plugins:
  - serverless-cloudformation-parameter-setter

custom:
  cf-parameters:
    secretPassword: whatever # this could be serverless ssm variable or s3 variable or plaintext or whatever, do what you want

resources:
  # define the cloudformation parameters here
  Parameters:
    secretPassword:
      Type: string
      Description: database password
      NoEcho: true # keep it secret, keep it safe
  # use the parameters here
  Resources:
    TheDatabase:
      Type: AWS::RDS::DBInstance
      Properties:
        Engine: MySQL
        DBInstanceIdentifier: MySQL
        DBName: MySQL
        MultiAZ: true
        PubliclyAccessible: true
        MasterUsername: root
        MasterUserPassword: { Ref: secretPassword } # you can also send this to a lambda's env var
        DBInstanceClass: db.t2.large
        AllocatedStorage: 100
        DBSubnetGroupName:
          Ref: DBSubnetGroup # not included in this example
        VPCSecurityGroups:
          - Ref: DBSecurityGroup # not included in this example