Encrypt database storage with a key you control

How to do it

Community PostgreSQL has no built-in encryption of its data files, so its docs point to file system or block encryption. Managed databases encrypt storage as a setting, often chosen only when the database is created. Pick your own key there rather than the provider's default key, so you can audit its use and destroy it. A hosted platform that offers no key choice still encrypts storage, so confirm that in its security documentation. Read replicas and snapshots copied to another region need a key in that region. The key lives in a key service with automatic rotation, as Keep encryption keys in a key service says. That rule holds the rotation period. Disk encryption stops a stolen disk or snapshot, not someone who can query the database. Fields whose leak causes serious harm also need Encrypt the most sensitive fields. One key per store lets you erase a retired store by destroying its key, as Erase retired databases and every copy does. Connections are encrypted as Force encryption on every managed service says.

Examples

Shell example

# AWS CLI as an example: expect no row with false or with a key you do not own
aws rds describe-db-instances --query "DBInstances[].[DBInstanceIdentifier,StorageEncrypted,KmsKeyId]" --output text
aws rds describe-db-snapshots --query "DBSnapshots[].[DBSnapshotIdentifier,Encrypted,KmsKeyId]" --output text
# Self-hosted: the device under the data directory
lsblk -f

Terraform example

resource "aws_db_instance" "orders" {
  identifier        = "orders"
  engine            = "postgres"
  storage_encrypted = true
  kms_key_id        = aws_kms_key.orders.arn
}

How to check

The listing below shows storage encryption on for every database instance and snapshot. Where the host allows it, each key ID is one of your own keys. On a self-hosted server, lsblk -f shows the data directory on a crypto_LUKS device or an encrypted volume.

Sources

• PostgreSQL encryption options
• NIST SP 800-57 Part 1 Rev. 5 Recommendation for Key Management
• GDPR Article 32 on security of processing

Related rules

• APS-57 Keep encryption keys in a key service in Application security
• APS-58 Encrypt the most sensitive fields in Application security
• DAT-35 Erase retired databases and every copy in Data and databases
• INF-33 Force encryption on every managed service in Infrastructure and environments