For AWS and GCP you can setup cross-project permissions. I've run a single project of secrets, which grants specific access to various service accounts