Support encrypting sensitive config and per stage

I need to store sensitive data (e.g. passwords) for use by lambda. I'm currently planning on doing this by using a custom config file, but I see that Lambda supports KMS. Ideally I'm looking for a way that allows me to locally encrypt this data as well so I can safely store everything in my git repo (for example how ansible has a command to encrypt secrets using `ansible vault`) without adding extra tooling.

I plan on using separate accounts per stage to fully segregate my resources, so it'd useful if there was support for `config-.json` files as well. Doing that could allow these stage-specific config files to be encrypted separately per stage. It could require a password to decrypt the config for whichever stage while running/deploying.

Have you given any thought to how to handle encrypted config, and then push it up to lambda so it's encrypted there as well?