<p>As far as I'm aware. There is no way to encrypt the environment variable value in the variables section of the lambda function. And to be fair, even if there was, it wouldn't provide any benefit in terms of keeping the variable secret. If the variable could be hidden/encrypted in the variables sections to be decrypted later, a user could simply execute the lambda function and print the results of the decrypted variable to stdout. </p>

<p>One approach could be to use <a href="https://aws.amazon.com/secrets-manager/" rel="nofollow noreferrer">aws secrets manager</a> to store and retrieve your secrets. You can then assign your lambda function a role to allow access to the secret store, and use <a href="https://aws.amazon.com/sdk-for-node-js/" rel="nofollow noreferrer">AWS SDK</a> to retrieve your value. </p>

CC BY-SA 4.0
2018-10-17T15:50:18.913Z
2018-10-17T15:50:18.913Z
Preston Martin
<p>I want to deploy AWS lambda written in NODEJS. And I have sensitive variables that can't be disclosed in AWS lambda variables section. Is there a way to deploy lambda with an encrypted variable which no one can see and can't be decrypted from the machine which was used to deploy the lambda. Only some other user who has the key should be able to decrypt the variable. </p>

<serverless>
Deploying lambda conceiving sensitive variables using serverless
Justin
# Deploying lambda conceiving sensitive variables using serverless

(Asked by: username_0 on 2018-10-15)

I want to deploy AWS lambda written in NODEJS. And I have sensitive variables that can't be disclosed in AWS lambda variables section. Is there a way to deploy lambda with an encrypted variable which no one can see and can't be decrypted from the machine which was used to deploy the lambda. Only some other user who has the key should be able to decrypt the variable.

**Tags:** serverless


---

## 1 answers

### Answer by username_1 on 2018-10-17. Score: 1

As far as I'm aware. There is no way to encrypt the environment variable value in the variables section of the lambda function. And to be fair, even if there was, it wouldn't provide any benefit in terms of keeping the variable secret. If the variable could be hidden/encrypted in the variables sections to be decrypted later, a user could simply execute the lambda function and print the results of the decrypted variable to stdout.

One approach could be to use [aws secrets manager](https://aws.amazon.com/secrets-manager/) to store and retrieve your secrets. You can then assign your lambda function a role to allow access to the secret store, and use [AWS SDK](https://aws.amazon.com/sdk-for-node-js/) to retrieve your value.


---

