jason-aws-webhooks

[median wedge]

Hi 👋

I'm not sure I follow. Webhooks are the current recommended approach to receive event notifications and, as far as I know, this will not change when Workbench GAs

To the best of my knowledge, Workbench is still building on top of webhook events. They would not replace this functionality but rather provide a more centralized UI for managing them.

[kindred lynx]

ah. I was trying to follow the quickstart on AWS At https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-saas-furls.html#furls-connection-stripe. But the stripe option has been removed from the quickstarts

then I was referred to this one : https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-saas.html#eb-saas-integration

[median wedge]

Unfortunately I cannot speak to non-Stripe content.

[kindred lynx]

fair enough.

[median wedge]

It's hard to tell what exactly these tools would do (I'm not well versed in AWS tooling). But as long as you have a publicly accessible URL that we can send POST requests to and the function that receives them can correctly process the payload like we show here https://stripe.com/docs/webhooks#webhook-endpoint-def, I don't see why this wouldn't work.

[kindred lynx]

Yeah, AWS is a bit of a beast... I was told it's not an aws best pratice to just hang a publicly accessible webhook endpoint out on the web... There are two walkthroughs on the aws docs with specfic implementations for stripe.... but one is no longer available ( the we hook cloud formation template, it was there a few months ago... ) and the other is not availble yet (using work bench. I'll try to reach out to aws...

thanks for the link, I appreciate effort 🙂 happy new year

[median wedge]

Hmmmm....I'm not aware of any way to avoid a publicly accessible endpoint, maybe you could proxy the request but you would definitely want to watch out for any transofmration of the payload since we use it to validate the signature and even trimming whitespace will cause that to fail.

[kindred lynx]

It's stil publicly available, but wrapped in some aws security... it helps prevents bad actors from flooding the enpoint and driving up your aws bill i guess

[median wedge]

I see. Another way you could address that is with traffic rules. We publish all the IP addresses we will send webhook requests from here https://stripe.com/docs/ips#webhook-notifications

[kindred lynx]

cool, thanks for your help. i'll look into that

[median wedge]

Happy to shed what 💡 I can 🙂