I do not think there is an ideal setup that fits all kinds of scenarios. That being said, assuming there will be other things than lambdas and VPC/network stuff, I would consider splitting up things in multiple stacks, based on lifecycle and logical grouping. With multiple stacks I mean separate deployable units, not just different environment configurations.