It's secure to store private keys in AWS Secret Manager?

Question

I'm implementing a service that makes signs and sends transactions at the end of the day, this acts as a crypto exchange. The service creates for every new user a key pair (Private key with its public key). The user can deposit his funds to his respective public key (this is a hot wallet and he has no access to the private key of it) and the service must send these funds to a cold wallet at the end of the day. I'm looking for a solution to store these private keys safely using AWS infrastructure.

Reading the description of AWS Secret Manager, it says that it can store API keys, DB Credentials, or tokens OAuth, but it doesn't mention crypto private keys.

I found other solutions using Hashicorp, but I prefer a solution using any AWS solutions.

So, the questions are:

1. It's safe to store Private keys in AWS KMS or Secret Manager?
2. If not, is there a solution using AWS?

Answer 1

The whole point of AWS Secret Manager and KMS is to store secrets and keys, so I don't see why this would not be safe. However, the actual security of your implementation is likely to be dependent on how you use those services, and whether or not your code integrates those services safely.

Since your platform handles financial transactions, and I presume that your cryptocurrency wallet is not insured, your financial safety is determined solely by the security of your implementation. I would strongly recommend paying a security professional - preferably one experienced with these AWS services - to review your design and implementation. Recent history is littered with examples of exchanges being compromised and funds being stolen, due to security deficiencies in the exchange. The investment is almost certainly worth it.