Wanted to understand if this is a common and secure practice.

I have an application that has a lot of customer secrets (their API Keys, credentials).

We’ve reached a stage where AWS secrets manager is not proving to be cost-effective as the number of secrets are high.

Was wondering to encrypt the secrets and store them in a database (we use postgres already) and store only the AES keys in secrets manager or KMS (which can only be accessed by resources with the relevant permissions).

This way the costs for us can be significantly reduced.

Vault can be another option, but this is currently not in the tech stack of my company and may require a lot of time to take to production.

Storing the secrets in the DB using AES encryption at rest is a common practice? Anything to be wary of?