At Zemanta, we developed py-secretcrypt[0] and go-secretcrypt[1] for keeping secrets encrypted with Amazon KMS (Key Management Service) in our repos. They are then decrypted on the fly by the application.<p>Access control is managed through AWS KMS key policies, with EC2 instances running the applications having permissions to decrypt the secrets.<p>Blog post about this will follow soon.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;py-secretcrypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;py-secretcrypt</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;go-secretcrypt" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Zemanta&#x2F;go-secretcrypt</a>