In your target AWS account, create an IAM user and attach an IAM policy of the following format:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sqs:SendMessage",
            "Resource": "[your-sqs-queue-arn]"
        }
    ]
}

This assumes you have an SQS queue created where you'd like webhook events delivered. If not, go ahead an create one now.

This policy establishes access only to send new messages to the specified queue, limiting the permissions in the narrowest possible way. If you need to perform more operations, extend the policy according to your use case.

Once you've created the IAM user, click the Connect Account under the send_message_to_sqs step in the workflow, saving your AWS access and secret keys.

Then, add the SQS queue URL as the value of the SQS Queue param, also below the step.

Remember that the contents of all code steps on Pipedream are public, but the values of params are (by default) private.