Maybe use just the vault gem that only depends on aws-sigv4 and aws-eventstream?
What do you mean by “safely” here? What is the Threat model - Wikipedia ? Are you trying to protect it from Admins with Data Explorer access? In that case using a simple ENV variable should be easier.