To fix this, we can leverage another AWS service called Key Management Service (KMS). KMS works by encrypting data into a string that can only be decrypted using KMS itself. What's nice about using KMS is that you can then store, share, or even check into source control your encrypted variables, since nobody can decrypt them unless they have access to KMS. Your one attack vector here then becomes AWS and KMS itself. If anyone has permission to use your KMS key or can gain access to a privileged AWS account, they can decrypt any KMS-managed variable.
Azure has something similar called Key Vault, which is something you should look into if building on top of Azure. I'm unaware of a similar service within Google Compute or ...
