I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other sensitive info are stored as environment variables in plain text on the production machine.
Looking a little bit around I saw that most of the solutions are about limiting the access to these kinds of sensitive data (by storing them on a file with access granted only to the admin of the system), and to the access to the DB itself (by limiting the access only to fixed IPs).
Unfortunately none of them is possible in this case for a few reasons: the service that hosts the system DOES NOT allow us to have a IP (so I can not set the DB to be accessible only by one IP) and the DB credentials must remain in an environment variable for deployment reasons.
On the other hand, the DB is not actually containing sensitive data and, more in general, at the moment we are mostly worried about not having internal persons going through the production DB and causing damage, rather than external hacker attacks.
So my question is: what would be a "fairly safe solution" in this case?
Would it be a safe solution to encrypt the password for the DB and then store the decryption key on a config file uploaded on GitHub encrypted with this procedure (although it looks a little bit outdated)?
I thought this was a quite straight-forward and popular topic but apparently I was wrong, since looks like there are not many 'TODO-list' like answers.