Getting SSM secret for Firelens

[ruidc]

In my Sidecar, the following works:

    secrets:
      DD_API_KEY:
        secretsmanager: '${COPILOT_ENVIRONMENT_NAME}/${COPILOT_APPLICATION_NAME}/env:DATADOG_API_KEY::'

but for logging, I cannot find the right syntax:

logging:
  image: public.ecr.aws/aws-observability/aws-for-fluent-bit:stable
  enableMetadata: true
  secretOptions:
#    apiKey: '/myenv/myapp/env:DATADOG_API_KEY'
#    apiKey: arn:aws:secretsmanager:ap-southeast-2:myaccount:secret:myenv/myapp/env-ZpH4mj
    apiKey: 'arn:aws:secretsmanager:ap-southeast-2:myaccount:secret:env/myapp/myenv:DATADOG_API_KEY::'

[ruidc]

Seems it needs to be a plaintext secret whereas I was using key-value