You can use the tailscale cli as a socks proxy. https://tailscale.com/kb/1113/aws-lambda

If you slap that into a container image and expose the socks port tailscale listens on, bada bing, bada proxy!