Glossary
Managing passwords, keys and credentials outside of code and configuration files.
Managed services such as AWS Secrets Manager or Parameter Store deliver credentials at runtime, log every access and allow rotation without a new deployment.
The gain is less in storing than in rotating: a key that cannot be swapped without a deployment will not be swapped when it matters.