This pattern deploys a webhook receiver as an AWS Lambda Web Function with an Amazon DynamoDB table. Providers such as Stripe or GitHub POST directly to the function's HTTPS endpoint, which replaces the usual API Gateway plus Lambda pair with a single Express server. Because Lambda Web Functions forward the HTTP request unchanged, the app reads the raw request body, which is what signature verification needs; there is no base64 decoding or event mapping.

POST /webhooks/{provider} runs four steps. First it verifies the signature with the provider's scheme: Stripe's stripe-signature header (timestamp plus HMAC-SHA256 over t.body), GitHub's x-hub-signature-256 header (sha256= prefix), or a generic x-webhook-signature hex digest. All comparisons use crypto.timingSafeEqual, and a missing or wrong signature returns 401 before the body is parsed. Second it parses the JSON. Third it derives a stable event id per provider (GitHub's x-github-delivery header, otherwise the payload id). Fourth it writes the event with a conditional PutItem on attribute_not_exists(eventId): the first delivery is stored and later redeliveries return 200 with duplicate: true, so provider retries are idempotent. A TTL attribute expires events after 30 days.

The secrets arrive as NoEcho template parameters mapped to environment variables; in production load them from AWS Secrets Manager or SSM Parameter Store instead. POST /test/fire builds a correctly signed sample request for any provider so the flow can be exercised without an external account. It signs with the real secret, so it is gated by the EnableTestEndpoint parameter, which defaults to false. GET /events and GET /events/{eventId} read back what was stored.

A single AWS::Serverless::WebFunction resource expands into AWS::Lambda::WebFunction, an immutable AWS::Lambda::WebFunctionRevision and an AWS::Lambda::WebFunctionEndpoint. The endpoint uses AuthType ApplicationManaged because providers cannot SigV4-sign their calls; the HMAC signature is the authentication. The explicit execution role carries CloudWatch Logs plus PutItem, GetItem and Scan scoped to the table ARN.