Because much of serveless.com is CloudFormation based, you can easily update existing resources. They talk about this feature here

For me this was required for adding tags

# you can add CloudFormation resource templates here
resources:
  Resources:
    ServerlessDeploymentBucket:
      Properties:
        Tags:
          - { Key: "project", Value: "${self:provider.project}" }
          - { Key: "environment", Value: "${opt:stage, self:provider.stage}" }
          - { Key: "parent_project", Value: "${self:custom.parent}" }
          - { Key: "key_contact", Value: "${self:custom.contact}" }
          - { Key: "billing_ref", Value: "${self:custom.billing_ref}" }

now that bucket, that Severless makes by default, will have tags.

Also I need to tag Lambda functions too for billing:

functions:
  check_queue:
    handler: handler.check_queue
    tags:
      project: ${self:provider.project}
      environment: ${opt:stage, self:provider.stage}
      parent_project: ${self:custom.parent}
      key_contact: ${self:custom.contact}
      billing_ref: ${self:custom.billing_ref}
    events:

Some of this info I centralize in this area here

custom:
  secrets: ${file(secrets.${opt:stage, self:provider.stage}.yml)}
  contact: AlfredNutile
  billing_ref: foo_app
  parent: foo_app

Some of this I can drive using this plugin serverless-secrets-plugin here

So I then pull in the secrets file and use it as needed.

provider:
  name: aws
  stage: dev
  runtime: nodejs6.10
  environment:
    APP_ENV: ${self:custom.secrets.APP_ENV}
    REGION: ${self:custom.secrets.REGION}
    ACCOUNT_ID: 555555555