I'm creating an authorisation service, which does signing using a key.

For local development I was randomly generating a key on application start-up.

Now I'm deploying to the cloud (currently going with AWS), I'm refactoring this approach to be more robust / persistent.

The current idea I have is to generate some keys and dump these into environment variables - where the PRODUCTION private key would need to be handled with care / protected.

Because they'd be in environment variables, I'd use the PEM format.

At startup, I'd now load the keys from environment variables such as APPLICATION_SIGNING_KEY_PUBLIC/PRIVATE, parse the base-64 encoded bits and process the X509 thingy into Private/PublicKeys in memory.

Is this standard - or even acceptable? Are there any holes in this design?

  • 3
    Why not just use AWS Secrets Manager (or the equivalent in other clouds)? Jul 6, 2021 at 21:50
  • @PhilipKendall Because I did not know it exists - that was the point of this question Jul 7, 2021 at 16:24


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.