code: function decrypt(env, callback) {
    if (!env.AWS_DEFAULT_REGION) return callback(new Error('AWS_DEFAULT_REGION env var must be set'));
    var kms = new AWS.KMS({
      region: env.AWS_DEFAULT_REGION,
      maxRetries: 10
    });
    var q = queue();
    for (var key in env) {
      if (!(/^secure:/).test(env[key])) continue;
      q.defer(function(key, val, done) {
        kms.decrypt({
          CiphertextBlob: new Buffer(val, 'base64')
        }, function(err, data) {
          if (err) return done(err);
          done(null, { key: key, val: val, decrypted: (new Buffer(data.Plaintext, 'base64')).toString('utf8') });
        });
      }, key, env[key].replace(/^secure:/,''));
    }
    q.awaitAll(function(err, results) {
      if (err) return callback(err);
      callback(null, results);
    });
  }
docs: Private decrypt function that does not scrub output. Not exposed as a public API.
  
  @param {object} env Object with variables to decrypt.
  @param {function} callback Callback function.