npm install serverless-crypt --save

npm install serverless --save

provider:
  name: aws
  runtime: nodejs4.3
#  runtime: python2.7
plugins:
  - serverless-crypt
custom:
    cryptKeyId: ${env:AWS_KMS_KEYID}

serverless encrypt -n $SECRET_NAME -t $PLAINTEXT --save

serverless decrypt -n $SECRET_NAME

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:<your-account-number>:key/<your-key-id>"
            ]
        }
    ]
}

provider:
  name: aws
  runtime: nodejs4.3
#  runtime: python2.7
functions:
  hello:
    handler: handler.hello
plugins:
  - serverless-crypt
custom:
  cryptKeyId: ${env:AWS_KMS_KEYID}

serverless encrypt -n secret_name -t "This is a secret" --save

'use strict';
const slscrypt = require('slscrypt');
module.exports.hello = (event, context, callback) => {
  slscrypt.get('secret_name').then((txt) => {
    const response = {
      statusCode: 200,
      body: JSON.stringify({
        message: txt,
        input: event,
      }),
    };
    callback(null, response);
  });
};

import json
import slscrypt
def hello(event, context):
    body = {
        "message": slscrypt.get('secret_name'),
        "input": event
    }
    response = {
        "statusCode": 200,
        "body": json.dumps(body)
    };
    return response

serverless deploy

serverless deploy function -f $FUNCTION_NAME

serverless invoke -f $FUNCTION_NAME

{
    "body": "{\"input\": {}, \"message\": \"This is a secret\"}",
    "statusCode": 200
}