Transparent Data Encryption (TDE, AES-256 & Cloud KMS / HashiCorp Vault)

Protect data files, redo logs, and database backup dumps against physical theft or unauthorized extraction using AES-256 envelope encryption.

Target Compliance Frameworks

✓ PCI-DSS Req 3.4 & 3.5✓ SOC 2 Security✓ FIPS 140-3✓ ISO 27001 (A.10.1)✓ GDPR Art. 32

Key Security & Compliance Objectives

Transparent AES-256 disk encryption covering datafiles, temp storage, and write-ahead logs

Enforce encryption on all backup streams (pg_dump, pg_basebackup, RMAN, Percona XtraBackup)

Maintain master encryption keys (KEK) in dedicated KMS/HSM appliances separated from DB host

Zero-downtime key rotation policies matching regulatory compliance audit standards

Architecture & Operational Mechanism

Using Envelope Encryption, raw data pages are encrypted using Data Encryption Keys (DEK), which are in turn encrypted by a Key Encryption Key (KEK) managed in an isolated Hardware Security Module (HSM) or Cloud KMS.

Reference Configuration File

# PostgreSQL pgbackrest veya RMAN AES-256 Şifreleme
# /etc/pgbackrest/pgbackrest.conf
[global]
repo1-type=s3
repo1-s3-bucket=my-secure-db-backups
repo1-s3-endpoint=s3.eu-central-1.amazonaws.com
repo1-cipher-type=aes-256-cbc
repo1-cipher-pass=MY_STRONG_SECRET_ENCRYPTION_PASSPHRASE_FROM_VAULT

[main-cluster]
pg1-path=/var/lib/postgresql/17/main

Step-by-Step Implementation Guide

Sequential execution procedures for verified production rollout.

Block Storage Encryption (LUKS)

bash

Provision LUKS or Cloud Encrypted EBS/Persistent Disks for the main database mount point.

cryptsetup luksFormat /dev/sdb
cryptsetup luksOpen /dev/sdb pg_encrypted_data
mkfs.ext4 /dev/mapper/pg_encrypted_data
mount /dev/mapper/pg_encrypted_data /var/lib/postgresql/data

Encrypted Backup Streams

bash

Pipe logical backup stream through AES-256 encryption before streaming to cloud storage.

pg_dump -U postgres -Fc production_db | openssl enc -aes-256-cbc -salt -pbkdf2 -out production_db_$(date +%F).dump.enc -pass file:/etc/vault/backup_key.bin

Decryption & Recovery Validation

bash

Routinely verify that encrypted backups can be decrypted and restored cleanly.

openssl enc -d -aes-256-cbc -pbkdf2 -in production_db.dump.enc -pass file:/etc/vault/backup_key.bin | pg_restore -U postgres -d test_db

Production Best Practices

✓Never store decryption keys alongside backup files or in git repos; use HashiCorp Vault or Cloud KMS.
✓Enforce automated annual key rotation policies while ensuring backwards recovery of legacy cold archives.

Common Pitfalls & Anti-Patterns

⚠Losing encryption key files, resulting in permanent, unrecoverable data loss during disaster recovery.
⚠Leaving temp tablespace directories unencrypted, leaking sorted buffer blocks to cleartext disk.

Audit List Critical CVE Feed →