How do I store API keys for a Vercel-deployed application?

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an AWS Secrets Manager secret to store the API key
const apiKeySecret = new aws.secretsmanager.Secret("apiKeySecret", {
    description: "API key for Vercel-deployed application",
});

// Store the actual API key value in the secret
const apiKeyValue = new aws.secretsmanager.SecretVersion("apiKeyValue", {
    secretId: apiKeySecret.id,
    secretString: pulumi.secret("your-api-key-value"), // Replace with your actual API key value
});

// Create an IAM Policy that grants read access to the secret
const secretAccessPolicy = new aws.iam.Policy("secretAccessPolicy", {
    description: "Policy to allow Vercel to access the API key secret",
    policy: apiKeySecret.arn.apply(arn => JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Action: [
                    "secretsmanager:GetSecretValue",
                ],
                Resource: arn,
            },
        ],
    })),
});

// Create an IAM Role for Vercel with the above policy attached
const vercelRole = new aws.iam.Role("vercelRole", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: {
                    Service: "vercel.com", // Replace with the actual Vercel service principal if available
                },
                Action: "sts:AssumeRole",
            },
        ],
    }),
});

new aws.iam.RolePolicyAttachment("vercelRolePolicyAttachment", {
    role: vercelRole.name,
    policyArn: secretAccessPolicy.arn,
});

// Export the secret ARN and IAM Role ARN for use in Vercel configuration
export const secretArn = apiKeySecret.arn;
export const vercelRoleArn = vercelRole.arn;