title: How to encrypt Lambda variables Using cloudformation
body: <p>AWS CloudFormation template that includes a Lambda function with sensitive environment variables. I'd like to set up a KMS key and encrypt them with it</p>
  
  <p>Add basic cloudformation to encrypt the key even is ok with aws/lambda default encryption</p>
  
  <pre><code>  LambdaFunction:
              Type: AWS::Lambda::Function
              DependsOn: LambdaRole
              Properties:
                Environment:
                 Variables:
                   key: AKIAJ6W7WERITYHYUHJGHN
                   secret: PGDzQ8277Fg6+SbuTyqxfrtbskjnaslkchkY1
                   dest: !Ref dstBucket
                Code:
                  ZipFile:  |
                     from __future__ import print_function
                     import os
                     import json
                     import boto3
                     import time
                     import string
                     import urllib
                     print('Loading function')
                     ACCESS_KEY_ID = os.environ['key']
                     ACCESS_SECRET_KEY = os.environ['secret']
                     #s3_bucket = boto3.resource('s3',aws_access_key_id=ACCESS_KEY_ID,aws_secret_access_key=ACCESS_SECRET_KEY)
                     s3 = boto3.client('s3',aws_access_key_id=ACCESS_KEY_ID,aws_secret_access_key=ACCESS_SECRET_KEY)
                     #s3 = boto3.client('s3')
                     def handler(event, context):
                        source_bucket = event['Records'][0]['s3']['bucket']['name']
                        key = event['Records'][0]['s3']['object']['key']
                        #key = urllib.unquote_plus(event['Records'][0]['s3']['object']['key'])
  
                        #target_bucket     =  "${dstBucket}"
                        target_bucket = os.environ['dest']
  
                        copy_source = {'Bucket':source_bucket, 'Key':key}
  
                        try:
                          s3.copy_object(Bucket=target_bucket, Key=key, CopySource=copy_source)
  
                        except Exception as e:
                          print(e)
                          print('Error getting object {} from bucket {}. Make sure they exist '
                             'and your bucket is in the same region as this '
                             'function.'.format(key, source_bucket))
                          raise e
  </code></pre>
  
  <p>AWS CloudFormation template that includes a Lambda function with sensitive environment variables. I'd like to set up a KMS key and encrypt them with it</p>