When hosting a webhook-driven integration in AWS, which security best practice should you implement?

• A. Validate request signatures, use authorized endpoints, implement least privilege, and consider VPC endpoints or Private API endpoints
• B. Allow all traffic from the internet
• C. Use default AWS credentials in code
• D. Expose public endpoints for easy access

Answer: (A)

When securing a webhook-driven integration in AWS, the emphasis is on proving the sender and limiting what the receiving system can do, while keeping the communication private. Validate request signatures to confirm the payload really came from the webhook provider, and keep the signing secret securely (for example in Secrets Manager or Parameter Store). Use authorized endpoints so only the intended service can be reached, such as routing the webhook through API Gateway with proper access controls or exposing a Private API/PrivateLink endpoint that isn’t reachable from the public internet. Apply least privilege to all involved IAM roles and policies so the webhook consumer can perform only the actions it truly needs. Consider using VPC endpoints or Private API endpoints to ensure traffic stays inside AWS rather than traversing the public internet. Together, these practices reduce the risk of tampering, eavesdropping, or unauthorized access. Opening to the internet, hardcoding credentials, or exposing public endpoints would significantly increase security risks.