---
title: "Encrypt database storage with a key you · Agent Wranglers"
url: https://agentwranglers.se/playbook/data/database-security/encryption-at-rest
id: DAT-80
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1210
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Encrypt database storage with a key you control

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Database security](https://agentwranglers.se/playbook/data/database-security.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: DAT-80
- Level: Required
- Chapter: [Database security](https://agentwranglers.se/playbook/data/database-security.md)
- Rule: Encrypt the storage of every database, replica and snapshot. Use a key from a key service you control wherever the host lets you choose one. A disk, snapshot or volume copied out of the account must be unreadable without that key.
- Check: The listing below shows storage encryption on for every database instance and snapshot. Where the host allows it, each key ID is one of your own keys. On a self-hosted server, `lsblk -f` shows the data directory on a `crypto_LUKS` device or an encrypted volume.
- Risk: Data leaked or lost
- How: Community PostgreSQL has no built-in encryption of its data files, so its docs point to file system or block encryption. Managed databases encrypt storage as a setting, often chosen only when the database is created. Pick your own key there rather than the provider's default key, so you can audit its use and destroy it. A hosted platform that offers no key choice still encrypts storage, so confirm that in its security documentation. Read replicas and snapshots copied to another region need a key in that region. The key lives in a key service with automatic rotation, as [Keep encryption keys in a key service](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/key-management.md) says. That rule holds the rotation period. Disk encryption stops a stolen disk or snapshot, not someone who can query the database. Fields whose leak causes serious harm also need [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md). One key per store lets you erase a retired store by destroying its key, as [Erase retired databases and every copy](https://agentwranglers.se/playbook/data/personal-data/retired-data-stores.md) does. Connections are encrypted as [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# AWS CLI as an example: expect no row with false or with a key you do not own
aws rds describe-db-instances --query "DBInstances[].[DBInstanceIdentifier,StorageEncrypted,KmsKeyId]" --output text
aws rds describe-db-snapshots --query "DBSnapshots[].[DBSnapshotIdentifier,Encrypted,KmsKeyId]" --output text
# Self-hosted: the device under the data directory
lsblk -f
```

### Terraform example

```hcl
resource "aws_db_instance" "orders" {
  identifier        = "orders"
  engine            = "postgres"
  storage_encrypted = true
  kms_key_id        = aws_kms_key.orders.arn
}
```

## Sources

- [PostgreSQL encryption options](https://www.postgresql.org/docs/current/encryption-options.html)
- [NIST SP 800-57 Part 1 Rev. 5 Recommendation for Key Management](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)
- [GDPR Article 32 on security of processing](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Related rules

- APS-57 [Keep encryption keys in a key service](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/key-management.md) in Application security
- APS-58 [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md) in Application security
- DAT-35 [Erase retired databases and every copy](https://agentwranglers.se/playbook/data/personal-data/retired-data-stores.md) in Data and databases
- INF-33 [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/data/database-security/encryption-at-rest">Agent Wranglers data and databases playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Encrypt backups](https://agentwranglers.se/playbook/data/database-security/encrypted-backups.md)
- [Database security](https://agentwranglers.se/playbook/data/database-security.md)