Comment by TrickardRixx

Sounds to me like a configuration-driven interface with the password manager is the appropriate solution here, then. I used this pattern to write config files out of secrets stored in SSM, which previously was ad-hoc secret sharing. FWIW I would never use Sendenv.