[vasco]

We're using Ansible which means we use ansible-vault to store secrets. We store the encrypted files in S3 and decrypt them on deploy as needed.

[kkamperschroer]

So if you potentially need to roll a secret you would just run your deployment playbook limited to the secrets task?