Docs

RDS for PostgreSQL

Data security

About TDE data encryption

This topic describes the details of TDE data encryption.

What is transparent data encryption TDE

The transparent data encryption TDE (Transparent Data Encryption) performs real-time I/O encryption and decryption on data files. Data is encrypted before being written to a disk and decrypted when being read into the memory from the disk. This function performs data-at-rest encryption at the database level. It prevents attackers from bypassing the database to directly read sensitive information from storage space, and users can use the TDE feature without modifying any applications.

Principle of transparent data encryption

term introduction:

Customer Master Key (CMK): the Customer Master Key (CMK) can be used to protect the Data Encryption Key (DEK).

Data Encryption Key (DEK): generated by the database for disk data encryption and decryption.

Encryption and decryption process:

All encryption and decryption operations of RDS for PostgreSQL instances are performed in memory.

Encryption: Business data is written into memory in plaintext, encrypted by the DEK (Data Encryption Key) in memory, and then the ciphertext data is stored on disk.

Decryption: When business data is read, the system first retrieves the CMK (Customer Master Key) from the KMS service, uses it to decrypt the DEK (Data Encryption Key), and then uses the decrypted DEK to decrypt ciphertext data on disk before returning plaintext data to memory for business access.

Preparations

Before using the TDE data encryption function, complete the following preparations:

TDE encryption is currently in invitation-only testing. You need to submit a ticket to apply for a trial.

The key management system service and cloud service hosted key management service are both enabled. For more information, refer to Enable key management system service and Enable cloud service hosted key management service.

Create a key. For more information, refer to Key Management Quick Start.

tip

The key created here only supports selecting SYMMETRIC_128 and SYMMETRIC_256 for key type, and only supports selecting ENCRYPT_DECRYPT for key usage.

Ensure the account used has STSAssumeRoleAccess and iam:CreateServiceLinkedRole permissions when enabling the TDE data encryption feature. For more information, refer to Manage users.

Fee description

The TDE data encryption feature is free. Using Key Management Service (KMS) and creating keys incurs KMS service fees. For billing details, refer to key management billing description.

Precautions

Disabling or deleting a custom KMS key, or renaming it, will cause PostgreSQL instances that use this key to malfunction.

The TDE data encryption feature only supports enabling on the Create instance page during instance creation. It does not support enabling on existing instances, and once the instance is created, manually enabling or disabling this feature is not possible.

Creating a PostgreSQL instance with TDE encryption also requires meeting the following conditions:

Compatible version is PostgreSQL 17 version.

Storage type is Local SSD disk.

instance region must be a region supported by the TDE data encryption feature.

PostgreSQL instances with the enable TDE encryption feature do not support upgrading the database major version.

Instances with the enable TDE encryption feature cannot serve as MPP cluster Coordinator or Worker instances.

If the PostgreSQL instance has read-only nodes, after enabling the TDE encryption feature, the read-only nodes inherit the primary node’s keys.

The TDE encryption feature only supports encrypting disk data; WAL logs are not supported for encryption.

After enabling the TDE encryption feature, when the instance is restored via backups to a new instance, the new instance also enables TDE encryption by default and inherits the key configuration from the source instance.

After an instance enables the TDE encryption feature, logical replication is not supported. Therefore, the instance cannot serve as the source database for DTS data migration or synchronization tasks.

After enabling TDE encryption, the number of scanned rows recorded in DBW audit logs may be inaccurate.

After enabling the TDE encryption feature, all table data is encrypted by default. If you do not need to encrypt the specified data table, you can add the USING heap parameter when creating the table. For example:

CREATE TABLE not_tde_table(...) USING heap；

Revoking the authorization and restarting the PostgreSQL instance will render the instance unavailable.

TDE data encryption feature is currently only available in the following regions:

Region name	Region ID
China (Beijing)	cn-beijing
China (Shanghai)	cn-shanghai
China (Hong Kong)	cn-hongkong
Asia Pacific (Johor)	ap-southeast-1
Asia Pacific (Jakarta)	ap-southeast-3
China (Beijing)-autodriving	cn-beijing-autodriving
China (Shanghai)-autodriving	cn-shanghai-autodriving

Next steps

If you need to use the TDE encryption feature, obtain trial qualification by submitting a ticket, then create a PostgreSQL instance and enable TDE encryption. For details, see Creating an instance.

Last updated: 2026.09.18 11:15:44