Features
Everything you need to build serverless UDP applications.
Proxylity receives, secures and routes your UDP, DTLS and WireGuard traffic, and delivers it to services in your own AWS account. You write the application.
Batching at the point of ingress, tuned per destination.
Blocked traffic costs nothing.
The same setup works from a few packets a day to heavy load.
Processing and storage stay in your AWS account. Proxylity routes packets and does not store your payloads.
01 · Build
How do I build on it?
Define a listener, point it at a destination, and write a handler. It deploys like any other serverless app.
- Infrastructure as code. CloudFormation custom resources for listeners, destinations and client restrictions. Account configuration is retrieved from S3 during deployment.
- Jump-start with an agent. Use the udp-gateway skill from our skills repository to help your coding agent plan and build your project.
- Per-developer and per-branch environments spin up as fast as production.
- Least-privilege roles for each destination keep permissions scoped to the resources it needs.
"ProxylityListener": {
"Type": "Custom::ProxylityUdpGatewayListener",
"Properties": {
"ServiceToken": { "Ref": "ProxylityServiceToken" },
"ApiKey": { "Ref": "ProxylityApiKey" },
"Protocols": [ "udp" ],
"Destinations": [
{
"Role": {
"Arn": { "Fn::GetAtt": [ "DestinationRole", "Arn" ] }
},
"Batching": {
"Count": 10,
"TimeoutInSeconds": 0.1
},
"DestinationArn": {
"Fn::GetAtt": [ "MyLambdaFunction", "Arn" ]
}
}
]
}
}public async Task<UdpGatewayReply> Handler(
UdpGatewayMessage message)
{
var reading = Parse(message);
await table.PutItemAsync(reading);
return message.NoReply(); // no reply needed
}The resource excerpt uses your account configuration, destination role and Lambda function. Start with a generated template for a complete deployment.
02 · Connect
How do my clients connect?
Clients keep speaking the protocol they already use. With Packet Sources, your application can also initiate outbound UDP traffic.
- UDP, DTLS 1.2 and 1.3, and WireGuard listeners. Encrypted sessions terminate at the managed edge, delivering application payloads to your AWS destinations.
- Open WireGuard endpoints accept devices without advance registration, then hand identity to your workflow.
- Packet Sources send UDP from your application to remote clients without waiting for a request: pushes, keepalives, OTA updates and fan-out.
- Region-aware delivery keeps replies in-region without custom networking code.
Inbound
Outbound
Transports
03 · Integrate
Where do my packets go?
Straight into the AWS services you already use, with no message broker in between and permissions you control.
- 14+ native destinations, each with its own IAM role.
- Batching is configurable per destination, by count, time window or size. Concurrent batches keep processing moving.
- Lambda Tenant Isolation supports multi-tenant workloads.
React in code
Orchestrate
Notify and queue
Reach other systems
04 · Protect
Who gets in, and what can you see?
You decide who can send traffic. Your application processes and stores the delivered data in your own AWS account.
- Client restrictions by CIDR, reverse-DNS hostname or CPF/DNS policy records instead of a brittle allowlist.
- Firewall, rate limits and geographic rules filter traffic before you pay for it.
- Role-based access. Proxylity assumes roles you define and never stores your credentials. Permissions can be scoped to individual resources.
- Auditable. Every API call made on your behalf appears in CloudTrail.
Your data, your account.
Proxylity routes packets without storing your payloads. Delivery uses IAM role assumption, with a unique external ID per account to prevent confused-deputy attacks.
Show the role trust policy
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": {
"Fn::FindInMap": [
"ProxylityConfig", "Account", "ServiceTokenArn"
]
}
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": {
"Fn::FindInMap": [
"ProxylityConfig", "Account", "ExternalId"
]
}
}
}
}
]
}Trust-policy excerpt using your Proxylity configuration mapping. Add resource-scoped permissions as described in Access & Permissions.
05 · Run
Will it stay up, and can I see what's happening?
Regional stacks run independently, with metrics and logs delivered to your own CloudWatch.
- Multi-region with automatic failover, so traffic routes to healthy regions during outages.
- Regional isolation keeps a failure from cascading.
- Data residency. Keep processing inside specific geographic boundaries.
- Clients connect to the nearest regional endpoint.
- Metrics and logs
- CloudWatch
- Alarms on spikes, errors, latency
- Custom alarms
- Client-to-destination tracing
- Distributed tracing
- Batching efficiency and throughput
- Performance analytics
- Destination availability
- Health checks
- Common-case views
- Pre-built dashboards
06 · Scale and cost
What happens when my traffic grows?
Nothing you have to manage. A trickle of packets and a flood use the same listener, the same handler and the same configuration.
- One set of primitives at every scale. No re-architecting as you grow, and nothing to size or provision.
- Unit cost falls as volume rises. Batching cuts AWS API calls, and volume discounts apply automatically.
- Less time waiting for a batch. Busier traffic fills batches sooner, so packets wait less until batches are full.
- Affordable from the first packet. Pay only for packets delivered to your destinations. Blocked traffic is free, and a free tier gets you started.
- One AWS bill. Billed through AWS Marketplace, with AWS credits supported and detailed usage reporting.
Illustrative. Shapes show the trend, not measured values.
- Episodic
- A few packets a day
- Steady
- Continuous telemetry and sessions
- High volume
- Tested to 1,000,000 packets per second
Go deeper
How teams deploy, secure and scale UDP workloads in production.
Your first listener is five minutes away.
Deploy in your own AWS account with a free tier and no credit card.