With serverless.com, the easiest way to expose a secret to an AWS Lambda function is to store it in the
serverless.yml file (encrypted with KMS, for example).
But committing encrypted secrets to Git is not the best thing in the world. Requires code changes when the secret has to change, for one thing.
But in terms of security alone, what are better alternatives? e.g. the secret could be stored in S3 (encrypted), with the Lambda given access to that location and KMS key, but is that actually better in any meaningful way?