Second, if it's a major change, I might begin with a clean slate, instead of trying to make sweeping changes to the existing environment.
Configuration management (CM) isn't something to add at the end. I tend to use AWS SecretsManager to store a .env file for each "environment" and "role" - like staging.env and production.env, and staging.webapp.env and production.webapp.env. The files can be requested and loaded during the initialization phase (startup) of a container or server or service.
And security is important to consider at the beginning as well. Bastion hosts, deployment strategies, network security (firewalls and open ports), and user management (IAM) must be considered.
ChatGPT is pretty good at helping with such tasks, but it does hallucinate frequently so keep the CloudFormation documentation open and refer to it often.