[dossy]

How sensitive are the secrets? How often will you be rotating them?

Are the secrets sensitive enough to encrypt them at rest?

Keeping the lock (the encrypted secret) and the key (the decryption key) in two separate places makes it slightly harder for an attacker to recover the plaintext secret, but also means you need to take the necessary precautions to not leak the key accidentally.

Sometimes, we can't even trust our system to be secure enough to prevent the key from becoming compromised, so Hardware Security Modules (HSMs)[1] became a thing, something with, presumably, a smaller attack surface that holds the key and can be used to decrypt the secret.

[1]: https://en.wikipedia.org/wiki/Hardware_security_module