[Laravel + AWS]: Passing stored ENV variables into an EC2 container via an ECS deployment task results in the .env file being ignored

I'm working with a dockerized Laravel 8 website hosted on an ECS-managed EC2 instance.

Deployments are managed by AWS CodePipeline.

• The code is stored in GitHub.
• Production images are built by CodeBuild.
• An ECS service runs a production release task to push that prod image to alternating EC2 instances.

This works well. I'm having problems, however, altering how I provision environment variables to newly released containers. During early development these were provided in a static .env file, then generated in CodeBuild during the build stage, and are now specified in the deployment task as stored AWS Systems Manager variables.

The goal is to allow the automatic provision of env variables without storing secrets in the codebase or build artifacts, or having to SSH into containers, and that's achieved.

However, I'd still like to run php artisan key:generate in the build stage to create a new app key when the production site is released, rather than storing that statically in AWS.

The problem

Whenever I specify any environment variables in the ECS deployment task, any environment variables I have provided in the site's .env file (specifically, those built in the CodeBuild build stage) are ignored.

Here's a snippet of the relevant buildspec.yml section:

      build:
        commands: 
        - echo Building front-end assets...
        - npm run prod
        - echo Installing composer libraries...
        - composer install
        - echo Creating .env file...
        - touch .env
        - echo Generating app key...
        - php artisan key:generate

On release the site will throw a missing app key error, implying that php artisan key:generate failed - yet CodeBuild logging reports that it has succeeded. If I remove the environment variables from the ECS task then the generated app key is read correctly and the site works.

Illuminate\Encryption\MissingAppKeyException
No application encryption key has been specified.

It appears, basically, that if I want to provide some environment variables via ECS deployment task injection, I have to provide all environment variables that way, because any others will be ignored.

Any insights into why the ECS task environment variables method could result in the .env (or its contents) being ignored?