Been running with this same setup in ECS for a few months now. We also partition by environment (in the key name), which works well with a minimal .env, and makes it super easy to manage/revoke credentials (as opposed to distributing .env files to team members and keep those up to date)