code: public static Config resolveEncrypted(Config config, Optional<String> encConfigPath) {
      if (!encConfigPath.isPresent() || !config.hasPath(encConfigPath.get())) {
        return config;
      }
  
      Config encryptedConfig = config.getConfig(encConfigPath.get());
  
      PasswordManager passwordManager = PasswordManager.getInstance(configToProperties(config));
      Map<String, String> tmpMap = Maps.newHashMap();
      for (Map.Entry<String, ConfigValue> entry : encryptedConfig.entrySet()) {
        String val = entry.getValue().unwrapped().toString();
        val = passwordManager.readPassword(val);
        tmpMap.put(entry.getKey(), val);
      }
      return ConfigFactory.parseMap(tmpMap).withFallback(config);
    }
docs: Resolves encrypted config value(s) by considering on the path with "encConfigPath" as encrypted.
  (If encConfigPath is absent or encConfigPath does not exist in config, config will be just returned untouched.)
  It will use Password manager via given config. Thus, convention of PasswordManager need to be followed in order to be decrypted.
  Note that "encConfigPath" path will be removed from the config key, leaving child path on the config key.
  e.g:
  encConfigPath = enc.conf
  - Before : { enc.conf.secret_key : ENC(rOF43721f0pZqAXg#63a) }
  - After  : { secret_key : decrypted_val }
  
  @param config
  @param encConfigPath
  @return