Secret keys should not be stored unencrypted in the environment variables. With AWS Secrets Manager the variables can be encrypted.