Include sensitive environment variables to AWS EB Django app

Question

I am deploying a django app to AWS Elastic Beanstalk and initially I am defining my environment variable in .ebextensions/django.config

Some of those variable are sensitive and I don't want to push them to Git, so I want to encapsulate those variables in a single file (for example: .env) that will not be pushed to Git.

Plan A:

A way to include .env in my config file, but I didn't find a way to do it supposedly like:

option_settings:
  aws:elasticbeanstalk:application:environment:
    include .env
  aws:elasticbeanstalk:container:python:
    WSGIPath: mydjangoapp.wsgi:application

Cons:

The environment variables are shown as plain text in AWS console at Elastic Beanstalk > Environments > my-environment > Configuration > Environment properties, although I know the fact that they are only readable by the authorised AWS users who have permission to it.

Pros:

Ability to update only and directly the environment variables from AWS console without requiring new deployment.

Plan B:

Nearly same as plan A, but without including .env file in config file. It is by using eb setenv to set the sensitive environments, but it is should be typed explicitly one-by-one, not from an external file, so it is headache if they are a lot

Plan C:

Remove the sensitive variables at all from my config file and load the .env file from my django app itself.