# Secret values stay in Secrets Manager. ARNs are pinned in locals.tf so the
# first bootstrap-plan does not need secretsmanager:DescribeSecret.