What’s encrypted with TDE?

TDE encrypts:

• The files underlying tables, sequences, indexes, including TOAST tables and system catalogs, and including all forks. These files are known as data files.

• The write-ahead log (WAL).

• Various temporary files that are used during query processing and database system operation.

The following aren’t encrypted or otherwise disguised by TDE:

• Metadata internal to operating the database system that doesn’t contain user data, such as the transaction status (for example, pg_subtrans and pg_xact).

• The file names and file system structure in the data directory. That means that the overall size of the database system, the number of databases, the number of tables, their relative sizes, as well as file system metadata such as last access time are all visible without decryption.

• Data in foreign tables.

• The server diagnostics log.

• Configuration files.