No description, website, or topics provided.
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.

Serverless Credentials Plugin

IMPORTANT NOTE: As pointed out in the AWS documentation for storing sensible information Amazon recommends to use AWS KMS instead of environment variables like this plugin.

serverless npm version license


npm install --save-dev serverless-secrets-plugin

After that you need to add the plugin to your serverless.yml of you service.

Run the command serverless --help and verify the list of commands contain an encrypt and a decrypt command.


Create a secrets.{stage}.yml file for each stage e.g.

Store the keys in there, that you want to keep private e.g.


You can also provide a path prefix if you like to keep your secrets in a different directory e.g.

  secretsFilePathPrefix: config

Encrypt the secrets file for the desired stage by running

serverless encrypt --stage dev --password '{your super secure password}'

This will result in an encrypted file e.g. You can check the encrypted file into your version control system e.g. Git. It's recommened to add your unencrypted file to .gitignore or similar so you and your colleagues can't check it in by accident.

In your serverless.yaml you can use the file variable syntax to import the secrets and set them as environment variables. When you create or update Lambda functions that use environment variables, AWS Lambda encrypts them using the AWS Key Management Service. Read more about that in the AWS documentation here.

Whenever you want to deploy there needs to be the unencrypted version of the secrets file available otherwise the plugin will prevent the deployment.


You can check out a full example in the Serverless Examples repository: serverless/examples/aws-node-env-variables-encrypted-in-a-file.