What's the "Best Practice" approach for disabling secure pages on local Dev? Wondering what the "best practice" approach would be for disabling secure pages on local dev. I'm running a site on Acquia Cloud and have access to the environment variable AH_SITE_ENVIRONMENT and I could easily do something like: 

if (isset($_ENV['AH_SITE_ENVIRONMENT'])) {
  switch ($_ENV['AH_SITE_ENVIRONMENT']) {
    // case 'dev':
    //   // do something on dev
    //   break;

    // case 'test':
    //   // do something on staging
    //   break;

    case 'prod':
      // do something on prod
      break;
  }
}
else {
    $conf['securepages_enabled'] = 0;
}


Is that the best approach or is there a better, cleaner way? Also, are there negative implications for filling up settings.php with stuff like this?
It's a best practice to create a settings.local.php file which is included at the end of the default settings.php file. Then within that file you can place whatever logic you want per server as you've done, or make the content of settings.local.php be specific per server host you're deploying too (and keep settings.local.php basically outside of version control).

This is a good practice for Drupal 7 development -- so good in fact Drupal 8 ships with such code in settings.php by default, which you can uncomment to make use of:

/** In settings.php for a drupal 8 site */

/**
 * Load local development override configuration, if available.
 *
 * Use settings.local.php to override variables on secondary (staging,
 * development, etc) installations of this site. Typically used to disable
 * caching, JavaScript/CSS compression, re-routing of outgoing emails, and
 * other things that should not happen on development and testing sites.
 *
 * Keep this code block at the end of this file to take full effect.
 */
# if (file_exists(__DIR__ . '/settings.local.php')) {
#   include __DIR__ . '/settings.local.php';
# }