How can I safely grant users access to private environment variables like API secret keys while using AWS Lightsail containers?

Environment variables can be added when I make a deployment in AWS Lightsail containers. However, it doesn't appear to be particularly safe because all the secrets will be revealed when I open the deployment information.

The secrets of AWS Secret Manager must be accessible to AWS Lightsail containers in some way. Or at least a straightforward approach of addressing this with AWS Lightsail.

I'm attempting to grant AWS Lightsail access so it can retrieve secrets from AWS Secret Manager, but so far I've been unsuccessful.
I'm beginning to think that all I really need to do is launch an AWS Lightsail instance where all I do is offer a private GET endpoint and store the hidden environment variables. Since it communicates through the private network, this would be fairly safe. But that's so stupid. What if I need to run a second instance but it is not available?