Elastic beanstalk and env variables

With above constraints, a possible option is to then use SSM Parameter Store secure strings.

It tends to be generally cheaper than Secrets Manager. To decide whether that cheaper is enough for you to choose it over Secrets Manager, you can look at its price under the "Paramster Store" sub section: https://aws.amazon.com/systems-manager/pricing/

Refer to this article to learn about SSM parameter store secrets strings: https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html