This way, when things break or don't function how you like, you can easily copy the original config file back into position, restoring the original functionality.
Specifically AWS secrets manager, I know there's others like if you're using Ansible there's Ansible Vault. The point is that it's a separate service that keeps all your secrets encrypted at rest and to access them you need an initial authentication.
I tend to make a .bak file before changes. There is nothing worse than fixing one config item only to realize later something else broke and not being sure what it was that changed and no easy way to revert. I'm guilty of having many .bak configs that are poorly named. I hadn't heard of etckeeper before. That looks real handy for me. Thanks for sharing