I might be misunderstanding something here, but you don’t need to worry about CORS between a Lambda function and some external API, in this case, Google Sheets.
This is because Lambda is not bound by any “single origin policy”, like you have in a web browser.
If this isn’t the case, maybe post the code and error message. I’ve sometimes seen CORS in error messages when it turned out to have nothing to do with CORS.