Part of the application I'm working connects to an instance using ssh. It requires a .ppk file which I've currently got stored in S3.

My concern is that it's not secure enough and I'm looking for a method in which to make it so.

I've considered encrypting the S3 bucket and allowing programmatic access only, the bucket and file location can be fed to app via env variables.

I really don't want to keep the file in the resources as anyone getting the jar cam unzip and obtain, same with hardcoded values in the codebase. Is this a safe way of storing this file? Would encrypting it be worth the additional steps?