Such as: https://cloud.google.com/secret-manager (beta). Maybe auth the CLI through OAuth? See: https://javascript-conference.com/wp-content/uploads/2019/02/Building_an_OAuth_Flow_in_a_Nodejs_CLI.pdf