Safely connect to remote site from cloud based code

Question

I am connecting my computer located at my home to a remote server.

To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the config file and sends a message containing the signature from the private key, the public key and the passphrase.

Now, I would like to run my code on the Cloud, for example AWS. I suppose it is not safe to store the config file on AWS, so what would be the correct way to connect safely from AWS to the remote server ?

Answer 1

The solution I use in the case of secrets (not only for your case, but also to make sure that I do not commit them with the code) is to put them in an environment variable when starting my code

$ API=kjsdhtgsdsdskdjsldjsldjklskjd /usr/bin/python3 mycode.py

It is not absolutely secure as the key is still in memory. It is also a pain to start the command with the secrets like this.

I usually end up adding the keys to the systemd service file I start my code with. It is in a file, but at least not together with the code.

Finally you can prompt for the keys at startup, which is not practical is the code is supposed to run headless.

The enterprise solution is a HSM, which is a glorified service to retrieve your keys from, based on some criteria.