We suggest that a possibility is added, to specify sensitive environment variables which will not be printed out by Terraform. We futher suggest to use the existing "sensitive" function from Terraform ...

See Amazon's documentation on creating a ZIP deployment package for a Java Lambda function; When creating your Lambda function in AWS Lambda console the handler for the given example would be entered ...