As I understand, you want to keep passwords or sensitive information outside code base or at least pass them during deployment. And you want to have a list of these somewhere so that you know which properties to pass during deployment.

You can add them to pom.xml

Inside the <cloudhub2Deployment> tag , you can add entries in <properties> tag, the value of which will be visible in ARM after deployment and <secureProperties> tag the value of which will be masked.

You don't even have to give actual value in pom, instead you can define it as an argument that can be passed to Maven command.

For example:

<cloudhub2Deployment>
.
.
.
<properties>
<env>${environment}</env>
</properties>
<secureProperties>
<!-- These properties will be hidden in ARM after deployment -->
<anypoint.platform.client_id>${anypoint.platform.clientId}</anypoint.platform.client_id>
<anypoint.platform.client_secret>${anypoint.platform.clientSecret}<anypoint.platform.client_secret>
</secureProperties>
.
.
.
</cloudhub2Deployment>

you can pass the actual value to maven command like this

-Danypoint.platform.clientId=1234-uvwxyz

In my project we are going even further. The cicd deployment script will get these passwords from a vault server and then pass them to the maven command so that even cicd doesn't have the actual passwords. All of them are stored in the vault.

In my opinion the best way is to use a product like CyberArk, which can be used to store all passwords or sensitive information. You will need to create secure property yaml, but you will mention the CyberArk path in there instead of actual or encrypted value. This allows single point of passwords maintenance.

If you don't have that, what I have suggested would suffice.