Migrate data to and from a TDE-enabled cluster

Select a documentation version:

This guide describes how to migrate data between transparent data encryption-enabled (TDE) and non-encrypted clusters using pg_dump and pg_restore.

Both migration directions—TDE to non-encrypted and the other way around—are supported and use standard PostgreSQL logical backup tools.

Logical migration using pg_dump decodes the encrypted data on-the-fly at the source and dumps it as unencrypted SQL statements. When you restore the data, the destination cluster writes the data according to its own encryption settings. The destination cluster encrypts the data if TDE is enabled, and it writes as plain text if TDE is disabled.

Before you begin

Migrate a TDE-enabled database to a TDE-disabled database

  1. Dump the database from the TDE-enabled database server to a file on the host.

    /usr/lib/postgresql/18/bin/pg_dump -U postgres -d DATABASE_NAME > /tmp/decrypted_dump.sql

  2. Start a TDE-disabled AlloyDB Omni server by following the instructions in Install AlloyDB Omni using RPM.

  3. Restore the dump file to the non-encrypted database server.

    /usr/lib/postgresql/18/bin/psql -U postgres -c "CREATE DATABASE DATABASE_NAME"
/usr/lib/postgresql/18/bin/psql -U postgres -d DATABASE_NAME < /tmp/decrypted_dump.sql

Migrate a TDE-disabled database to a TDE-enabled database

  1. Use pg_dump to dump the database from the non-encrypted database server.

    /usr/lib/postgresql/18/bin/pg_dump -U postgres -d DATABASE_NAME > /tmp/src_plaintext_dump.sql

  2. Start a TDE-enabled AlloyDB Omni server following the instructions in Create a TDE-enabled cluster.

  3. Restore to the TDE-enabled database server. The data is transparently encrypted as it is written.

    /usr/lib/postgresql/18/bin/psql -U postgres -c "CREATE DATABASE DATABASE_NAME"
/usr/lib/postgresql/18/bin/psql -U postgres -d DATABASE_NAME < /tmp/src_plaintext_dump.sql

What's next