Serverless Webhook Relay
CloudFormation: API Gateway + Lambda that receives webhooks, validates signatures, and fans out to multiple downstream services via SQS. Configurable routing rules.
Serverless Webhook Relay — Receive, Validate, Fan Out
A production-ready webhook relay that validates HMAC signatures and routes events to multiple downstream SQS queues. Supports GitHub, Stripe, and any generic HMAC-signed webhook source.
What's Included
- API Gateway with
POST /webhook/{source}endpoint - Lambda relay (Node.js 22) with HMAC-SHA256 signature validation
- Per-source signing secrets in SSM Parameter Store
- Configurable routing-rules.json mapping event types to SQS queues
- Three downstream SQS queues for fan-out delivery
- Timestamp replay protection (rejects events older than 5 minutes)
Developer Experience
Edit routing-rules.json to define which event types go to which queues. Store HMAC secrets in SSM. The relay handles validation and fan-out — downstream consumers focus on processing only.
What You Get
A centralized webhook ingestion layer. One endpoint per source, any number of downstream consumers. Works with GitHub, Stripe, or any HMAC-SHA256 signed service.
Requirements
AWS CLI v2 with CloudFormation, API Gateway, Lambda, SQS, SSM, IAM, and CloudWatch permissions.