Best practice to store private key for containerized apps in the cloud

Question

I am a crypto investor. I am staking a coin but the smart contract requires the user to claim and restake the rewards by transacting a smart contract function every 24 hours. Currently I am doing it manually, which is wasting time. To my understanding, I can just write a program to call this smart contract function to claim and restake automatically. I am already doing similar things to fetch on-chain values (read contract) from Ethereum using Python, web3py, and that program was deployed to the cloud as a Docker container app. However if I want to do something that changes the state (write contract), I will need to provide the private key in order to sign the transaction. This raises a security concern because I am not sure about the best practice on how to store the private key securely.

I have the following proposals:

1. I can use a cloud instance, e.g. AWS EC2 and run my Python code there. I can use a .env file to store the private key and inject the private key only during runtime as an environment variable. Or I should totally avoid saving the private key to disk, and instead, just export the key as an environment variable via SSH shell. However, I doubt that even if the code is dockerized, maybe the private key is still accessible to AWS’s staff, and therefore still not secure?
2. Another approach is, I can use a Raspberry Pi which will be online 24/7 running scheduled cron jobs using my home network. But the only worry is the network downtime. Also, If the Raspberry Pi is connected to the Internet, I still hesitate to just save the private key as a plain text .env file even on an encrypted SD card. How should I encrypt that plain text secret file and make it accessible only to just one container?

Anyway, can you think of a better solution to this task? Or maybe I’d better ask, in general, what is the best practice to store the secrets if your container app needs to constantly sign digital signatures but at the same time it needs to be run on the cloud?

Pls help. Thx.

Answer 1

One option I can think of in regards to AWS is to use the secret store to keep the private key. You have to modify your code to load the key from the secret store and could use it than to sign the transaction.

AWS also has a KMS, which can sign transactions for you. But I am not sure if you can load your private key into the KMS and then sign the data. Use Key Management Service (AWS KMS) to securely manage Ethereum accounts: Part 1

Answer 2

For secure storage of private keys in containerized apps, you can set this up:

• Environment Variables: Inject private keys into containers at runtime via environment variables, avoiding hardcoding in images or source control.
• Secrets Management Tools: Use tools like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault for secure key storage, access control, and rotation.
• Orchestration Secrets: For Kubernetes or similar, utilize their secrets management features to securely handle private keys.
• Encrypt Data: Ensure private keys are encrypted both at rest and in transit.
• Principle of Least Privilege: Limit access to private keys to only those components that absolutely need it.
• Rotate Keys Regularly: Implement a routine for changing private keys to limit exposure from potential breaches.
• Monitor and Log: Keep an eye on private key usage and access patterns, but ensure sensitive details are not logged.

=> This repository could provide a good solution : https://github.com/JonathanOkz/web3-kms-signer