I have to generate ssh key pairs for multiple server instances, and keep the private keys in the same/other server for further automation tasks.

What are some ways to protect these keys in case of a hacking attempt?

Does [AWS Key Management Service](https://aws.amazon.com/kms/) can help to secure these key files, one possible solution I am thinking is to

1. Keep the private keys encrypted with AWS KMS and Keep the keep the key in database with the AWS key ID.

And then I will transmit the encrypted private key related to the automation server and then the decryption of Key happens in the automation server which calls aws for decryption and then use the plaintext ssh private key to authenticate with the instance.

Is this a viable approach? I feel like this is just an added layer of security rather than a solid solution. What are some approaches would help here?