How to encrypt AWS Lambda environment variables using CloudFormation

Question

I am working on a CloudSormation AWS template that includes a Lambda function with sensitive environment variables. I would like to create a KMS key and encrypt them using this, which is easy to do in the console, but very difficult to do in CloudFormation.

Can I host a CloudFormation JSON base object for Lambda with at least one environment variable that is encrypted using a KMS key, as well as JSON to create this key?

Answer 1

, AWS serverless-application-model : https://github.com/awslabs/serverless-application-model/issues/48

CloudFormation. KMS CloudFormation, . : http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html

KMS Key -, KmsKeyArn .