Store secrets outside of Terraform code and have the Lambdas pull them in

[adampie]

Based on domain-protect/domain-protect#199

We should move the management and configuration of secrets used by the Lambdas to call third-party servies outside of the Terraform code and state. There are a couple of options such as 'AWS Secrets Manager' and 'AWS Systems Manager Parameter Store' with the latter being the simpler and cheaper option.

This would introduce a new resource eg. aws_ssm_parameter and also require code changes to pull the secret on function init.

[paulschwarzenberger]

good idea