AWS KMS. Access is added invidually using IAM roles. That's it.