Around 100 lines of shell scripting and an encrypted S3 bucket that has a shared secrets .env file which is ignored from version control for each project.

IAM handles access control and the shell script makes it easy for folks to show, diff, download and upload secrets for a project.

When a secret gets changed it also sends a Slack notification so folks know to download the latest copy.

It costs practically nothing, is super easy to maintain and it keeps your app only needing to deal with environment variables.