You are deploying an application that needs to access sensitive information.

Store the encryption keys in Cloud Key Management Service (KMS) and rotate the keys frequently

Inject the secret at the time of instance creation via an encrypted configuration management system.

Integrate the application with a Single sign-on (SSO) system and do not expose secrets to the application

Leverage a continuous build pipeline that produces multiple versions of the secret for each instance of the application.