alternative to storing api keys in migration yaml files? I've created a yaml file to import Twitter timeline items (not super simple since documentation on the migrate_plus OAuth plugin seems to be few and far between); this migration naturally requires the use of ostensibly-secret API information. I'd like to keep this out of the yaml and I've seen answers (like this one) that talk about setting things in code, but I'm wondering if there's another customer-serviceable way. For example, here's my config file, called migrate_plus.migration.migrate_sample_twitter:

id: migrate_sample_twitter
label: Sample Twitter Migration
dependencies:
  - migrate
  - migrate_plus
status: true

source:
  plugin: url
  data_fetcher_plugin: http
  authentication:
    plugin: oauth2
    base_uri: 'https://api.twitter.com'
    token_url: /oauth2/token
    grant_type: client_credentials
    client_id: &lt;twitter app consumer key&gt;
    client_secret: &lt;twitter app consumer secret&gt;

  urls: https://api.twitter.com/1.1/statuses/user_timeline.json?screen_name=tmountjr

  fields:
    -
      name: id
      label: Tweet ID
      selector: id_str

destination:
  plugin: table
  table_name: twitter_import
  id_fields:
    id:
      type: string


Now, running drush cget migrate_plus.migration.migrate_sample_twitter drops all that information on the console, which is fine. BUT, I'm unable to retrieve any information deeper than that. What I was hoping to do was, in my settings.local.php, specify this:

$conf['migrate_plus.migration.migrate_sample_twitter.source.authentication.client_id'] = 'consumer key here'
$conf['migrate_plus.migration.migrate_sample_twitter.source.authentication.client_secret'] = 'consumer secret here'


...and then just omit the client_id and client_secret keys from the yaml file. But that doesn't seem to work; when I make those changes and run drush migrate-status I get an error: The config is missing the following key: "client_id".

So short version of this question: is there any way to omit values from an exported yaml file and instead have those values stored in a user-editable settings file that can be .gitignored from the repo?
In Drupal 8, If the migration is one that is a config entity (shows up in /config rather than in migrations/) values can be overridden in settings.php or environment specific settings.

// Set migration settings from environment variables.
$config['migrate_plus.migration.node_article']['source']['urls'] = [getenv('CMS_ARTICLE_API_URL') . '/services/articles/facilities/all'];
$config['migrate_plus.migration.node_article']['source']['headers']['apikey'] = getenv('CMS_ARTICLE_API_KEY');