0

I'm creating an authorisation service, which does signing using a key.

For local development I was randomly generating a key on application start-up.

Now I'm deploying to the cloud (currently going with AWS), I'm refactoring this approach to be more robust / persistent.

The current idea I have is to generate some keys and dump these into environment variables - where the PRODUCTION private key would need to be handled with care / protected.

Because they'd be in environment variables, I'd use the PEM format.

At startup, I'd now load the keys from environment variables such as APPLICATION_SIGNING_KEY_PUBLIC/PRIVATE, parse the base-64 encoded bits and process the X509 thingy into Private/PublicKeys in memory.

Is this standard - or even acceptable? Are there any holes in this design?

Improve this question
2
  • 4
    Why not just use AWS Secrets Manager (or the equivalent in other clouds)?
    – Philip Kendall
    Jul 6, 2021 at 21:50
  • @PhilipKendall Because I did not know it exists - that was the point of this question
    – Tobi Akinyemi
    Jul 7, 2021 at 16:24

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.