Webhook Delivery Service  ·  View 09 of 20  ·  Data

Storage Zones

Four zones, divided by what can be rebuilt and what cannot.

Editable source SVG draw.io All views
System of record — what we were asked to send Event metadata Event Index DynamoDB, 30 d TTL Event content Event Payloads S3 SSE-KMS, 30 d One copy per event not per delivery System of record — what we actually did Delivery evidence Attempt Log 90 d, by endpoint Dead-Letter Index 30 d from last attempt Governance Audit Log 400 d, append-only Aggregates 13 months Configuration — small, versioned, security-critical Subscriptions Endpoints & Subscriptions strongly consistent reads Secrets Signing Secrets KMS-wrapped, 2 active Derived — rebuildable, no recovery objective of its own Work in flight Per-Endpoint Queues rebuilt from the attempt log Derived state Endpoint Health recomputed from attempts reconstructs payload_ref Storage Zones — By Ownership and Rebuildability Data store Application we own Queue / topic batch synchronous Nothing already recorded as delivered is re-sent when the queues are rebuilt. v 1.0 · owner Integration Platform Architecture · date 2026-09

The division

  • What we were asked to send, and what we actually did, are two systems of record. Neither is derivable from the other, and conflating them is how a platform loses an argument with a customer (ADR-15).
  • Payload stored once per event, referenced from each delivery. Fan-out multiplies deliveries, not content — at a p99 fan-out of 40 this is the difference between 4 KB and 160 KB per event.
  • Queues and endpoint health carry no recovery objective of their own: both are rebuilt from the attempt log, and nothing already recorded as delivered is re-sent.

Retention, all assumptions

  • Payloads 30 days — this number *is* the replay window, and it is the one figure a customer will discover the hard way.
  • Attempt records 90 days full fidelity, 13 months aggregated. Dead letters 30 days from the final attempt. Audit 400 days.
  • Each expires on an independent storage lifecycle rather than an application deletion job, so a stalled job cannot silently extend retention.

Risks

  • Signing secrets sit in the configuration zone with a strong consistency requirement and a KMS dependency on every worker start. If the secret read path is slow, it becomes a delivery-latency problem rather than a control-plane one.
◀  Integration Surface All views Data Model  ▶
Solution Architecture v1.0 · Amazon Web Services · Integration Platform Architecture · 2026-09 · 20 views · 16 architecture decision records09-storage-zones