How should I handle keys in production

Question

I'm creating an authorisation service, which does signing using a key.

For local development I was randomly generating a key on application start-up.

Now I'm deploying to the cloud (currently going with AWS), I'm refactoring this approach to be more robust / persistent.

The current idea I have is to generate some keys and dump these into environment variables - where the PRODUCTION private key would need to be handled with care / protected.

Because they'd be in environment variables, I'd use the PEM format.

At startup, I'd now load the keys from environment variables such as APPLICATION_SIGNING_KEY_PUBLIC/PRIVATE, parse the base-64 encoded bits and process the X509 thingy into Private/PublicKeys in memory.

Is this standard - or even acceptable? Are there any holes in this design?

• Philip Kendall: Why not just use AWS Secrets Manager (or the equivalent in other clouds)?
• Tobi Akinyemi: @PhilipKendall Because I did not know it exists - that was the point of this question