PGEE Transparent Data Encryption: Architecture and Key Management
Date Published
What TDE protects
CYBERTEC PostgreSQL Enterprise Edition can encrypt database storage transparently so PostgreSQL reads and writes encrypted data files without application changes. TDE reduces exposure from stolen disks, copied volume snapshots, or raw database files. It does not replace TLS, access control, query auditing, application security, or encrypted backups. A logged-in database role still sees the data it is authorized to read.
The key command is part of availability
PGEE obtains the encryption key through an encryption-key command during initialization and startup. PostgreSQL cannot open encrypted storage when that command fails or returns the wrong key. Treat the command, its runtime dependencies, permissions, timeout, and error handling as production infrastructure. Never embed the key directly in world-readable configuration or automation logs.
Keep HA nodes consistent
Every Patroni node that may become primary must be able to retrieve the same active key for the encrypted cluster. A local script can work in a lab, but production should use a controlled key-management or hardware-security system with audited access and resilient availability. Test replica creation, restart, failover, and rebuild while the key service is healthy and while one key-service path is unavailable.
Separate keys from encrypted data
Do not store the only key copy beside the data directory, VM snapshot, or backup repository. Use separate administrative authority, encrypted escrow, documented recovery, and dual control for destructive key operations. Backups remain useless without the required key material, while a backup and its key stored together weaken the protection TDE was meant to provide.
Rotate and recover safely
Key rotation requires a vendor-supported procedure, a rollback plan, verified backups, and confirmation that replicas and restored environments can read the result. Test disaster recovery with the real key-retrieval path—not a temporary plaintext shortcut. Record key identifiers rather than key values in operational logs, and alert on retrieval failures, unauthorized attempts, and unexpected key changes.
Know the boundary
TDE is one layer in a defense-in-depth design. Combine it with least privilege, SCRAM authentication, TLS, network segmentation, secure backups, patching, and monitoring. Document which files and temporary artifacts are encrypted by the chosen PGEE configuration and validate the behavior against the exact licensed version before promising compliance coverage.