How to storing encrypted secrets in code for a serverless.com project?
There are a couple of elements to consider here:


It is valuable to have the capability to maintain configuration with a separate release cadence from the code that is being configured. Doing so encourages rotation of credentials in an automated manner, do it regularly make it painless.  
It is entirely reasonable from an "Infrastructure as Code" point of view to store all configuration in Git, albeit probably in a different repository as the scope of configuration is likely to span more than one service.
Assuming both of the above statements are relevant to your situation, I would be inclined to encrypt the data with KMS and store it in S3 or DynamoDB.  I would even go so far to say that in very simple situations it might be suitable to encrypt and store the data within KMS itself.


There are several open source libraries that will support this operation:


Python: CredS3
Go: Sneaker