Discussion on: How do you store private keys?

[Abdulla T]

I work with Serverless framework mainly, but it can apply to any serverless functions. Since I mostly use AWS, I store my secrets on Secret Manager. I use the same key (but different value) for both staging and production and when I deploy to any stage it will go look for the secret using that key regardless of the environment and retrieve the corresponding value. Note: each stage is a seperate AWS account, if you have different stages in the same account/region, then you might need to have different secret keys e.g. private_key_dev and private_key_production

Example:

Go to Secrets manager and create a new secret in the UI (or cli).. and call this secret "my_app_secrets". The object in this secret is key,value type of object. e.g
private_key: "secret_value"

And then in serverless.yml

custom:
   myAppSecrets: ${ssm:/aws/reference/secretsmanager/my_app_secrets~true}

functions:
 myFunctionWithASecret:
   handler: src/handlers.myFunction
   environment: 
     privateKey: ${self:custom.myAppSecrets.private_key}

There are also other ways for example if you are using a CI/CD tool like Jenkins you can use the Jenkins Credentials to store the secrets there especially for secrets to deploy the apps to the services.