Encrypts all environment variables using the KMS key specified in env['aws_key_arn']. Much simpler to use as a utility in something like PyCharm with run configurations.

aws_var_encryption.py

#! /usr/bin/python
"""
Script to encrypt environment variables to their encrypted version.
    aws_key_arn - Resource ID # for aws encryption key.
        format: 'arn:aws:kms:us-east-1:123456789:key/711d0e6d-620c-47da-a2f6-7141eb8cbde4'
"""
import os
import boto3
from base64 import b64encode

keyarn = os.getenv('aws_key_arn')

kms = boto3.client('kms', region_name='us-east-1')

def encrypt_with_arn(value):
    return b64encode(kms.encrypt(KeyId=keyarn, Plaintext=value)['CiphertextBlob'])


# Encrypted versions for webform or code
print('\n'.join(sorted([f"{str(e).upper()}: {encrypt_with_arn(os.getenv(e))}" for e in os.environ.keys() if os.getenv(e)])))