If you can modify role IAM, I'd start with SSM Parameter Store + KMS encryption for secret values. That is generally much cheaper since typical use fits in the

If you can modify role IAM, I'd start with SSM Parameter Store + KMS encryption for secret values. That is generally much cheaper since typical use fits in the free tier. They also recently added resource policies to parameters but I don't you have to opt in to the paid tier of offering--not sure how cost compared to Secrets for that.