The question, of course, is how we can use this within our application; the answer is the inverse of what we just did. Now that we have an encrypted variable, our application code will need to read that value and decrypt it. Nothing changes from the standpoint of using environment variables. All that has changed now is that our sensitive variables are no longer stored in plain text anywhere within AWS.
After setting the DB_PASSWORD environment variable to this new encrypted string and redeploying, we can verify that the Lambda console is no longer storing the supersecret password. The following screenshot shows the value for the DB_PASSWORD variable from the AWS Lambda page for my function:
In order for our Lambda functions ...
