AWS - KMS

Encrypt:

aws kms encrypt --region="eu-west-1" --key-id xxx --plaintext file://secrets.json --output text --query CiphertextBlob | base64 --decode > secrets.encrypted.json

Decrypt:

aws kms decrypt --region="eu-west-1" --ciphertext-blob fileb://secrets.encrypted --output text --query Plaintext | base64 --decode > secrets.decrypted