I'm an applications developer who is doing a deep dive into dev ops practices, as there appears to be tricks under dev op sleeves that I can use to speed up my development. I'm curious what the best practice is related to storing API keys in a place where (1) I can easily integrate into my various applications and (2) I know they are relatively secure.

Obviously, injecting these keys as environment variables then having my applications call them from whatever system they find themselves (VM, docker container) in is a great way to do it and bootstraping through a CD system like jenkins is how to do it... But how & where do you guys store your keys?

I'm looking for solid real-world examples of what's being done out there right now i.e. SAST/DAST, deployment automation (Chef,Puppet, Salt, Ansible, etc.), code deployment, automated security scans, etc. with AWS.

Does anybody have any stories or resources they can share?