I think a related idea is that instead of passing secrets to a cloud application directly in configuration or environment names, it's better to pass the _name or the ARN of secrets_, which the application can use to fetch the actual secrets from the Secrets Manager service.