I've used Pulumi in anger saving to S3 and Azure Blob storage. Both more or less "just work" once configured. There are a couple of things around stack references... which I'd have to dig out of code - but other than that its good.
The other things you may then want to do is to use a cloud provided key for your secrets - at which point things become tolerably secure (there are levels of risk - determining what is acceptable is very context dependent)