Storing private keys in cloud providers enviroment variables Is it ok to store private keys in cloud provider (such as AWS, Firebase) secrets (enviroment variables) in cloud functions (such as lambdas or firebase cloud functions)?
I understand I would be trusting the safety of the funds in that address to the cloud provider, but I can't see another solution since I am building an application that has to sign bitcoin transactions from that address.
If the private keys are visible to you on your AWS account, then they'd be visible to anyone who has your session tokens (i.e. if a hacker would simply need to take your cookies to view the keys). So it's not only the cloud provider you'd need to worry about.
Always best to sign transactions on your own node which has no connection to your online accounts. You can build the transaction on your app, and send it off to be signed on your own server.
BitGo has some cool functionality that allows admin-approved transactions and multisig.