There are a handful of other wrappers around AWS KMS to solve this problem - it seems like the best approach if you're already on AWS, no additional major infrastructure to manage. Thanks for sharing.