Anther solution is to store secrets in the Terraform state and use a secured state backend (eg: S3+KMS) to share them. It makes key sharing and rotation a bit easier while not promoting copy-and-paste.

You can use the "random" provider to generate secrets, the "tls" provider to generate certs and I also wrote a "secret" provider[1] to hold arbitrary secrets.

The best part is that it doesn't require to maintain a long-running process. For small shops it's a good upgrade over storing credentials in code or using git-crypt.

[1]: https://github.com/tweag/terraform-provider-secret