Home icon

Things to consider when choosing between Oracle TDE and AWS KMS for encryption of data at rest for Amazon RDS for Oracle

Database Blog

This article provides a detailed comparison between Oracle Transparent Data Encryption (TDE) and AWS Key Management Service (KMS) for encrypting data at rest in Amazon RDS for Oracle databases.

  • AWS KMS offers full database encryption across all storage, backups, and replicas
  • Oracle TDE provides fine-grained, column or tablespace-level encryption
  • AWS KMS is available for all Oracle editions, while TDE requires Enterprise Edition
  • AWS KMS allows bringing your own keys and offers centralized key management
  • TDE requires additional licensing and has more implementation restrictions

The article recommends using AWS KMS for full database encryption, centralized management, and compliance requirements. Oracle TDE is suggested for selective encryption and specific regulatory needs.

Go to article

The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.

Related articles

May 20
2025
Amazon RDS for Oracle now supports credential management with AWS Secrets Manager for databases using Oracle multitenant architecture
Nov 21
2025
Oracle Database@AWS now supports AWS KMS integration with Oracle Transparent Data Encryption
Apr 13
2026
Options for changing AWS KMS encryption key for Amazon RDS databases
Mar 12
2024
Choose the right type of AWS KMS key to encrypt Amazon RDS and Aurora Global Database

The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.