In the past I've used Hashicorp Vault to handle this kind of situation. Granted, it's an additional piece of infrastructure to manage but Vault has been pretty solid for this kind of situation and others where you need to safely manage secrets.