TDE encrypts data as it's written, so you can only enable it when you create a database cluster — you can't turn it on for data that already exists. Which path you need depends on whether you already have a cluster, and if so, what you want to do with it.
| Your scenario | Source database server | Target database server | See |
|---|---|---|---|
| You don't have a cluster yet | None (new cluster) | Encrypted Enterprise Postgres (Oracle Compatible) or Enterprise Postgres | Creating a new TDE-enabled cluster on self-managed infrastructure |
| Maintain the Postgres distribution and add encryption | Unencrypted Enterprise Postgres (Oracle Compatible) (a given major version) | Encrypted Enterprise Postgres (Oracle Compatible) (same major version) | Adding encryption and upgrading with pg_upgrade |
| Perform a minor upgrade and add encryption | Unencrypted Enterprise Postgres (a given major version, earlier minor version) | Encrypted Enterprise Postgres (same major version, later minor version) | Adding encryption and upgrading with pg_upgrade |
| Perform a major upgrade and add encryption | Unencrypted Enterprise Postgres (a given major version) | Encrypted Enterprise Postgres (a later major version) | Adding encryption and upgrading with pg_upgrade |
| Perform a major upgrade on an encrypted database | Encrypted Enterprise Postgres (Oracle Compatible) (a given major version) | Encrypted Enterprise Postgres (Oracle Compatible) (a later major version) | Adding encryption and upgrading with pg_upgrade |
| Maintain the Postgres distribution and rotate encryption keys | Encrypted Enterprise Postgres (Oracle Compatible) (a given major version) | Encrypted Enterprise Postgres (Oracle Compatible) (same major version) with new encryption keys | Adding encryption and upgrading with pg_upgrade |
| Change the community Postgres distribution to an EnterpriseDB PG distribution and add encryption | Unencrypted PostgreSQL (a given major version) | Encrypted Enterprise Postgres (Oracle Compatible) or Enterprise Postgres (same major version) | Migrating from PostgreSQL to Enterprise Postgres (Oracle Compatible) or Enterprise Postgres |
If you're choosing how to protect the data encryption key rather than which path to follow, see Protecting the data encryption key.