I realize that this is a somewhat old question so there's a decent chance you had a different problem, but the problem I had was that I missed where Datadog's documentation said that I needed to create a "plaintext secret".

Not knowing better I created my AWS secret as a key/value secret with an arbitrary key. It turns out that AWS stuffs a JSON blob into the environment variable if you do that. Instead when creating the AWS secret (if you're using the AWS web UI) make sure to select the "Plaintext" tab, delete the boilerplate JSON object, and paste in just your API key by itself.