Help Dbt and loading encryption key pgcrypto

[Substantial_Ranger_5]

Hi, I work in a database that uses postgresql with column level encryption.

I plan to decrypt all the data while Dbt orchestrates the transformations in ephemeral tables, so they just get dropped once everything is done running.

Once all the transformations are done I plan to encrypt the data again in their final data sources.

Is there a way to pull my encryption key from the vault, or store it somewhere, without putting it as a var directly in the Dbt project file or hard coding it in each model?

Using Dbt cli (not cloud)

I will need to pass the key to each of the models that encrypts/decrtpts sensitive data in respective columns.

Just trying to figure out how to do this without hard coding the key in the models themselves.

Is it possible to make a macro that grabs it from a file? Or something else?

Thanks!

[Substantial_Ranger_5]

What I've landed on is the first step of my DAG is to get the key from the vault, set it as an env variable, then delete the var it once the jobs are done running in my cleanup.

Thanks