How to use client side encryption for Postgres in a way that only the end user have access to their data?

Question

I have an App running on a cloud which stores data in a PostgreSQL. Since this App is aimed to be used by various different clients, I need a way to guarantee to them that they are the only ones that have access to their respective data, even when I am the one who manages the cloud services. The only way I found that this could be achieved is by means of client side encryption (please correct me if I am wrong).

I couldn't find information about achieve this goal with keys been stored locally (in the client). which service of AWS should I use in order to achieve my goal? Thanks

I couldn't find information about achieve this goal with keys been stored locally (in the client).
which service of AWS should I use in order to achieve my goal?
Thanks

Didier_Durand · Answer

Hi,

The AWS Database Encryption SDK seems provide what you ask for:

```
Working with multitenant databases

With the AWS Database Encryption SDK, you can configure client-side encryption for 
databases with a shared schema by isolating each tenant with distinct encryption materials. 
When considering a multitenant database, take some time to review your security requirements 
and how multitenancy might impact them. For example, using a multitenant database might 
impact your ability to combine the AWS Database Encryption SDK with another server-side encryption 
solution.
```

The documentation  starting point is here: https://docs.aws.amazon.com/database-encryption-sdk/latest/devguide/configure.html#config-multitenant-databases

This blog post implements the solution: https://aws.amazon.com/blogs/database/multi-tenant-data-isolation-with-postgresql-row-level-security/

Best,

Didier

How to use client side encryption for Postgres in a way that only the end user have access to their data?

Relevant content