storing the credentials as lambda env variables is basically what happens if you adopt solutions number 2 -3 or 4 in my examples. (if you use serverless framework — otherwise you could just assume you have those variables in your code, and then add the env variables in the uiconsole)

i would not say it is a bad practice. expecially if structured with a yml file it is a good enough solution in many cases. but not optimal. expecially because variable can be read by malicious code in your npm dependencies , or by anyone in your team / company having access to the UI console