I have a process that needs secret keys to be passed as environment variables. That is for historical reasons.

I have a AWS machine where this process runs but I do not want to store these keys in files or scripts on the cloud.

What is the industry standard process for this situation? Do folks typically store the secret files under a username, lock it with standard unix file/user permissions, and hope for the best?

I thought about to somehow keep those secrets on a secure machine remotely and then start processes on the remote machine with the provided keys, passing them through ssh. For that I'd have to customize /etc/sshd/config to allow some of these environment variables to be passed in the environment. Is this safer?

Alternatively, I thought about starting these processes with crontab but then reach back home for the secrets.

As a third option I thought about storing these files as gpg encrypted files to be decrypted through ssh.

Am I being too stringent on my requirements?

Thank you,

  • Welcome to the community. Are you running bare metal, Docker, one of the Kubernetes variants, Hypervisors etc?.. Commented Mar 31 at 14:59

1 Answer 1


In AWS the best practice would probably be Key Management Service for cryptographic key material, and Secrets Management for other kinds of secrets, e.g. database tokens.

You'll have to decide if this is secure enough, based on a threat model you develop.

  • What would be the on-premises equivalent of AWS secrets management? Commented Mar 31 at 2:17
  • So I set up the AWS keys management. However when I went to use it - you have to use boto3 (in Python) and then you have to have the AWS keys configured. So it's like tying a dog with sausage. Commented Mar 31 at 2:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .