index.js
function decrypt(env, callback) {
  if (!env.AWS_DEFAULT_REGION) return callback(new Error('AWS_DEFAULT_REGION env var must be set'));
  var kms = new AWS.KMS({
    region: env.AWS_DEFAULT_REGION,
    maxRetries: 10
  });
  var q = queue();
  for (var key in env) {
    if (!(/^secure:/).test(env[key])) continue;
    q.defer(function(key, val, done) {
      kms.decrypt({
        CiphertextBlob: new Buffer(val, 'base64')
      }, function(err, data) {
        if (err) return done(err);
        done(null, { key: key, val: val, decrypted: (new Buffer(data.Plaintext, 'base64')).toString('utf8') });
      });
    }, key, env[key].replace(/^secure:/,''));
  }
  q.awaitAll(function(err, results) {
    if (err) return callback(err);
    callback(null, results);
  });
}
function decrypt(env, callback) {
  if (!env.AWS_DEFAULT_REGION) return callback(new Error('AWS_DEFAULT_REGION env var must be set'));
  var kms = new AWS.KMS({
    region: env.AWS_DEFAULT_REGION,
    maxRetries: 10
  });
  var q = queue();
  for (var key in env) {
    if (!(/^secure:/).test(env[key])) continue;
    q.defer(function(key, val, done) {
      kms.decrypt({
        CiphertextBlob: new Buffer(val, 'base64')
      }, function(err, data) {
        if (err) return done(err);
        done(null, { key: key, val: val, decrypted: (new Buffer(data.Plaintext, 'base64')).toString('utf8') });
      });
    }, key, env[key].replace(/^secure:/,''));
  }
  q.awaitAll(function(err, results) {
    if (err) return callback(err);
    callback(null, results);
  });
}
function decrypt ( env , callback ) { if ( ! env . AWS_DEFAULT_REGION ) return callback ( new Error ( 'AWS_DEFAULT_REGION env var must be set' ) ) ; var kms = new AWS . KMS ( { region : env . AWS_DEFAULT_REGION , maxRetries : 10 } ) ; var q = queue ( ) ; for ( var key in env ) { if ( ! ( / ^secure: / ) . test ( env [ key ] ) ) continue ; q . defer ( function ( key , val , done ) { kms . decrypt ( { CiphertextBlob : new Buffer ( val , 'base64' ) } , function ( err , data ) { if ( err ) return done ( err ) ; done ( null , { key : key , val : val , decrypted : ( new Buffer ( data . Plaintext , 'base64' ) ) . toString ( 'utf8' ) } ) ; } ) ; } , key , env [ key ] . replace ( / ^secure: / , '' ) ) ; } q . awaitAll ( function ( err , results ) { if ( err ) return callback ( err ) ; callback ( null , results ) ; } ) ; }
Private decrypt function that does not scrub output. Not exposed as a public API.

@param {object} env Object with variables to decrypt.
@param {function} callback Callback function.
Private decrypt function that does not scrub output . Not exposed as a public API .