I am thinking about using a vps on a hosting provider that does not offer cloud services like kms, or vpc on for example AWS for a webapp. The webapp will need to encrypt some sensitive data in the database.
When comparing the vps and vpc, vpc does have key management services, such as AWS KMS, which safely stores and rotates the keys.
For the vps, the only thing I can think of is to save the keys in a dotenv file. This means that they are not rotated and will be found in plain text if the vps gets hacked.
Have I understand above correctly and is using a vps then considered insecure comparing to a vpc with key service, or am I missing something?