Now that we have injected configuration parameters as environment variables, the next step is to encrypt them so that they don't exist in the plaintext format.
To achieve this, we will use the AWS KMS (Key Managed Service) mechanism to encrypt data in transit to mask the environment variable values that are entered.
AWS Lambda and KMS have a default integration that allows the data to be encrypted at rest. To mask the environment variables that we defined, we need to go a step further and enable the "encryption in transit". The following sections show how to achieve this.
