When this becomes useful
A payment provider, code host or messaging provider sends an event while your application is doing other work. You need to verify that the request really came from that source, accept it quickly, and hand it to downstream processing.
What the template offers
The directory contains separate AWS SAM examples for Stripe, GitHub and Twilio. Each puts a vendor-specific verifier in front of an EventBridge event bus. Start with the matching provider directory; this is a set of examples, not a finished webhook operations product.
Technical shape
The GitHub example exposes a Lambda function URL, reads a shared secret from Secrets Manager, checks an HMAC-SHA256 signature over the raw request body, and calls EventBridge PutEvents after verification. Its template also sets reserved concurrency and an invocation alarm. Inspect the other vendor folders separately because their signature rules differ.
What we checked
This is a source and documentation review ↗; we have not deployed this example.
License: MIT text in repository root ↗ · checked 2026-11-11. The directory README labels itself MIT-0 while the root LICENSE uses MIT wording. Check both notices before copying code. This listing links to the source and does not reproduce it.
Maintenance: last source commit 2025-11-25; checked 2026-11-11. The latest GitHub example template change found was on 2025-11-25. A 2026-10-01 directory commit regenerated pattern metadata, not the example implementation. Recheck runtime and dependencies before deployment.
Adoption notes
- The GitHub function URL uses public AWS invocation and relies on application signature verification; test missing, invalid and replayed signatures for your provider.
- The GitHub sample logs request headers on errors. Review that path before handling real credentials or customer events.
- Add durable delivery status, deduplication, retry and dead-letter behavior around downstream consumers; the example forwards an event but does not provide a customer-facing delivery console.
Questions worth answering
- How will you rotate each provider secret without interrupting valid deliveries?
- What happens when EventBridge or a downstream consumer rejects or duplicates an event?
- Which payload fields and request headers can be logged without exposing customer data or signatures?
Inspect the source
Read the maintainer's README, license, setup instructions and current repository state before adapting the code.
Open AWS Serverless PatternsCapabilities to plan next
A deployable pattern is one piece of the product. These guides cover behavior and decisions around it.