Storing private keys in cloud providers enviroment variables
If the private keys are visible to you on your AWS account, then they'd be visible to anyone who has your session tokens (i.e. if a hacker would simply need to take your cookies to view the keys). So it's not only the cloud provider you'd need to worry about.
Always best to sign transactions on your own node which has no connection to your online accounts. You can build the transaction on your app, and send it off to be signed on your own server.
BitGo has some cool functionality that allows admin-approved transactions and multisig.