# Securing Environmental Variables

**URL:** <https://forum.serverless.com/t/securing-environmental-variables/6398>\
**Category:** Serverless Framework\
**Tags:** security\
**Created:** [November 8, 2018, 7:17pm UTC](https://forum.serverless.com/t/securing-environmental-variables/6398 "2018-11-08T19:17:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwerre](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jwerre/32/2727_2.png) [@jwerre](https://forum.serverless.com/u/jwerre)\
**Post date:** [November 8, 2018, 7:17pm UTC](https://forum.serverless.com/t/securing-environmental-variables/6398/1 "2018-11-08T19:17:57Z")

</div>

Hello,

I’m pretty new to Serverless so sorry if this has been asked a thousand time already.

I noticed that when I import SSM encrypted parameters as environmental variables in my serverless.yml ( `${ssm:secret~true}` ) they are compiled to plain text and placed in the Cloudformation template as well as in the Lambda Environmental variables for anyone to see. This feels like a pretty glaring security flaw. Is there a way to keep Environmental variables hidden and decrypted _at_ deployment?

I realize I could just load the SSM keys inside my Lambda handler but this would add additional time to each request which I’m trying to avoid.

### Update:

I found the [serverless-kms-secrets](https://github.com/nordcloud/serverless-kms-secrets) along with [this article](https://www.metaltoad.com/blog/how-to-encrypt-serverless-environment-variable-secrets-with-kms). These look promising but I’m still decrypting with each invocation which I’d like to avoid.