Can’t you open up a SSH-tunnel from the lambda? I think there are Python clients if OpenSSH isn’t available in lambda instances (anyone know which binaries are available? I suppose it’s a quite barebone Linux container)
I guess I don't want a socket listening. If AWS would publish their subnets maybe I could limit it to those addresses. It sure seems like they could keep their subnets dynamic and accommodate something like this but I guess not.