terraform-provider-sealedsecret You probably don't want to use this. Bits of code borrowed from here.