When creating new clusters, you can enable Transparent Data Encryption (TDE) to encrypt the data stored in your databases.
To secure the data encryption key, you can either enter a passphrase of your choice, or bring your own key from a key management provider such as HashiCorp Vault or AWS Key Management Service.
Note
TDE is available for EDB Postgres Advanced Server and EDB Postgres Extended Server for version 15 and later.
First, ensure the Key Management System provider of your choice has been enabled in the HybridControlPlane CR:
Then, configure your Key Management System provider:
If you plan to deploy clusters across multiple data centers or regions, see TDE across data centers for how TDE behaves for replica clusters and distributed high-availability clusters, and what to plan for when you use a customer-managed key per location.
KMS support
Integrate KMS with Hybrid Manager.
HashiCorp Vault key
Use a HashiCorp Vault key with Hybrid Manager.
AWS KMS
Learn about using AWS Key Management Service (KMS) with Hybrid Manager.
Azure KMS
Learn about using Azure Key Vault (KMS) with Hybrid Manager.
Google Cloud KMS
Use Google Cloud Key Management (KMS) with Hybrid Manager.
Deleting a key
Delete a KMS key with Hybrid Manager.