Custom API interface for AWS Client VPN creation

I'm looking for an input/output sort of scenario where a client could hit something like a REST API with variables to automatically create a new client VPN in a new AWS subscription. It would be for a completely new AWS subscription, assuming nothing exists, and need to create the proper certs (if Let's Encrypt can be used, all the better). This needs to be without using EC2 instances. Ephemeral containers are ok. Inputs would be IAM credentials, network, subnet, etc. I would probably need it to create a new VPC as well, or at least have an option for it.