It is best practice to not persist the secrets. However, our function might need some secrets to be long lived, such as database credentials and dependency service access keys. Because of this requirement, it is recommended that you encrypt these secrets. There are a few options available to us, such as using the lambda environment variable with encryption and the Amazon EC2 systems manager's parameter store.
Secrets should not be saved or persisted on memory. Instead, the function should retrieve temporary credentials and keep rotating them, revoking them from time to time. API interaction with the lambda function should be authenticated and authorized.
