You all do know that AWS SSM Parameter Store exists, right? It’s literally a KV store explicitly for this purpose. Parameters are scoped by path, versioned, are have optional encryption at rest.<p>Like you’re using the AWS cli! It’s one call to <a href="https://docs.aws.amazon.com/cli/latest/reference/ssm/get-parameter.html" rel="nofollow">https://docs.aws.amazon.com/cli/latest/reference/ssm/get-par...</a> away.<p>It even has built in Ansible support <a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html" rel="nofollow">https://docs.ansible.com/ansible/latest/collections/amazon/a...</a> and can values can be rendered in Cloudformation templates natively.<p>Too hard? Maybe try Chamber <a href="https://github.com/segmentio/chamber" rel="nofollow">https://github.com/segmentio/chamber</a> It has support for multiple backends and can render secrets in lots of different formats.