I have deployed my Django application to Elastic Beanstalk with the intention of using its environment variable configuration interface to store my API keys instead of storing them in my source (as described here https://stackoverflow.com/a/17878600).
After doing this, I found out that what Beanstalk calls environment variables aren't actually shell environment variables (as mentioned here https://stackoverflow.com/a/24564832/378638) and are stored on the instance in a configuration file (as described here https://stackoverflow.com/a/24566283/378638).
This seems like a security issue to me. Doesn't this defeat the purpose of keeping the secret keys out of the source? I understand they are no longer in the repo, but they are still accessible on the instance.
Am I misunderstanding the risk? I am sysadmin by inheritance so please excuse my ignorance here. Should I just load the Beanstalk variables as shell environment variables via the configuration file and move on since the file is only accessible via root, or is my concern valid? Thank you.