Fix deployment from MacOS and other non-Linux/x86_64 hosts

[matthewhall79]

Summary

This fixes a deployment issue in the v2 stack where Lambda layer dependencies are built on the local host, which can produce incompatible native binaries for AWS Lambda. In practice, this breaks JWT verification in the API authorizer when cryptography is installed from a non-Linux environment, causing the authorizer to fail at import time and return Deny.

The change updates deploy-v2.sh to build layer dependencies in a Lambda-compatible container by default.

Root Cause

#164 added RS256 JWT verification with pyjwt[crypto] / cryptography. Those packages include native components. The existing deploy flow installed layer dependencies directly on the machine running the deploy script, which is not safe on Mac OS or other non-Linux/x86_64 environments. This produced runtime errors like the following inside the API authorizer path, which then fell back to a deny policy and caused authenticated API requests to fail.

ImportError: /opt/python/cryptography/hazmat/bindings/_rust.abi3.so: invalid ELF header

Fix Description

• Added install_lambda_layer_dependencies() helper to deploy-v2.sh.
• Prefers building in a container using:
  • image: public.ecr.aws/lambda/python:3.10
  • platform: linux/amd64
• Supports both Docker and Podman.
• If neither are available:
  • On Linux/x86_64, falls back to local build,
  • otherwise fails deployment.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.