Managing secrets in AWS Lightsail container service

Hello, I would like to host my backend application using the Lightsail container service using docker image and Github CI/CD (Build the image, push it to lightsail, create deployment). The application should have few secrets like RDS credentials, external services API keys etc. How can I manage those secrets? I know I can use environment variables when creating the deployment, but that doesn't seem secure, as those variables are visible as plain text in the console. That doesn't seem like the best approach.