My 2 cents on this as someone who does a lot of stuff in AWS/Lambda. The pattern you guys use is wrong.

I NEVER want the exograph command line to touch my AWS resources.

The right pattern is you really should have a CDK construct to manage all of this.

 new ExoGraphLambda(this, "My API", {
      code: lambda.Code.fromAsset(path.join(__dirname, 'exograph_schema')) // Path to the exograph schema,
      exograph_version: "Some constant" 
      enviroment: {} // known exograph envrioment variables
})

That's basically all that's needed to handle this. You can just manage the layer from inside the construct and don't even have to expose that complexity to the consumer.

Similar patterns exist in cargo-lambda to inject build-steps into the deployment.

The second benefit to using a CDK construct is something I would really recommend to call out in the documentation.

Lambda is billed per invocation and for execution duration. So with a function URL, you're billed per HTTP request regardless if the lambda just immediately stops executing. So someone can just DDOS me out of my paycheck by spamming the URL with unauthenticated requests.

With a CDK construct you can easily integrate the lambda with AWS WAF to ratelimit the execution so that can't happen. Cloudflare is also a decent option that's free for also.

@MinisculeGirraffe Thanks for your input. Indeed, using CDK will improve user experience (in addition to the benefits you listed).