Great list. Closing layer 3* access (inbound firewall rule of deny-all) helps mitigate against the common webhook attack vectors as well (should still do all the L7 mitigation and best practices alluded to above for a multi-layered approach).

* examples:

https://netfoundry.io/zero-trust-webhook-security/ (blog)

https://youtu.be/TWohosldLP4 (video specifically for a Lambda function)