Destinations

Destinations in Proxylity are where packets arriving at your Listeners are delivered. A Destination is associated with an AWS resource like a Lambda function, Firehose stream or SNS topic, and includes settings for how packets are delivered (batching and role).

Supported Services

The list of currently supported services is:

• Lambda
• Step Functions
• API Gateway
• Firehose
• Kinesis Data Streams
• DynamoDB
• EventBridge
• IoT Data
• SNS
• SQS
• S3
• Location Service (Tracker)
• CloudWatch Logs

Configuration Reference

For complete details on all destination properties including MetricsEnabled, LogGroupName, batching, roles, and multi-region configuration, see the Destination CloudFormation Resource Reference.

Observability and Monitoring

Destinations can be configured with built-in observability features to help you monitor traffic, track errors, and troubleshoot issues:

CloudWatch Metrics (MetricsEnabled)

When you set MetricsEnabled: true on a destination, UDP Gateway publishes metrics to your AWS account for that destination. These metrics include:

• Ingress packet and byte counts - Track incoming UDP traffic volume
• Egress packet and byte counts - Monitor response traffic (for request/response destinations)
• Error counts - Identify delivery failures and issues
• Filtered packet and byte counts - Track packets dropped by FilterExpression before delivery (via FilteredPackets and FilteredBytes)

Use these metrics to create CloudWatch dashboards, set up alarms for anomaly detection, track usage patterns, and attribute costs in multi-tenant systems.

CloudWatch Logs (LogGroupName)

Specify a LogGroupName to receive detailed error and warning messages in CloudWatch Logs. This is particularly valuable for:

• Troubleshooting IAM permission issues - See exactly which permissions are missing
• Identifying configuration problems - Catch malformed ARNs or missing resources
• Diagnosing service throttling - Understand when AWS service rate limits are encountered

Log messages are intelligently deduplicated within short time windows, showing occurrence counts (e.g., [x12]) to prevent log flooding during widespread issues.

For more details on observability best practices, see our article on Building Observable UDP Infrastructure with CloudWatch.

Packet Filtering

Destinations support an optional FilterExpression that controls which packets are delivered. The expression is a BREX expression evaluated against each inbound packet. Only packets that produce a truthy value reach the destination — non-matching packets are silently dropped and are not billed.

Filtering is especially powerful with composite destinations. A single listener can receive a heterogeneous packet stream and each destination can filter for its own subset of the traffic, enabling content-based routing without Lambda intermediaries.

When the parent listener is a WireGuard listener with DecapsulatedDelivery enabled, the filter evaluates the decapsulated payload. Otherwise it evaluates the raw packet.

For the full property reference, see the Destination CloudFormation Resource Reference.

Additional Resources

Ready-to-deploy example projects for Proxylity UDP Gateway are available in our examples repository on GitHub.

Other helpful information about destinations:

• The formats used to deliver packets.
• How batching to destinations works.
• Using composite destinations to deliver packets to multiple destinations (multiplexing).
• How to use packet filtering to route subsets of traffic to specific destinations.
• How to configure multi-region destinations.
• Integrating outside AWS with external REST APIs and services.