In your target AWS account, create an IAM user and attach an IAM policy of the following format:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "kinesis:PutRecord",
            "Resource": "[your-kinesis-stream-arn]"
        }
    ]
}

This assumes you have a Kinesis stream created where you'd like webhook events delivered. If not, create one before using this workflow.

This policy establishes access only to send new messages to the specified stream, limiting the permissions in the narrowest possible way. If you need to perform more operations, extend the policy according to your use case.

Once you've created the IAM user, save the access key and secret access key AWS generates for you as Pipedream environment variables. You should also save the Kinesis stream name as an environment variable. Remember that the contents of all code steps on Pipedream are public, so take care not to include sensitive values in your code.

In the code for this pipeline, I've referenced the names of these environment variables as:

• KINESIS_ACCESS_KEY
• KINESIS_SECRET_KEY
• KINESIS_REGION
• KINESIS_STREAM_NAME