moving cloud-secrets initalization up to universal for rouster/aws work