Agree, also check out credstash[0], a very good and secure solution if you are running on AWS. Credstash is an small utility that encrypt with KMS and store the ciphertext of the datakey and secret on Dynamodb.

I configure my application roles to be able to decrypt with the master key and I restrict what ciphertext they can read from Dynamodb.

[0] https://github.com/fugue/credstash