Safe payment retries on AWS: API Gateway invokes a Lambda that checks an idempotency key in DynamoDB before calling the payment provider — duplicate requests short-circuit on the dedup lookup, first-time requests take the conditional-write-then-charge path to the external payment gateway. The dedup store and the charge path are grouped separately.