Just like people have been calling their controller actions from test harnesses for ages to test their APIs. You can call call your handler the same way.

At the end of the day, AWS is just passing you a JSON message. You can call your lambda function manually with the same JSON payload locally.

I tend to opt for the SSH tunnel route for personal projects but use OpenVPN with a secrets management (eg Vault or AWS's new key store) for professional projects (ie when you have several people on your team).

AWS is versatile enough that you do actually have several options available to you.