[this-pony]

This sounds like a turtles all the way down kind of think... Then is it OK to keep the secret of the secrets service, or something in that sense.

[dfee]

The idea is that you keep the name of the secret, and grant access to the secret manager via roles / policies which are generally open to devs on a subnet for a development environment but locked down in production environments.