion withdraws the record while target cleanup follows | | DescribeSecret | Secret CRUD | Supported | Common | reports the secret record, including version stages, deletion, rotation, and replica configuration | | GetSecretValue | Secret CRUD | Supported | Common | reads the requested version or stage from durable state; scheduled deletion blocks reads | | PutSecretValue | Secret CRUD | Supported | Common | adds an immutable version with idempotency-token checks and updates stages | | RestoreSecret | Secret CRUD | Supported | Most usage | cancels scheduled deletion before the recovery window expires | | UpdateSecret | Secret CRUD | Supported | Most usage | updates metadata or adds a value version; an encryption-key ID must be distinguished from target key configuration | | ListSecretVersionIds | Versioning | Supported | Most usage | lists immutable versions and their stage labels from the record | | UpdateSecretVersionStage | Versioning | Supported | Most usage | moves source stage labels independently of provider-native aliases | #### Requests, versions, and deletion Your application sends AWS Secrets Manager requests to the Tensor9 adapter in the customer environment. The adapter keeps a durable record containing the secret's values, version IDs, stage labels, tags, and lifecycle settings. Reads use that record; they do not select whichever version happens to be latest in the target store. `PutSecretValue` creates an immutable version. `AWSCURRENT`, `AWSPENDING`, `AWSPREVIOUS`, and custom labels select versions in the record. Moving a label changes which value a read returns. A repeated request token with the same value returns the earlier result; reusing the token with a different value is rejected. Scheduled deletion blocks reads for a recoverable period of 7-30 days, with 30 days as the default. `RestoreSecret` cancels that deletion before the window expires. Force deletion removes the secret from the API immediately; removal of any target copy is completed separately.
The adapter stores values and version history in its durable state.
#### Rotation and access policies The adapter runs the four rotation steps: create a candidate, update the credential at its source, test it, and make it current. Your rotation function performs the credential-specific work. The deployment must connect that function through the Lambda adapter; a rotation request is rejected when the configured function cannot be reached. Cancelling rotation stops the run but leaves the pending label for the caller to resolve. Resource-policy operations store, return, delete, and validate the AWS policy document. Validation checks syntax, public access, and policies that would lock every caller out of policy administration. Those operations are distinct from complete resource-policy enforcement: the endpoint authorizes the authenticated principal, and target-store access uses the deployment's cloud identity. Review effective permissions when resource policies grant cross-account access or impose restrictions beyond the principal's permissions. #### Target storage, encryption, and replication The customer deployment stores the secret entirely in the adapter's durable state. This configuration creates no additional Kubernetes Secret. Version history and reads use the same secret record as cloud-backed deployments. All versions and labels remain in the adapter's durable state. Protect that state store and its backups; no separate cloud secret copy is configured. Encryption follows the deployment's storage and key configuration. The adapter retains `KmsKeyId` as metadata. Protect the durable state and configure any target copy to meet the workload's encryption-key requirements. Replication requests maintain region configuration in the secret record. They do not by themselves establish a second physical copy or disaster recovery in another region. Configure and verify geographic replication of the underlying storage separately. This adapter serves primary secret records; `StopReplicationToReplica` does not promote an independent regional replica. Storage durability, encryption, backups, and recovery depend on the appliance's state store. A Kubernetes namespace or an external synchronization controller does not provide that history. #### Cutover and ongoing operation Create the target deployment, load the required values through the Secrets Manager API, and verify current, previous, and explicitly versioned reads before switching the application. Existing provider values and their history are not automatically imported into the adapter's record. Test credential rotation with the real database or API it updates, including a failed test step and a retried callback. Verify deletion and restore behavior before relying on the recovery window. The customer controls access to secret state, rotation-function permissions, backup retention, and monitoring. [Service Catalog](/service-adapters/catalog).