Configuration

Suggest edits

Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above or EDB Postgres Extended Server version 15.2 and above, requires the following components:

Note

The EDB Postgres Advanced Server version 15.2 and above and EDB Postgres Extended Server version 15.2 and above, products will be referred to as EDB Postgres distribution. The specific distribution type will be dependent upon customer need or preference.

  • EDB Postgres distribution (15.2 or later)
  • Hashicorp Vault v1.13.3

Prerequisites

  • A running EDB Postgres distribution
  • Hashicorp Vault installed and deployed per your VM environment

Enable Hashicorp Vault Transit Secrets Engine

Note

You have to set your environment variable with Hashicorp Vault. If you receive this error message “Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client” you need to issue this in your command line export VAULT_ADDR="http://127.0.0.1:8200".

  1. After your Hashicorp Vault configuration is installed and deployed per the guidelines in the Hashicorp documentation, you will then need to enable the transit secrets engine.

  2. Assume root user.

  3. First set your two variables, your API address and token you receieved during installation and setup.

root@ip-172-31-50-151:/home/ubuntu# export VAULT_ADDR='http://127.0.0.1:8200'
root@ip-172-31-50-151:/home/ubuntu# export VAULT_TOKEN="hvs.D9lfoRBZYtdJY2t3lG3f6yUa"
  1. Before you enable the Transit Secrets Engine you can check your Vault Server status with vault status.
root@ip-172-31-50-151:/home/ubuntu# vault status
Key             Value
---             -----
Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.13.3
Build Date      2023-06-06T18:12:37Z
Storage Type    inmem
Cluster Name    vault-cluster-18a7ed39
Cluster ID      83012ee7-18f0-9480-e8b6-3ff02c285ba2
HA Enabled      false
  1. Type vault secrets enable transit.
root@ip-172-31-50-151:/home/ubuntu# vault secrets enable transit
Success! Enabled the transit secrets engine at: transit/
  1. Next you will create your encryption key with an identifiable name. For example: vault write -f transit/keys/pg-tde-master-1
root@ip-172-31-50-151:/usr/lib/edb-pge/15/bin# vault write -f transit/keys/pg-tde-master-1
Success! Data written to: transit/keys/pg-tde-master-1
  1. You now have your encryption key set and are ready to export your WRAP and UNWRAP commands and initialize your database.

Could this page be better? Report a problem or suggest an addition!