These options help you work with transparent data encryption when using pg_waldump and pg_resetwal on a TDE-encrypted cluster. See Working with encrypted WAL files for usage examples.
pg_waldump
Option: --data-encryption
Specify this option if the WAL files were encrypted by transparent data encryption. Without it, pg_waldump can't detect whether WAL files are encrypted.
Supported values
You can optionally specify the same AES key length you used during cluster initialization, in the form --data-encryption[=KEYLEN]. Otherwise, run the flag with no value. See initdb TDE options for more information.
Option: --key-file-name=<file>
References the file that contains the data encryption key required to decrypt the WAL file.
Supported values
<file> is the location of the pg_encryption/key.bin file generated when you initialize a cluster with encryption enabled.
Option: --key-unwrap-command=<command>
Provides the command to unwrap (decrypt) the data encryption key. It must be the same unwrap command you specified when initializing the cluster.
Supported values
<command> is customizable, but it must contain the placeholder %p, which specifies the file to read the wrapped key from. The command must write the unwrapped key to its standard output. Use the special value - if you don't want to apply any key unwrapping command. See Choosing a key protection mechanism for more information.
If you don't use this option, pg_waldump falls back on the environment variable PGDATAKEYUNWRAPCMD.
pg_resetwal
Option: --key-unwrap-command=<command>
Works the same way as for pg_waldump, earlier on this page.
If you don't use this option, pg_resetwal falls back on the environment variable PGDATAKEYUNWRAPCMD.