Breaking the Key Management Cycle

Breaking the Key Management Cycle

I'm working on securing encryption keys in a software application. The common practice of storing encrypted keys in configuration files leads to the challenge of securely storing and accessing the decryption keys.

Two approaches I'm considering are:

1. Storing decryption keys in cloud services (AWS, Azure, Oracle OCI): This seems to require additional credentials (key pairs or IAM) to access the keys, raising the question of where to store those credentials securely.
2. Embedding decryption keys directly in the source code: This is often discouraged due to immutability concerns and increased risk of exposure.

I'm looking for guidance on best practices for managing decryption keys in this scenario. How do experienced developers typically address this challenge and avoid the recursive problem of securing the final key? Are there alternative approaches to consider that balance security and practicality?

Thank you!