In the configuration section of the Greeter lambda function, check the box for enabling helpers for encryption in transit and select the key that was just created, Greeter-Service-Encryption-Key.
Selecting that puts the ARN in the text box and enables an Encrypt button next to each environment variable row.
Clicking on that button masks the value of that variable: