Set environmental variables for DATABASE|_URL

I want to set up a redash instance on AWS using the pre-baked amis.

What is the recommended (and most secure) way of injecting the needed env vars (POSTGRES_PASSWORD etc) ?