You can make this work with inline Lambda code by installing the package at runtime to /tmp and deferring the import. The /tmp directory in Lambda provides 512MB (or up to 10GB if configured) of ephemeral storage, and you can use pip to install packages there during cold starts.

The Pattern: Runtime pip install with deferred import

import json
import subprocess
import sys
import cfnresponse

def install_packages():
    """Install cryptography to /tmp on cold start."""
    subprocess.check_call([
        sys.executable, '-m', 'pip', 'install',
        'cryptography', '--target', '/tmp/pip_packages',
        '--quiet', '--no-cache-dir'
    ])
    sys.path.insert(0, '/tmp/pip_packages')

# Install on cold start (outside handler)
install_packages()

# NOW import cryptography (after install)
from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
import datetime


def handler(event, context):
    try:
        if event['RequestType'] == 'Delete':
            cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
            return

        # Generate CA private key
        ca_key = rsa.generate_private_key(
            public_exponent=65537,
            key_size=2048
        )

        # Generate CA certificate
        ca_name = x509.Name([
            x509.NameAttribute(NameOID.COMMON_NAME, "My Custom CA"),
            x509.NameAttribute(NameOID.ORGANIZATION_NAME, "MyOrg"),
        ])

        ca_cert = (
            x509.CertificateBuilder()
            .subject_name(ca_name)
            .issuer_name(ca_name)
            .public_key(ca_key.public_key())
            .serial_number(x509.random_serial_number())
            .not_valid_before(datetime.datetime.utcnow())
            .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=3650))
            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
            .sign(ca_key, hashes.SHA256())
        )

        # Serialize to PEM
        ca_key_pem = ca_key.private_bytes(
            encoding=serialization.Encoding.PEM,
            format=serialization.PrivateFormat.TraditionalOpenSSL,
            encryption_algorithm=serialization.NoEncryption()
        ).decode('utf-8')

        ca_cert_pem = ca_cert.public_bytes(
            serialization.Encoding.PEM
        ).decode('utf-8')

        cfnresponse.send(event, context, cfnresponse.SUCCESS, {
            'CACertificatePem': ca_cert_pem,
            'CAPrivateKeyPem': ca_key_pem
        })

    except Exception as e:
        print(f"Error: {str(e)}")
        cfnresponse.send(event, context, cfnresponse.FAILED, {
            'Error': str(e)
        })

Important considerations:

1. Cold start penalty: The pip install adds 5-15 seconds to cold starts. Set your Lambda timeout to at least 120 seconds (custom resources allow up to 3600s).

2. Memory: Set memory to at least 512MB — the cryptography library compilation and loading is memory-intensive.

3. Idempotency: The install runs on every cold start but is fast on warm invocations since the module is already in sys.path. You can add a check: if not os.path.exists('/tmp/pip_packages/cryptography').

4. Network access: The Lambda needs internet access (NAT Gateway or public subnet) OR a VPC endpoint for PyPI. If your Lambda is in a VPC without internet, this won't work — use a Lambda Layer instead.

5. Pinning versions: For production, pin the version: 'cryptography==42.0.0' to avoid unexpected breaking changes.

References:

• Lambda Ephemeral Storage (/tmp)
• Lambda Execution Environment
• Lambda Best Practices - Cache Static Assets in /tmp
• cfn-response Module
• Python cryptography Library Documentation