Proxylity
Compare
An open, side-by-side look at the architecture AWS recommends for datagram services and the approach in our examples. Every task, every line item, and the cases where building it yourself is the better call.
We priced five workloads with published list prices and show our working. AI coding agents have made building either option faster, so we also look at what's left after the build: running it.
AWS prices checked , us-east-1.
Proxylity UDP Gateway costs less to run than a self-managed Network Load Balancer and Fargate stack for development environments, low-to-moderate traffic and anything multi-region. The self-managed stack has a lower AWS bill at sustained high volume in a single region, where the choice comes down to how much engineering time you'd spend operating it. AI coding agents make both options faster to build, which makes that operating time the deciding cost.
Proxylity is ahead
Five dev environments cost about $4 a month on Proxylity and $368 on the AWS stack. At moderate traffic, Proxylity is within about $30 a month or cheaper, and adding a second region doesn't change its bill.
DIY is ahead
From about 400 to 1,000 packets a second in one region, the AWS bill is $780 to $1,220 a month lower, even with Enterprise batch pricing. Proxylity breaks even only if it saves you about 6 to 10 engineer-hours a month.
What AI changed
In our estimates, agents cut the build gap between the two by 57% but the monthly operating gap by only 35%. Operations are now about 82% of the three-year difference.
The two approaches
On AWS, the managed path for public UDP traffic is a Network Load Balancer, optionally fronted by Global Accelerator. Application Load Balancer and API Gateway don't accept UDP, and Lambda can't listen on a socket, so something has to own the socket. With the reference approach that's your container. With Proxylity it's a managed listener that hands batches of datagrams to your AWS services.
Both sides below follow published guidance, configured the way a careful team would ship to production.
AWS reference approach
Roughly 30 CloudFormation resources per region before application code.
Proxylity approach
Custom::ProxylityUdpGatewayListener resource gives you a public UDP,
WireGuard or DTLS endpoint, already served from multiple regions.The packet counter example is three resources: a Lambda function, a role and a listener.
Side by side: building
The last column is our read on how much an AI coding agent reduces the effort today. High means an agent drafts most of it and your time goes to review. Low means the work is measuring, testing or deciding, which an agent can assist with but not replace.
| Task | AWS reference approach | Proxylity | AI leverage |
|---|---|---|---|
| Network foundation | VPC across two or three AZs, public and private subnets, route tables, internet gateway, NAT gateways, security groups. | None for ingress. The listener is a managed public endpoint. | High Agents generate this IaC well. |
| Ingress and load balancing | NLB, UDP listener, target group, and a separate TCP or HTTP health endpoint that reflects the UDP service's health. | One listener resource: protocols, destinations, client restrictions. | High |
| Datagram server | Write and containerize a socket server: receive loop, concurrency, buffer sizing, parsing, backpressure, reply path, graceful shutdown. | A handler that receives a batch of messages and returns replies. Or no code, for direct destinations. | Medium The code is fast to write. Tuning it under load still takes measurement. |
| Delivery to AWS services | SDK calls with batching, retries and partial-failure handling for each service you write to. | Declarative destinations with batching and an error log group. | Medium |
| Scaling | Service auto scaling on CPU or memory. The NLB has no per-datagram request metric, so you choose a proxy signal and prove it with load tests. | The gateway scales. Lambda concurrency scales; set limits if you need them. | Low Thresholds come from real load tests. |
| Encryption and peer auth | Run DTLS or WireGuard inside your service and manage keys and peers. | WireGuard and DTLS listeners, with peers declared in the template. | Medium |
| Access control | Security group and network ACL rules by CIDR. | Client restrictions by network. Blocked traffic isn't charged. | High |
| Multi-region | A stack per region, Global Accelerator endpoint groups, health checks and traffic dials. | Ingress is already multi-region. Map each region to a destination ARN. | Medium Generating it is easy. Proving failover is not. |
| Observability | Container Insights, NLB metrics, custom metrics, logs and alarms. | Per-destination metrics, a destination error log group, and Lambda metrics. | High |
| More environments | Each dev, staging or branch environment carries about $74 a month of fixed infrastructure. | First listener free, then about $1 a month each. | Not an effort question. See scenario 1. |
With the Proxylity Agent Skills package, agents in Kiro, GitHub Copilot, Claude Code, Cursor and others work from the same templates as our examples repo, so a first working listener is usually a single prompt away. Agents are just as capable of drafting the AWS reference stack. The difference is how much of what they produce you then have to run.
Side by side: operating
Operations are where the two approaches differ most. With the reference approach you own every layer from the load balancer down. With Proxylity you own your handler and destinations, and we run the ingress tier.
| Activity | AWS reference approach | Proxylity | AI leverage |
|---|---|---|---|
| Patching | Container base images, OS libraries, language runtime and dependencies. Rebuild and roll out on every CVE that matters. | Lambda runtime versions and handler dependencies. Nothing for no-code destinations. | High Agents find and fix. Rollouts still need review. |
| Deploys | UDP flows stay pinned to a target until they go idle, so rolling deploys need deregistration delays and drain logic to avoid dropping datagrams. | Publish a new Lambda version or update the listener through IaC. | Low |
| Capacity | Revisit task size, task count and scaling policies, and re-run load tests as traffic changes. | Watch Lambda concurrency and destination service quotas. | Low |
| Incidents | The whole path is yours: NLB, health checks, tasks, NAT, AZ impairments, regional failover. | We run the ingress tier. You own your handler and destinations. | Medium Agents speed diagnosis. Someone still answers the page. |
| Security posture | Security groups, ACLs, public IPv4 inventory, flood and abuse response. Shield Standard is included; Shield Advanced is extra. | Client restrictions and filter expressions. We operate the edge. | Medium |
| Failover drills | Exercise Global Accelerator dials and regional failover, and confirm state survives it. | Built in. Confirm each region's destinations exist and are healthy. | Low |
| Cost hygiene | Rightsize tasks, watch NAT data processing, clean up idle environments. | Watch packet volume and batch sizes. | High |
The AI shift
These are our estimates of the effort for one production service, with and without agent assistance. Your numbers will differ, so treat ours as a template and substitute your own. Engineer-days are 8 hours.
| Phase | DIY | DIY + AI | Proxylity | Proxylity + AI |
|---|---|---|---|---|
| Network and ingress IaC | 4 | 1 | 0.5 | 0.25 |
| Server or handler code | 5 | 1.5 | 1 | 0.25 |
| Hardening (backpressure, drain, health) | 3 | 2 | 0 | 0 |
| Load and failure testing | 3 | 2 | 1 | 0.5 |
| Observability and alarms | 2 | 0.5 | 0.5 | 0.25 |
| Multi-region | 4 | 2 | 0.5 | 0.25 |
| Total | 21 | 9 | 3.5 | 1.5 |
| Activity | DIY | DIY + AI | Proxylity | Proxylity + AI |
|---|---|---|---|---|
| Patching and redeploys | 3 | 1.5 | 1 | 0.5 |
| Capacity and load tests | 2 | 1.5 | 0 | 0 |
| Safe UDP deploys | 1 | 0.5 | 0 | 0 |
| Monitoring and alarms | 2 | 1 | 1 | 0.5 |
| Incident response (amortized) | 4 | 3 | 1.5 | 1 |
| Security posture | 1 | 0.5 | 0.5 | 0.25 |
| Cost hygiene | 1 | 0.5 | 0.5 | 0.25 |
| Single region | 14 | 8.5 | 4.5 | 2.5 |
| Add: failover drills | 2 | 1.5 | 0 | 0 |
| Multi-region | 16 | 10 | 4.5 | 2.5 |
What this means over three years, for a multi-region service at a loaded rate of $125 an hour ($1,000 a day):
Without agents, the build gap between the two is 17.5 days ($17,500) and the operating gap is 11.5 hours a month ($51,750 over 36 months). Operations are about 75% of the difference.
With agents, the build gap falls 57% to 7.5 days ($7,500), but the operating gap only falls 35% to 7.5 hours a month ($33,750). Operations become about 82% of the difference.
Agents make choosing on build effort alone even less useful than it was. Compare what each option costs to run.
We kept Proxylity's operating estimate at 2.5 hours even for no-code workloads like syslog, where there is no handler to patch. That's deliberately conservative. Not included for either side: on-call stipends, hiring, and the opportunity cost of the people involved.
Side by side: costs
The Proxylity columns use the published usage-based tiers and, where it helps, the Enterprise plan: an $850 monthly subscription plus batch-based pricing. The AWS columns use us-east-1 list prices.
Scenario 1
Five near-idle environments for developers and pull requests. This is fixed cost, before any traffic.
| Line item | AWS reference | Proxylity |
|---|---|---|
| NLB hourly charge | $16.20 | – |
| NAT gateway | $32.40 | – |
| Public IPv4 addresses (3) | $10.80 | – |
| Fargate, 2 × 0.25 vCPU / 0.5 GB | $14.22 | – |
| Listener | – | $0 to $1.00 |
| Packets (under 1M a month) | – | $0.00 |
| Per environment | $73.62 | $0 to $1.00 |
| Five environments | $368.10 | $4.00 |
Verdict: five near-idle environments cost about $4 a month on Proxylity and about $368 a month on the AWS reference stack.
You can trim a dev environment to one task and skip NAT, but then it no longer matches production. With Proxylity, dev and prod use the same managed ingress.
Scenario 2
1,000 sensors report once a minute and each report is acknowledged: 43.2M inbound and 43.2M replies, about 17 packets a second. Handled by a Lambda function, like the packet counter example.
| Line item | AWS reference | Proxylity |
|---|---|---|
| NLB hourly + NLCU (86.4 GB processed) | $16.72 | – |
| NAT gateway | $32.40 | – |
| Public IPv4 addresses (3) | $10.80 | – |
| Fargate, 2 × 0.25 vCPU / 0.5 GB | $14.22 | – |
| Data transfer out for replies (43.2 GB) | $3.89 | – |
| Packets, inbound and replies (86.4M) | – | $106.75 |
| Lambda handler (4.32M invocations, 20 ms, 128 MB) | – | $1.01 |
| Single region | $78.03 | $107.76 |
| Two regions, active-active | $170.30 | $107.76 |
Verdict: in one region, the AWS reference stack is about $30 a month cheaper for 1,000 acknowledged sensors ($78.03 vs $107.76), roughly 15 minutes of engineering time. In two regions it costs $170.30, while Proxylity stays at $107.76.
Proxylity's bill doesn't change with a second region because its ingress is already multi-region, and a Lambda function deployed in two regions still only bills for invocations.
Scenario 3
50 servers and network devices send 10 messages a minute each, fanned out to CloudWatch Logs and Firehose, as in the syslog example. With DIY, a collector such as rsyslog or Vector runs on Fargate. With Proxylity there is no compute at all.
| Line item | AWS reference | Proxylity |
|---|---|---|
| NLB hourly + NLCU (21.6 GB processed) | $16.33 | – |
| NAT gateway + processing (43.2 GB to two services) | $34.34 | – |
| Public IPv4 addresses (3) | $10.80 | – |
| Fargate collector, 2 × 0.25 vCPU / 0.5 GB | $14.22 | – |
| Deliveries (21.6M × 2 destinations = 43.2M) | – | $52.75 |
| Single region | $75.69 | $52.75 |
| Two regions, active-active | $167.63 | $52.75 |
Verdict: for syslog from 50 devices, Proxylity costs less on infrastructure alone: $52.75 vs $75.69 a month in one region, and $52.75 vs $167.63 in two.
There's no collector to patch, scale or page on, either. The syslog example also encrypts traffic in transit with WireGuard, which on the DIY side is one more component to run.
Scenario 4
10,000 devices send about 3,300 messages a day each, write-only, into Kinesis Data Streams, as in the Kinesis example. That's about 386 packets a second, right around where Enterprise starts to pay off.
| Line item | AWS reference | Proxylity |
|---|---|---|
| NLB hourly + NLCU (about 1 TB processed) | $22.20 | – |
| NAT gateway | $32.40 | – |
| Kinesis interface endpoint (2 AZ + 1 TB) | $24.40 | – |
| Public IPv4 addresses (3) | $10.80 | – |
| Fargate, 2 × 0.5 vCPU / 1 GB | $28.44 | – |
| AWS, single region | $118.24 | – |
| AWS, two regions | $253.48 | – |
| Proxylity pay-as-you-go (999.9M packets) | – | $1,131.64 |
| Proxylity Enterprise, batch size 10 ($850 + 99.99M batches at $227.48) | – | $1,077.48 |
| Proxylity Enterprise, batch size 50 ($850 + 20.0M batches at $47.50) | – | $897.50 |
Verdict: for 1 billion packets a month, the AWS reference stack is cheaper on infrastructure ($118.24 vs $897.50 to $1,131.64 a month). Proxylity breaks even if it saves 6.2 to 8.1 engineer-hours a month in one region, or 5.2 to 7.0 in two.
Our estimate above is 6 hours saved in one region and 7.5 in two. Call it a wash in one region and a modest win for Proxylity in two.
Scenario 5
A steady 1,000 packets a second, write-only, into Kinesis: 2.59 billion packets a month. This is where Enterprise batch pricing is built to work.
| Line item | AWS reference | Proxylity |
|---|---|---|
| NLB hourly + NLCU (2.59 TB processed) | $31.75 | – |
| NAT gateway | $32.40 | – |
| Kinesis interface endpoint (2 AZ + 2.59 TB) | $40.32 | – |
| Public IPv4 addresses (3) | $10.80 | – |
| Fargate, 2 × 1 vCPU / 2 GB | $56.88 | – |
| AWS, single region | $172.15 | – |
| AWS, two regions | $359.71 | – |
| Proxylity pay-as-you-go (2,592M packets) | – | $2,707.83 |
| Proxylity Enterprise, batch size 10 ($850 + 259.2M batches at $545.90) | – | $1,395.90 |
| Proxylity Enterprise, batch size 50 ($850 + 51.8M batches at $119.14) | – | $969.14 |
Verdict: at a sustained 1,000 packets a second, Enterprise batch pricing roughly halves Proxylity's cost ($969.14 to $1,395.90 vs $2,707.83 pay-as-you-go), but the single-region AWS stack ($172.15) is still about $800 to $1,220 a month cheaper. That's 6.4 to 9.8 engineer-hours.
If you already run containers with 24/7 on-call, your extra operating cost may well be below that. Across two regions the break-even narrows to 4.9 to 8.3 hours.
Putting it together
This table adds the agent-assisted operating estimates above, at $125 an hour: DIY at 8.5 hours in one region ($1,062.50) or 10 hours in two ($1,250), and Proxylity at 2.5 hours ($312.50) either way. For scenarios 4 and 5, Proxylity is shown with Enterprise at batch size 50, with batch size 10 in brackets.
| Workload | DIY, 1 region | Proxylity, 1 region | DIY, 2 regions | Proxylity, 2 regions |
|---|---|---|---|---|
| 2. Sensor telemetry with acks | $1,140.53 | $420.26 | $1,420.30 | $420.26 |
| 3. Syslog from 50 devices | $1,138.19 | $365.25 | $1,417.63 | $365.25 |
| 4. Ingestion, 1B packets | $1,180.74 | $1,210.00 ($1,389.98) | $1,503.48 | $1,210.00 ($1,389.98) |
| 5. Sustained 1,000 pps | $1,234.65 | $1,281.64 ($1,708.40) | $1,609.71 | $1,281.64 ($1,708.40) |
Rule of thumb: divide the infrastructure difference by your loaded hourly rate. That's how many hours a month Proxylity has to save you to break even. In scenarios 1 to 3 it's zero to 15 minutes. In scenarios 4 and 5 it's about 5 to 10 hours, which is close to a real team's operating load, so run the numbers with your own rates.
An honest recommendation
FAQ
With the AWS-recommended setup of a Network Load Balancer, two Fargate tasks across two Availability Zones, a NAT gateway and public IPv4 addresses, the fixed cost is about $74 per month per environment in us-east-1 before any traffic. Across the four production workloads we priced, the single-region AWS bill ranged from about $76 to $172 per month, and from about $168 to $360 per month across two regions with Global Accelerator. The engineering time to operate the stack usually costs more than the infrastructure.
Yes. Network Load Balancer supports UDP and TCP_UDP listeners, and Global Accelerator can front it across regions. UDP target groups are health checked over TCP, HTTP or HTTPS, so the server also needs a health endpoint. Application Load Balancer and Amazon API Gateway do not accept UDP traffic, and AWS Lambda cannot listen on a UDP socket directly.
For development environments, low and moderate volumes, and anything multi-region, usually yes, even before counting engineering time. For example, five dev environments cost about $4 per month on Proxylity versus about $368 on the AWS reference stack. At sustained high volume in a single region, the self-managed infrastructure bill is lower, and the answer depends on how many engineering hours per month the managed service saves you and on your effective batch size with Proxylity Enterprise.
Agents shrink build effort for both approaches, so the one-time build gap gets smaller. In our estimates the build gap falls 57%, from 17.5 to 7.5 engineer-days, while the monthly operating gap falls only 35%, from 11.5 to 7.5 engineer-hours. Work like load testing, safe deploys, incident response and failover drills shrinks less, so operations become about 82% of the three-year difference.
Enterprise is an $850 per month subscription that removes per-listener charges and unlocks batch-based pricing, from $2.50 per million batches and lower as volume grows. It usually beats pay-as-you-go above about 400 packets per second of sustained traffic. It also includes a 99.99% availability SLA, priority support and multi-account support.
Through AWS Marketplace, on your existing AWS bill. The first listener and the first million packets each month are free. Additional listeners cost $0.00139 per hour, about $1 per month, and packets are priced in progressive tiers starting at $1.25 per million and falling to $0.60 per million at very high volume. Your own AWS services, such as Lambda, SQS or Kinesis, are billed by AWS as usual.
Self-managed infrastructure is a strong choice when you have sustained, high, single-region volume and already run a container platform with 24/7 on-call, when you run authoritative game sessions that hold per-match state in memory (Amazon GameLift is built for those), when you need ingress in a region Proxylity does not offer, or when policy rules out a third-party service in the data path.
You pay those AWS charges the same way with either approach, so they cancel out. Proxylity's batching does reduce the number of destination API calls, which can lower request-priced services like Lambda and SQS, but we didn't count that in Proxylity's favor.
Yes. Compute Savings Plans lower Fargate costs, public subnets avoid NAT, and a single task avoids paying for a second one. Each of those gives up some resilience or flexibility that AWS's guidance recommends keeping. We priced the version we'd be comfortable running in production. There are also costs we left out, such as a NAT gateway in each Availability Zone and Shield Advanced.
Sources
Prices were checked when this page was published and can change. Effort estimates are ours. If you think we got something wrong, tell us and we'll fix it.
Your first listener and first million packets each month are free, so a side-by-side proof of concept costs nothing on our side. Or bring your traffic numbers and we'll model it with you, Enterprise included.
Try free with AWS Talk to an expert Get the Agent Skills Open the estimator